1 '\" te
2 .\" Copyright (C) 2002, Sun Microsystems, Inc. All Rights Reserved
3 .\" Copyright 1989 AT&T
4 .\" Copyright (c) 1983 Regents of the University of California. All rights reserved. The Berkeley software License Agreement specifies the terms and conditions for redistribution.
5 .TH NETSTAT 1M "Sep 02, 2015"
6 .SH NAME
7 netstat \- show network status
8 .SH SYNOPSIS
9 .LP
10 .nf
11 \fBnetstat\fR [\fB-anvR\fR] [\fB-f\fR \fIaddress_family\fR] [\fB-P\fR \fIprotocol\fR]
12 .fi
13
14 .LP
15 .nf
16 \fBnetstat\fR \fB-g\fR [\fB-nv\fR] [\fB-f\fR \fIaddress_family\fR]
17 .fi
18
19 .LP
20 .nf
21 \fBnetstat\fR \fB-p\fR [\fB-n\fR] [\fB-f\fR \fIaddress_family\fR]
22 .fi
23
24 .LP
25 .nf
26 \fBnetstat\fR \fB-s\fR [\fB-f\fR \fIaddress_family\fR] [\fB-P\fR \fIprotocol\fR]
27 [\fB-T\fR u | d ] [\fIinterval\fR [\fIcount\fR]]
28 .fi
29
30 .LP
31 .nf
32 \fBnetstat\fR \fB-m\fR [\fB-T\fR u | d ] [\fB-v\fR] [\fIinterval\fR [\fIcount\fR]]
33 .fi
34
35 .LP
36 .nf
37 \fBnetstat\fR \fB-i\fR [\fB-I\fR \fIinterface\fR] [\fB-an\fR] [\fB-f\fR \fIaddress_family\fR]
38 [\fB-T\fR u | d ] [\fIinterval\fR [\fIcount\fR]]
39 .fi
40
41 .LP
42 .nf
43 \fBnetstat\fR \fB-r\fR [\fB-anvR\fR] [\fB-f\fR \fIaddress_family\fR | \fIfilter\fR]
44 .fi
45
46 .LP
47 .nf
48 \fBnetstat\fR \fB-M\fR [\fB-ns\fR] [\fB-f\fR \fIaddress_family\fR]
49 .fi
50
51 .LP
52 .nf
53 \fBnetstat\fR \fB-D\fR [\fB-I\fR \fIinterface\fR] [\fB-f\fR \fIaddress_family\fR]
54 .fi
55
56 .SH DESCRIPTION
57 .LP
58 The \fBnetstat\fR command displays the contents of certain network-related data
59 structures in various formats, depending on the options you select.
60 .LP
61 The \fBnetstat\fR command has the several forms shown in the SYNOPSIS section,
62 above, listed as follows:
63 .RS +4
64 .TP
65 .ie t \(bu
66 .el o
67 The first form of the command (with no required arguments) displays a list of
68 active sockets for each protocol.
69 .RE
70 .RS +4
71 .TP
72 .ie t \(bu
73 .el o
74 The second, third, and fourth forms (\fB-g\fR, \fB-p\fR, and \fB-s\fR options)
75 display information from various network data structures.
76 .RE
77 .RS +4
78 .TP
79 .ie t \(bu
80 .el o
81 The fifth form (\fB-m\fR option) displays STREAMS memory statistics.
82 .RE
83 .RS +4
84 .TP
85 .ie t \(bu
86 .el o
87 The sixth form (\fB-i\fR option) shows the state of the interfaces.
88 .RE
89 .RS +4
90 .TP
91 .ie t \(bu
92 .el o
93 The seventh form (\fB-r\fR option) displays the routing table.
94 .RE
95 .RS +4
96 .TP
97 .ie t \(bu
98 .el o
99 The eighth form (\fB-M\fR option) displays the multicast routing table.
100 .RE
101 .RS +4
102 .TP
103 .ie t \(bu
104 .el o
105 The ninth form (\fB-D\fR option) displays the state of \fBDHCP\fR on one or all
106 interfaces.
107 .RE
108 .LP
109 These forms are described in greater detail below.
110 .LP
111 With no arguments (the first form), \fBnetstat\fR displays connected sockets
112 for \fBPF_INET\fR, \fBPF_INET6\fR, and \fBPF_UNIX\fR, unless modified otherwise
113 by the \fB-f\fR option.
114 .SH OPTIONS
115 .ne 2
116 .na
117 \fB\fB-a\fR\fR
118 .ad
119 .sp .6
120 .RS 4n
121 Show the state of all sockets, all routing table entries, or all interfaces,
122 both physical and logical. Normally, listener sockets used by server processes
123 are not shown. Under most conditions, only interface, host, network, and
124 default routes are shown and only the status of physical interfaces is shown.
125 .RE
126
127 .sp
128 .ne 2
129 .na
130 \fB\fB-f\fR \fIaddress_family\fR\fR
131 .ad
132 .sp .6
133 .RS 4n
134 Limit all displays to those of the specified \fIaddress_family\fR. The value of
135 \fIaddress_family\fR can be one of the following:
136 .sp
137 .ne 2
138 .na
139 \fB\fBinet\fR\fR
140 .ad
141 .RS 9n
142 For the \fBAF_INET\fR address family showing IPv4 information.
143 .RE
144
145 .sp
146 .ne 2
147 .na
148 \fB\fBinet6\fR\fR
149 .ad
150 .RS 9n
151 For the \fBAF_INET6\fR address family showing IPv6 information.
152 .RE
153
154 .sp
155 .ne 2
156 .na
157 \fB\fBunix\fR\fR
158 .ad
159 .RS 9n
160 For the \fBAF_UNIX\fR address family.
161 .RE
162
163 .RE
164
165 .sp
166 .ne 2
167 .na
168 \fB\fB-f\fR \fIfilter\fR\fR
169 .ad
170 .sp .6
171 .RS 4n
172 With \fB-r\fR only, limit the display of routes to those matching the specified
173 filter. A filter rule consists of a \fIkeyword\fR:\fIvalue\fR pair. The known
174 keywords and the value syntax are:
175 .sp
176 .ne 2
177 .na
178 \fB\fBaf:\fR{\fBinet\fR|\fBinet6\fR|\fBunix\fR|\fInumber\fR}\fR
179 .ad
180 .sp .6
181 .RS 4n
182 Selects an address family. This is identical to \fB-f\fR \fIaddress_family\fR
183 and both syntaxes are supported.
184 .RE
185
186 .sp
187 .ne 2
188 .na
189 \fB\fBoutif\fR:{\fIname\fR|\fIifIndex\fR|\fBany\fR|\fBnone\fR}\fR
190 .ad
191 .sp .6
192 .RS 4n
193 Selects an output interface. You can specify the interface by name (such as
194 \fBhme0\fR) or by \fBifIndex\fR number (for example, \fB2\fR). If \fBany\fR is
195 used, the filter matches all routes having a specified interface (anything
196 other than null). If \fBnone\fR is used, the filter matches all routes having a
197 null interface. Note that you can view the index number (\fIifIndex\fR) for an
198 interface with the \fB-a\fR option of \fBifconfig\fR(1M).
199 .RE
200
201 .sp
202 .ne 2
203 .na
204 \fB\fBdst\fR:{\fIip-address\fR[/\fImask\fR]|\fBany\fR|\fBnone\fR}\fR
205 .ad
206 .sp .6
207 .RS 4n
208 Selects a destination IP address. If specified with a mask length, then any
209 routes with matching or longer (more specific) masks are selected. If \fBany\fR
210 is used, then all but addresses but 0 are selected. If \fBnone\fR is used, then
211 address 0 is selected.
212 .RE
213
214 .sp
215 .ne 2
216 .na
217 \fB\fBflags:\fR[\fB+ -\fR]?[\fBABDGHLMSU\fR]\fB+\fR\fR
218 .ad
219 .sp .6
220 .RS 4n
221 Selects routes tagged with the specified flags. By default, the flags as
222 specified must be set in order to match. With a leading \fB+\fR, the flags
223 specified must be set but others are ignored. With a leading \fB-\fR, the flags
224 specified must not be set and others are permitted.
225 .RE
226
227 You can specify multiple instances of \fB-f\fR to specify multiple filters. For
228 example:
229 .sp
230 .in +2
231 .nf
232 % netstat -nr -f outif:hme0 -f outif:hme1 -f dst:10.0.0.0/8
233 .fi
234 .in -2
235 .sp
236
237 The preceding command displays routes within network 10.0.0.0/8, with mask
238 length 8 or greater, and an output interface of either \fBhme0\fR or
239 \fBhme1\fR, and excludes all other routes.
240 .RE
241
242 .sp
243 .ne 2
244 .na
245 \fB\fB-g\fR\fR
246 .ad
247 .sp .6
248 .RS 4n
249 Show the multicast group memberships for all interfaces. If the \fB-v\fR option
250 is included, source-specific membership information is also displayed. See
251 DISPLAYS, below.
252 .RE
253
254 .sp
255 .ne 2
256 .na
257 \fB\fB-i\fR\fR
258 .ad
259 .sp .6
260 .RS 4n
261 Show the state of the interfaces that are used for \fBIP\fR traffic. Normally
262 this shows statistics for the physical interfaces. When combined with the
263 \fB-a\fR option, this will also report information for the logical interfaces.
264 See \fBifconfig\fR(1M).
265 .RE
266
267 .sp
268 .ne 2
269 .na
270 \fB\fB-m\fR\fR
271 .ad
272 .sp .6
273 .RS 4n
274 Show the STREAMS memory statistics.
275 .RE
276
277 .sp
278 .ne 2
279 .na
280 \fB\fB-n\fR\fR
281 .ad
282 .sp .6
283 .RS 4n
284 Show network addresses as numbers. \fBnetstat\fR normally displays addresses as
285 symbols. This option may be used with any of the display formats.
286 .RE
287
288 .sp
289 .ne 2
290 .na
291 \fB\fB-p\fR\fR
292 .ad
293 .sp .6
294 .RS 4n
295 Show the net to media tables. See DISPLAYS, below.
296 .RE
297
298 .sp
299 .ne 2
300 .na
301 \fB\fB-r\fR\fR
302 .ad
303 .sp .6
304 .RS 4n
305 Show the routing tables. Normally, only interface, host, network, and default
306 routes are shown, but when this option is combined with the \fB-a\fR option,
307 all routes will be displayed, including cache. If you have not set up a
308 multicast route, \fB-ra\fR might not show any multicast routing entries,
309 although the kernel will derive such an entry if needed.
310 .RE
311
312 .sp
313 .ne 2
314 .na
315 \fB\fB-s\fR\fR
316 .ad
317 .sp .6
318 .RS 4n
319 Show per-protocol statistics. When used with the \fB-M\fR option, show
320 multicast routing statistics instead. When used with the \fB-a\fR option,
321 per-interface statistics will be displayed, when available, in addition to
322 statistics global to the system. See DISPLAYS, below.
323 .RE
324
325 .sp
326 .ne 2
327 .na
328 \fB\fB-T\fR \fBu\fR | \fBd\fR\fR
329 .ad
330 .sp .6
331 .RS 4n
332 Display a time stamp.
333 .sp
334 Specify \fBu\fR for a printed representation of the internal representation of
335 time. See \fBtime\fR(2). Specify \fBd\fR for standard date format. See
336 \fBdate\fR(1).
337 .RE
338
339 .sp
340 .ne 2
341 .na
342 \fB\fB-v\fR\fR
343 .ad
344 .sp .6
345 .RS 4n
346 Verbose. Show additional information for the sockets, STREAMS memory
347 statistics, routing table, and multicast group memberships.
348 .RE
349
350 .sp
351 .ne 2
352 .na
353 \fB\fB-I\fR \fIinterface\fR\fR
354 .ad
355 .sp .6
356 .RS 4n
357 Show the state of a particular interface. \fIinterface\fR can be any valid
358 interface such as \fBhme0\fR or \fBeri0\fR. Normally, the status and statistics
359 for physical interfaces are displayed. When this option is combined with the
360 \fB-a\fR option, information for the logical interfaces is also reported.
361 .RE
362
363 .sp
364 .ne 2
365 .na
366 \fB\fB-M\fR\fR
367 .ad
368 .sp .6
369 .RS 4n
370 Show the multicast routing tables. When used with the \fB-s\fR option, show
371 multicast routing statistics instead.
372 .RE
373
374 .sp
375 .ne 2
376 .na
377 \fB\fB-P\fR \fIprotocol\fR\fR
378 .ad
379 .sp .6
380 .RS 4n
381 Limit display of statistics or state of all sockets to those applicable to
382 \fIprotocol\fR. The protocol can be one of \fBip\fR, \fBipv6\fR, \fBicmp\fR,
383 \fBicmpv6\fR, \fBicmp\fR, \fBicmpv6\fR, \fBigmp\fR, \fBudp\fR, \fBtcp\fR,
384 \fBrawip\fR. \fBrawip\fR can also be specified as \fBraw\fR. The command
385 accepts protocol options only as all lowercase.
386 .RE
387
388 .sp
389 .ne 2
390 .na
391 \fB\fB-D\fR\fR
392 .ad
393 .sp .6
394 .RS 4n
395 Show the status of \fBDHCP\fR configured interfaces.
396 .RE
397
398 .sp
399 .ne 2
400 .na
401 \fB\fB-R\fR\fR
402 .ad
403 .sp .6
404 .RS 4n
405 This modifier displays extended security attributes for sockets and routing
406 table entries. The \fB-R\fR modifier is available only if the system is
407 configured with the Solaris Trusted Extensions feature.
408 .sp
409 With \fB-r\fR only, this option displays the routing entries' gateway security
410 attributes. See \fBroute\fR(1M) for more information on security attributes.
411 .sp
412 When displaying socket information using the first form of the command, this
413 option displays additional information for Multi-Level Port(MLP) sockets. This
414 includes:
415 .RS +4
416 .TP
417 .ie t \(bu
418 .el o
419 The label for the peer if the socket is connected.
420 .RE
421 .RS +4
422 .TP
423 .ie t \(bu
424 .el o
425 The following flags can be appended to the socket's "State" output:
426 .RS
427
428 .sp
429 .ne 2
430 .na
431 \fB\fBP\fR\fR
432 .ad
433 .RS 5n
434 The socket is a MLP on zone-private IP addresses.
435 .RE
436
437 .sp
438 .ne 2
439 .na
440 \fB\fBS\fR\fR
441 .ad
442 .RS 5n
443 The socket is a MLP on IP addresses shared between zones.
444 .RE
445 .SH OPERANDS
446 .ne 2
447 .na
448 \fB\fIinterval\fR\fR
449 .ad
450 .RS 12n
451 Display statistics accumulated since last display every \fIinterval\fR seconds,
452 repeating forever, unless \fIcount\fR is specified. When invoked with
453 \fIinterval\fR, the first row of netstat output shows statistics accumulated
454 since last reboot.
455 .sp
456 The following options support \fIinterval\fR: \fB-i\fR, \fB-m\fR, \fB-s\fR and
457 \fB-Ms\fR. Some values are configuration parameters and are just redisplayed at
458 each interval.
459 .RE
460
461 .sp
462 .ne 2
463 .na
464 \fB\fIcount\fR\fR
465 .ad
466 .RS 12n
467 Display interface statistics the number of times specified by \fIcount\fR, at
468 the interval specified by \fIinterval\fR.
469 .RE
470
471 .SH DISPLAYS
472 .SS "Active Sockets (First Form)"
473 .LP
474 The display for each active socket shows the local and remote address, the send
475 and receive queue sizes (in bytes), the send and receive windows (in bytes),
476 and the internal state of the protocol.
477 .LP
478 The symbolic format normally used to display socket addresses is either:
479 .sp
480 .in +2
481 .nf
482 \fBhostname\fR.\fIport\fR
483 .fi
484 .in -2
485 .sp
486 when the name of the host is specified, or
487 .sp
488 .in +2
489 .nf
490 \fInetwork\fR.\fIport\fR
491 .fi
492 .in -2
493 .sp
494 if a socket address specifies a network but no specific host.
495 .LP
496 The numeric host address or network number associated with the socket is used
497 to look up the corresponding symbolic hostname or network name in the
498 \fIhosts\fR or \fInetworks\fR database.
499 .LP
500 If the network or hostname for an address is not known, or if the \fB-n\fR
501 option is specified, the numerical network address is shown. Unspecified, or
502 "wildcard", addresses and ports appear as an asterisk (\fB*\fR). For more
503 information regarding the Internet naming conventions, refer to \fBinet\fR(7P)
504 and \fBinet6\fR(7P).
505 .LP
506 For SCTP sockets, because an endpoint can be represented by multiple addresses,
507 the verbose option (\fB-v\fR) displays the list of all the local and remote
508 addresses.
509 .SS "\fITCP Sockets\fR"
510 .LP
511 The possible state values for \fBTCP\fR sockets are as follows:
512 .sp
513 .ne 2
514 .na
515 \fB\fBBOUND\fR\fR
516 .ad
517 .RS 16n
518 Bound, ready to connect or listen.
519 .RE
520
521 .sp
522 .ne 2
523 .na
524 \fB\fBCLOSED\fR\fR
525 .ad
526 .RS 16n
527 Closed. The socket is not being used.
528 .RE
529
530 .sp
531 .ne 2
532 .na
533 \fB\fBCLOSING\fR\fR
534 .ad
535 .RS 16n
536 Closed, then remote shutdown; awaiting acknowledgment.
537 .RE
538
539 .sp
540 .ne 2
541 .na
542 \fB\fBCLOSE_WAIT\fR\fR
543 .ad
544 .RS 16n
545 Remote shutdown; waiting for the socket to close.
546 .RE
547
548 .sp
549 .ne 2
550 .na
551 \fB\fBESTABLISHED\fR\fR
552 .ad
553 .RS 16n
554 Connection has been established.
555 .RE
556
557 .sp
558 .ne 2
559 .na
560 \fB\fBFIN_WAIT_1\fR\fR
561 .ad
562 .RS 16n
563 Socket closed; shutting down connection.
564 .RE
565
566 .sp
567 .ne 2
568 .na
569 \fB\fBFIN_WAIT_2\fR\fR
570 .ad
571 .RS 16n
572 Socket closed; waiting for shutdown from remote.
573 .RE
574
575 .sp
576 .ne 2
577 .na
578 \fB\fBIDLE\fR\fR
579 .ad
580 .RS 16n
581 Idle, opened but not bound.
582 .RE
583
584 .sp
585 .ne 2
586 .na
587 \fB\fBLAST_ACK\fR\fR
588 .ad
589 .RS 16n
590 Remote shutdown, then closed; awaiting acknowledgment.
591 .RE
592
593 .sp
594 .ne 2
595 .na
596 \fB\fBLISTEN\fR\fR
597 .ad
598 .RS 16n
599 Listening for incoming connections.
600 .RE
601
602 .sp
603 .ne 2
604 .na
605 \fB\fBSYN_RECEIVED\fR\fR
606 .ad
607 .RS 16n
608 Initial synchronization of the connection under way.
609 .RE
610
611 .sp
612 .ne 2
613 .na
614 \fB\fBSYN_SENT\fR\fR
615 .ad
616 .RS 16n
617 Actively trying to establish connection.
618 .RE
619
620 .sp
621 .ne 2
622 .na
623 \fB\fBTIME_WAIT\fR\fR
624 .ad
625 .RS 16n
626 Wait after close for remote shutdown retransmission.
627 .RE
628
629 .SS "\fISCTP Sockets\fR"
630 .LP
631 The possible state values for SCTP sockets are as follows:
632 .sp
633 .ne 2
634 .na
635 \fB\fBCLOSED\fR\fR
636 .ad
637 .RS 21n
638 Closed. The socket is not being used.
639 .RE
640
641 .sp
642 .ne 2
643 .na
644 \fB\fBLISTEN\fR\fR
645 .ad
646 .RS 21n
647 Listening for incoming associations.
648 .RE
649
650 .sp
651 .ne 2
652 .na
653 \fB\fBESTABLISHED\fR\fR
654 .ad
655 .RS 21n
656 Association has been established.
657 .RE
658
659 .sp
660 .ne 2
661 .na
662 \fB\fBCOOKIE_WAIT\fR\fR
663 .ad
664 .RS 21n
665 \fBINIT\fR has been sent to the peer, awaiting acknowledgment.
666 .RE
667
668 .sp
669 .ne 2
670 .na
671 \fB\fBCOOKIE_ECHOED\fR\fR
672 .ad
673 .RS 21n
674 State cookie from the INIT-ACK has been sent to the peer, awaiting
675 acknowledgement.
676 .RE
677
678 .sp
679 .ne 2
680 .na
681 \fB\fBSHUTDOWN_PENDING\fR\fR
682 .ad
683 .RS 21n
684 \fBSHUTDOWN\fR has been received from the upper layer, awaiting acknowledgement
685 of all outstanding \fBDATA\fR from the peer.
686 .RE
687
688 .sp
689 .ne 2
690 .na
691 \fB\fBSHUTDOWN_SENT\fR\fR
692 .ad
693 .RS 21n
694 All outstanding data has been acknowledged in the \fBSHUTDOWN_SENT\fR state.
695 \fBSHUTDOWN\fR has been sent to the peer, awaiting acknowledgement.
696 .RE
697
698 .sp
699 .ne 2
700 .na
701 \fB\fBSHUTDOWN_RECEIVED\fR\fR
702 .ad
703 .RS 21n
704 \fBSHUTDOWN\fR has been received from the peer, awaiting acknowledgement of all
705 outstanding \fBDATA\fR.
706 .RE
707
708 .sp
709 .ne 2
710 .na
711 \fB\fBSHUTDOWN_ACK_SENT\fR\fR
712 .ad
713 .RS 21n
714 All outstanding data has been acknowledged in the \fBSHUTDOWN_RECEIVED\fR
715 state. \fBSHUTDOWN_ACK\fR has been sent to the peer.
716 .RE
717
718 .SS "Network Data Structures (Second Through Fifth Forms)"
719 .LP
720 The form of the display depends upon which of the \fB-g\fR, \fB-m\fR, \fB-p\fR,
721 or \fB-s\fR options you select.
722 .sp
723 .ne 2
724 .na
725 \fB\fB-g\fR\fR
726 .ad
727 .RS 6n
728 Displays the list of multicast group membership.
729 .RE
730
731 .sp
732 .ne 2
733 .na
734 \fB\fB-m\fR\fR
735 .ad
736 .RS 6n
737 Displays the memory usage, for example, STREAMS mblks.
738 .RE
739
740 .sp
741 .ne 2
742 .na
743 \fB\fB-p\fR\fR
744 .ad
745 .RS 6n
746 Displays the net to media mapping table. For IPv4, the address resolution table
747 is displayed. See \fBarp\fR(1M). For IPv6, the neighbor cache is displayed.
748 .RE
749
750 .sp
751 .ne 2
752 .na
753 \fB\fB-s\fR\fR
754 .ad
755 .RS 6n
756 Displays the statistics for the various protocol layers.
757 .RE
758
759 .sp
760 .LP
761 The statistics use the MIB specified variables. The defined values for
762 \fBipForwarding\fR are:
763 .sp
764 .ne 2
765 .na
766 \fB\fBforwarding(1)\fR\fR
767 .ad
768 .RS 21n
769 Acting as a gateway.
770 .RE
771
772 .sp
773 .ne 2
774 .na
775 \fB\fBnot-forwarding(2)\fR\fR
776 .ad
777 .RS 21n
778 Not acting as a gateway.
779 .RE
780
781 .sp
782 .LP
783 The IPv6 and ICMPv6 protocol layers maintain per-interface statistics. If the
784 \fB-a\fR option is specified with the \fB-s\fR option, then the per-interface
785 statistics as well as the total sums are displayed. Otherwise, just the sum of
786 the statistics are shown.
787 .LP
788 For the second, third, and fourth forms of the command, you must specify at
789 least \fB-g\fR, \fB-p\fR, or \fB-s\fR. You can specify any combination of these
790 options. You can also specify \fB-m\fR (the fifth form) with any set of the
791 \fB-g\fR, \fB-p\fR, and \fB-s\fR options. If you specify more than one of these
792 options, \fBnetstat\fR displays the information for each one of them.
793 .SS "Interface Status (Sixth Form)"
794 .LP
795 The interface status display lists information for all current interfaces, one
796 interface per line. If an interface is specified using the \fB-I\fR option, it
797 displays information for only the specified interface.
798 .LP
799 The list consists of the interface name, \fBmtu\fR (maximum transmission unit,
800 or maximum packet size)(see \fBifconfig\fR(1M)), the network to which the
801 interface is attached, addresses for each interface, and counter associated
802 with the interface. The counters show the number of input packets, input
803 errors, output packets, output errors, and collisions, respectively. For
804 Point-to-Point interfaces, the Net/Dest field is the name or address on the
805 other side of the link.
806 .LP
807 If the \fB-a\fR option is specified with either the \fB-i\fR option or the
808 \fB-I\fR option, then the output includes names of the physical interface(s),
809 counts for input packets and output packets for each logical interface, plus
810 additional information.
811 .LP
812 If the \fB-n\fR option is specified, the list displays the IP address instead
813 of the interface name.
814 .LP
815 If an optional \fIinterval\fR is specified, the output will be continually
816 displayed in \fIinterval\fR seconds until interrupted by the user or until
817 \fIcount\fR is reached. See OPERANDS.
818 .LP
819 The physical interface is specified using the \fB-I\fR option. When used with
820 the \fIinterval\fR operand, output for the \fB-I\fR option has the following
821 format:
822 .sp
823 .in +2
824 .nf
825 input eri0 output input (Total) output
826 packets errs packets errs colls packets errs packets errs colls
827 227681 0 659471 1 502 261331 0 99597 1 502
828 10 0 0 0 0 10 0 0 0 0
829 8 0 0 0 0 8 0 0 0 0
830 10 0 2 0 0 10 0 2 0 0
831 .fi
832 .in -2
833 .sp
834 .LP
835 If the input interface is not specified, the first interface of address family
836 \fBinet\fR or \fBinet6\fR will be displayed.
837 .SS "Routing Table (Seventh Form)"
838 .LP
839 The routing table display lists the available routes and the status of each.
840 Each route consists of a destination host or network, and a gateway to use in
841 forwarding packets. The \fIflags\fR column shows the status of the route. These
842 flags are as follows:
843 .sp
844 .ne 2
845 .na
846 \fB\fBU\fR\fR
847 .ad
848 .RS 5n
849 Indicates route is \fBup\fR.
850 .RE
851
852 .sp
853 .ne 2
854 .na
855 \fB\fBG\fR\fR
856 .ad
857 .RS 5n
858 Route is to a gateway.
859 .RE
860
861 .sp
862 .ne 2
863 .na
864 \fB\fBH\fR\fR
865 .ad
866 .RS 5n
867 Route is to a host and not a network.
868 .RE
869
870 .sp
871 .ne 2
872 .na
873 \fB\fBM\fR\fR
874 .ad
875 .RS 5n
876 Redundant route established with the \fB-multirt\fR option.
877 .RE
878
879 .sp
880 .ne 2
881 .na
882 \fB\fBS\fR\fR
883 .ad
884 .RS 5n
885 Route was established using the \fB-setsrc\fR option.
886 .RE
887
888 .sp
889 .ne 2
890 .na
891 \fB\fBD\fR\fR
892 .ad
893 .RS 5n
894 Route was created dynamically by a redirect.
895 .RE
896
897 .sp
898 .LP
899 If the \fB-a\fR option is specified, there will be routing entries with the
900 following flags:
901 .sp
902 .ne 2
903 .na
904 \fB\fBA\fR\fR
905 .ad
906 .RS 5n
907 Combined routing and address resolution entries.
908 .RE
909
910 .sp
911 .ne 2
912 .na
913 \fB\fBB\fR\fR
914 .ad
915 .RS 5n
916 Broadcast addresses.
917 .RE
918
919 .sp
920 .ne 2
921 .na
922 \fB\fBL\fR\fR
923 .ad
924 .RS 5n
925 Local addresses for the host.
926 .RE
927
928 .LP
929 Interface routes are created for each interface attached to the local host; the
930 gateway field for such entries shows the address of the outgoing interface.
931 .LP
932 The \fBuse\fR column displays the number of packets sent using a combined
933 routing and address resolution (\fBA\fR) or a broadcast (\fBB\fR) route. For a
934 local (\fBL\fR) route, this count is the number of packets received, and for
935 all other routes it is the number of times the routing entry has been used to
936 create a new combined route and address resolution entry.
937 .LP
938 The \fIinterface\fR entry indicates the network interface utilized for the
939 route.
940 .SS "Multicast Routing Tables (Eighth Form)"
941 .LP
942 The multicast routing table consists of the virtual interface table and the
943 actual routing table.
944 .SS "DHCP Interface Information (Ninth Form)"
945 .LP
946 The \fBDHCP\fR interface information consists of the interface name, its
947 current state, lease information, packet counts, and a list of flags.
948 .LP
949 The states correlate with the specifications set forth in \fIRFC 2131\fR.
950 .LP
951 Lease information includes:
952 .RS +4
953 .TP
954 .ie t \(bu
955 .el o
956 when the lease began;
957 .RE
958 .RS +4
959 .TP
960 .ie t \(bu
961 .el o
962 when lease renewal will begin; and
963 .RE
964 .RS +4
965 .TP
966 .ie t \(bu
967 .el o
968 when the lease will expire.
969 .RE
970 .sp
971 .LP
972 The flags currently defined include:
973 .sp
974 .ne 2
975 .na
976 \fB\fBBOOTP\fR\fR
977 .ad
978 .RS 11n
979 The interface has a lease obtained through \fBBOOTP\fR (IPv4 only).
980 .RE
981
982 .sp
983 .ne 2
984 .na
985 \fB\fBBUSY\fR\fR
986 .ad
987 .RS 11n
988 The interface is busy with a \fBDHCP\fR transaction.
989 .RE
990
991 .sp
992 .ne 2
993 .na
994 \fB\fBPRIMARY\fR\fR
995 .ad
996 .RS 11n
997 The interface is the primary interface. See \fBdhcpinfo\fR(1) and
998 \fBifconfig\fR(1M).
999 .RE
1000
1001 .sp
1002 .ne 2
1003 .na
1004 \fB\fBFAILED\fR\fR
1005 .ad
1006 .RS 11n
1007 The interface is in failure state and must be manually restarted.
1008 .RE
1009
1010 .LP
1011 Packet counts are maintained for the number of packets sent, the number of
1012 packets received, and the number of lease offers declined by the \fBDHCP\fR
1013 client. All three counters are initialized to zero and then incremented while
1014 obtaining a lease. The counters are reset when the period of lease renewal
1015 begins for the interface. Thus, the counters represent either the number of
1016 packets sent, received, and declined while obtaining the current lease, or the
1017 number of packets sent, received, and declined while attempting to obtain a
1018 future lease.
1019 .SH FILES
1020 .ne 2
1021 .na
1022 \fB\fB/etc/default/inet_type\fR\fR
1023 .ad
1024 .RS 26n
1025 \fBDEFAULT_IP\fR setting
1026 .RE
1027
1028 .SH SEE ALSO
1029 .LP
1030 \fBarp\fR(1M), \fBdhcpinfo\fR(1), \fBdhcpagent\fR(1M), \fBifconfig\fR(1M),
1031 \fBiostat\fR(1M), \fBkstat\fR(1M), \fBmibiisa\fR(1M), \fBndp\fR(1M), \fBsavecore\fR(1M),
1032 \fBvmstat\fR(1M), \fBhosts\fR(4), \fBinet_type\fR(4), \fBnetworks\fR(4),
1033 \fBprotocols\fR(4), \fBservices\fR(4), \fBattributes\fR(5), \fBdhcp\fR(5),
1034 \fBkstat\fR(7D), \fBinet\fR(7P), \fBinet6\fR(7P)
1035 .sp
1036 .LP
1037 Droms, R., \fIRFC 2131, Dynamic Host Configuration Protocol\fR, Network Working
1038 Group, March 1997.
1039 .sp
1040 .LP
1041 Droms, R. \fIRFC 3315, Dynamic Host Configuration Protocol for IPv6
1042 (DHCPv6)\fR. Cisco Systems. July 2003.
1043 .SH NOTES
1044 .LP
1045 When displaying interface information, \fBnetstat\fR honors the
1046 \fBDEFAULT_IP\fR setting in \fB/etc/default/inet_type\fR. If it is set to
1047 \fBIP_VERSION4\fR, then \fBnetstat\fR will omit information relating to IPv6
1048 interfaces, statistics, connections, routes and the like.
1049 .LP
1050 However, you can override the \fBDEFAULT_IP\fR setting in
1051 \fB/etc/default/inet_type\fR on the command-line. For example, if you have used
1052 the command-line to explicitly request IPv6 information by using the
1053 \fBinet6\fR address family or one of the IPv6 protocols, it will override the
1054 \fBDEFAULT_IP\fR setting.
1055 .LP
1056 If you need to examine network status information following a kernel crash, use
1057 the \fBmdb\fR(1) utility on the \fBsavecore\fR(1M) output.
1058 .LP
1059 The \fBnetstat\fR utility obtains TCP statistics from the system by opening
1060 \fB/dev/tcp\fR and issuing queries. Because of this, \fBnetstat\fR might
1061 display an extra, unused connection in \fBIDLE\fR state when reporting
1062 connection status.
1063 .LP
1064 Previous versions of \fBnetstat\fR had undocumented methods for reporting
1065 kernel statistics published using the \fBkstat\fR(7D) facility. This
1066 functionality has been removed. Use \fBkstat\fR(1M) instead.
1067 .LP
1068 \fBnetstat\fR restricts its output to information that is relevant to the zone
1069 in which \fBnetstat\fR runs. (This is true for both shared-IP and exclusive-IP
1070 zones.)