netstat(1)

Index for
Section 1

Alphabetical
listing for N

Bottom of
page

netstat(1)
NAME
netstat - Displays network statistics.

SYNOPSIS
/usr/sbin/netstat [-ARgrn | [-Aan] [-f address_family] [-p protocol]]
[interval]

/usr/sbin/netstat [-adgHimMnRrstuv] [-f address_family] [-p protocol]
[interval]

/usr/sbin/netstat [-dnotz] [-I interface [-c | -s]] [interval]

The netstat command displays network-related data in various formats.

OPTIONS
-a Displays the state of sockets related to the Internet protocol.
Includes sockets for processes such as servers that are currently
listening at a socket but are otherwise inactive.

-A Displays either the address of any protocol control blocks associated
with sockets or the addresses of routing table entries with bitmasks.
Typically, this option is used for debugging.

-d Displays the number of dropped packets; for use with the -I interface
or -i options. You can also specify an interval argument (in seconds).

-f address_family
Limits reports to the specified address family. The address families
that can be specified might include the following:

inet
Specifies reports of the AF_INET family, if present in the kernel.

inet6
Specifies reports of the AF_INET6 family, if present in the kernel.

unix
Specifies reports of the AF_UNIX family, if present in the kernel.

all Lists information about all address families in the system.

any Lists information about any address families in the system.

-g Displays statistics since the system was last booted. By default, the
command displays statistics since they were last zeroed. Use this
option with the -p and -s options only.

-H Displays the current ARP table (behaves like arp -a).

-i Displays the state of configured interfaces. (Interfaces that are
statically configured into the system, but not located at system
startup, are not shown.)

When used with the -a option, it displays IP (IPv4 and IPv6) and link-
level addresses associated with the interfaces.

You can use the -i option to retrieve your system's hardware address.

-I interface
Displays information about the specified interface.

-I interface -c
Displays the current access filter for the specified network interface.
See ifaccess.conf(4) for more information.

-I interface -s
Displays the DNA Data Link Layer counters (64-bit values) for the
specified network interface and the adapter's status and
characteristics. See Network Administration: Connections for a
description of the display fields.

-m Displays information about memory allocated to data structures
associated with network operations.

-M Displays Internet protocol multicast routing information. When used
with the -s option, it displays IP (IPv4 and IPv6) multicast
statistics.

-n Displays network address in numerical format with network masks in CIDR
format. When this option is not specified, the address is displayed as
hostname and port number. This option can be used with any of the
display formats.

-o Displays the DNA Data Link Layer counters (old 32-bit values) for the
specified network interface and the adapter's status and
characteristics. Use this options only with the -I interface -s
command. See Network Administration: Connections for a description of
the display fields.

-pprotocol
Displays statistics for protocol, which you can specify as a well known
name or an alias. Supported protocol names and their aliases are listed
in /etc/protocols. A null listing (0) means that there is no data to
report. If routines to report statistics for a specified protocol are
not implemented on this system, netstat reports that the protocol is
unknown.

-r Displays the host's routing tables. When used with the -s option, shows
the host's routing statistics instead of routing tables.

-R Display's the host's routing tables on each Resource Affinity Domain
(RAD), if your system has NUMA-capable hardware.

-s Displays statistics for each protocol.

-t Displays timer information; for use with the -I interface or -i
options.

-u Displays information about domain sockets (UNIX domain).

-v Displays more verbose output when specified with the -r option. In
this case, route metric values are displayed.

-z Sets the network interface counters or protocol statistics counters to
zero. This option must be specified with either the -I interface
option or the -s or -p options. In addition, you must be superuser to
use this option.

DESCRIPTION
The interval argument specifies in seconds the interval for updating and
displaying information. The first line of the display shows cumulative
statistics; subsequent lines show statistics recorded during interval.

Default Display

When used without options, the netstat command displays a list of active
sockets for each protocol. The default display shows the following items:

· Local and remote addresses

· Send and receive queue sizes (in bytes)

· Protocol

· State

Address formats are of the form host.port or network.port if a socket's
address specifies a network but no specific host address. The host and
network address are displayed symbolically unless -n is specified.

Interface Display

The network interface display format provides a table of cumulative
statistics for the following:

· Interface name

· Maximum Transmission Unit (MTU)

· Network Address

· Packets received (Ipkts)

· Packets received in error (Ierrs)

· Packets transferred (Opkts)

· Outgoing packets in error (Oerrs)

· Collisions

Note that the collisions item has different meanings for different
network interfaces.

· Drops (optional with -d)

· Timers (optional with -t)

Routing Table Display

A route consists of a destination host or network and a gateway to use when
forwarding packets. Direct routes are created automatically for each
interface attached to the local host when you issue the ifconfig command.
In addition, loopback routes are created automatically for each interface
address that is configured with the ifconfig command. Routes can be
modified automatically in response to the prevailing condition of the
network.

The routing-table display format indicates available routes and the status
of each in the following fields:

Flags
Displays the state of the route as one or more of the following:

c This is a cloned route.

C This route is a cloning route that was created by the route
command.

D This route was dynamically created by a redirect.

f Fragment to path MTU size is disabled on this route.

G This route is to a gateway.

H This route is to a host.

I This route contains valid link-layer information.

L This route is a loopback route that was created by the kernel.

M This route was modified by a redirect.

p Path MTU discovery is disabled on this route.

P This route was created by the Path MTU discovery process.

R This is a reject route that was created by the route command.

S This is a static route that was created by the route command.

U Up, or available.

refcnt
Gives the current number of active uses for the route. Connection-
oriented protocols hold on to a single route for the duration of a
connection; connectionless protocols obtain routes in the process of
sending to a destination.

use Provides a count of the number of packets sent using the route.

interface
Indicates the network interface used for the route.

When the -v option is specified, the routing table display includes the
route metrics. An asterisk (*) indicates the metric is locked. See
route(8) for additional information on routing.

DIAGNOSTICS
no namelist: unable to connect to kloadsrv daemon
Verify that the kloadsrv daemon is running. If it is not, start it.
See kloadsrv(8) for more information.

no namelist: requested symbols not found in kernel
Make sure that you have not replaced the running kernel with a new
kernel. You might need to reboot the system to correct this problem.

EXAMPLES
1. To show the state of the configured interfaces, enter:
$ netstat -i

2. To show the routing tables, enter:
$ netstat -r

The resulting display looks like the following:
Routing Tables
Destination Gateway Flags Refs Use Interface
Netmasks:
Inet 255.255.255.0

Route Tree for Protocol Family 2:
default 16.55.5.5 UG 13 38618 ln0
localhost 16.55.5.4 UH 2 29 lo0
ethernet 16.55.5.3 U 98 66760 ln0

(Output may be formatted differently on your system.)

3. To show the routing tables with network addresses, enter:
$ netstat -rn

The resulting display looks like the following:
Routing tables
Destination Gateway Flags Refs Use Interface
Netmasks:
Inet 0.0.0.0
Inet 255.0.0.0
Inet 255.255.0.0
Inet 255.255.252.0
Inet 255.255.255.0
Inet 255.255.255.224

Route Tree for Protocol Family 2:
default 16.140.28.1 UG 0 6004465 tu0
16.140.128/24 16.140.128.198 U 4 181451 tu0
127.0.0.1 127.0.0.1 UH 0 0 lo0
194.224/16 127.0.0.1 UG 0 3 lo0
194.226/16 127.0.0.1 UGR 0 0 lo0
198.119.1/24 198.119.19.76 U 1 867 le0
198.119.19.64/27 198.119.19.76 U 0 1 le0
198.119.64.80 198.119.19.24 UGH 0 0 le0
130.200/16 16.140.128.1 UG 0 0 tu0

4. To produce the default display for network connections, enter:
netstat

The resulting display might include the following headings:
Active Internet connections
Proto Recv-Q Send-Q Local Address Foreign Address (state)

5. To set the ln0 interface counters to zero, enter:
netstat -Iln0 -z

6. To display IPv6 routing entries, enter:
# netstat -rnf inet6

Routing tables
Destination Gateway Flags Refs Use Interface

Route Tree for Protocol Family 26
default Link#8 UCL 0 0 ipt0
default Link#1 UCL 0 0 ln0
default fe80::a00:2bff:fe2d:2b2 UG 0 0 ln0
3ffe:1200:4110:1::/64 Link#1 UCL 0 0 ln0
3ffe:1200:4110:1:a00:2bff:fe2c:f632 Link#1 UH 1 0 ln0
fe80::/10 Link#8 UCL 0 0 ipt0
fe80::/10 Link#1 UCL 0 0 ln0
fe80::108c:1056 Link#8 UHLc 1 4 ipt0
fe80::108c:80e3 Link#8 UHLc 0 0 ipt0
fe80::a00:2bff:fe2d:2b2 Link#1 UHLc 1 0 ln0
ff02::/16 Link#1 UCL 0 0 ln0
ff02::/16 Link#8 UCL 0 0 ipt0
ff02::1 16.140.128.227 UHLVc 0 8 ipt0
ff02::1 33:33:0:0:0:1 UHLVc 0 3 ln0
ff02::2 33:33:0:0:0:2 UHLVc 0 1 ln0
ff02::2 16.140.128.227 UHLVc 1 2 ipt0
ff02::9 16.140.128.227 UHLVc 0 4 ipt0

7. To display active IPv6 connections, enter:
# netstat -af inet6

Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp 0 0 3ffe:1200:4110:1:a00:2bff:fe2c:f632.1054 host1.corp.com.telnet ESTABLISHED
tcp 0 0 *.finger *.* LISTEN
tcp 0 0 *.telnet *.* LISTEN
tcp 0 0 *.ftp *.* LISTEN

netstat(1)

NAME

SYNOPSIS

OPTIONS

DESCRIPTION

DIAGNOSTICS

EXAMPLES

SEE ALSO