NETSTAT
Section: Linux Programmer's Manual (8)
Updated: 9 Jan 1995
Index
Return to Main Contents
NAME
netstat - Display active network connections
SYNOPSIS
netstat [[-a | [-t | -u | -w]] [-n | -o] | -x] [-c]
netstat -i [-a] [-c]
netstat -r [-c] [-n]
netstat -v
DESCRIPTION
Netstat
displays the status of network connections on either TCP, UDP, RAW
or UNIX sockets to the system. By default,
netstat
only displays status
on active sockets which are not in the LISTEN state (i.e. connections
to active processes). To obtain information about the kernel routing
table,
netstat
may be invoked with the option
-r
Netstat's display includes the following information for each socket:
Proto
The protocol (either TCP or UDP) used by the socket.
Recv-Q
The count of bytes not copied by the user program connected to this socket.
Send-Q
The count of bytes not acknoledged by the remote host.
Local Address
The local address (local hostname) and port number of the socket. Unless
the
-n
switch is given, the socket address is resolved to its canonical
hostname, and the port number is translated into the corresponding service
name.
Foreign Address
The remote address (remote hostname) and port number of he socket. As
with the local address:port, the
-n
switch turns off hostname and service name resolution.
(State)
The state of the socket. Since there are no states in RAW and usually no
states used in UDP, this row may be left blank. Normally this can be one
of several values:
- ESTABLISHED
-
The socket has an established connection.
- SYN_SENT
-
The socket is actively attempting to establish a connection.
- SYN_RECV
-
The connection is being initialized.
- FIN_WAIT1
-
The socket is closed, and the connection is shutting down.
- FIN_WAIT2
-
Connection is closed, and the socket is waiting for a shutdown from the
remote end.
- TIME_WAIT
-
The socket is waiting after close for remote shutdown retransmission.
- CLOSED
-
The socket is not being used.
- CLOSE_WAIT
-
The remote end has shut down, waiting for the socket to close.
- LAST_ACK
-
The remote end shut down, and the socket is closed. Waiting for
acknowledgement.
- LISTEN
-
The socket is listening for incoming connections.
- CLOSING
-
Both sockets are shut down but we still don't have all our data
sent.
- UNKNOWN
-
The state of the socket is unknown.
If
netstat
is invoked with the option
-o
, additional information will be displayed behind the state info.
These informations are shown like this: "rx-retransmission byte count"
"tx-retransmission byte count" "timer state" "(time/backoff)". Timer
state may now be either on or off. The time (in seconds)
being displayed is how long it will take the timer to expire. All these
options are subject to be removed in later releases of the NET software.
Being invoked with the option
-x
,
netstat displys a list of all
active UNIX internal communication sockets.
Netstat's display includes the following information for each socket:
Proto
The protocol (usually unix) used by the socket.
RefCnt
The reference count (i.e. attached processes via this socket).
Flags
The only displayed flag is SO_ACCEPTON (displayed as ACC) otherwise left
blank. SO_ACCECPTON is used on unconnected sockets if their corresponding
processes are waiting for a connect request. The other flags are not
of normal interest and not displayed.
Type
There are several types of socket access:
- SOCK_DGRAM
-
The socket is used in Datagram (connectionless) mode.
- SOCK_STREAM
-
This is a stream (connection) socket.
- SOCK_RAW
-
The socket is used as a raw socket.
- SOCK_RDM
-
This one serves reliably-delivered messages.
- SOCK_SEQPACKET
-
This is a sequential packet socket.
- SOCK_PACKET
-
RAW interface access socket.
- UNKNOWN
-
Who ever knows, what the future will bring us - just fill in here :-)
State
This field will contain one of the following Keywords:
- FREE
-
The socket is not allocated
- LISTENING
-
The socket is listening for a connection request.
- UNCONNECTED
-
The socket is not connected to another one.
- CONNECTING
-
The socket is about to establish a connection.
- CONNECTED
-
The socket is connected.
- DISCONNECTING
-
The socket is disconnecting.
- UNKNOWN
-
This state should never happen.
Path
This displays the path name as which the corresponding processes attached
to the socket.
The network routing table (invoked with
netstat -r
) shows up the
following information:
Destination net/address
The destination adress of a resolved host or hand-entered network
is displayed. Unless the option
-n is given, the hosts or nets are resolved. An entry named
"default" shows up the default route for the kernel.
Gateway address
If there is no Asterisk ('*') displayed - any data will be routed
to the dedicated gateway.
Flags
Possible routeing flags are:
- U
-
This route is useable
- G
-
Destination is a gateway
- H
-
Destination is a Host entry
- R
-
Route will be reinstated after time-out
- D
-
This one is created dynamically (by redirection)
- M
-
This one is modified dynamically (by redirection)
RefCnt
Reference count for this route
Use
How many times this route was used yet
Iface
This is the name of the Interface, where this route belongs to
The device statistics table (invoked with
netstat -i
) displays information about the interfaces:
Iface
The name this interface.
MTU
Maximum size for transmission on this interface. This should be the size
of data transferred on this interface without interface specific headers.
RX-OK
error free received packets for this interface.
RX-ERR
buggy received packets.
RX-DRP
dropped received packets (due to memory lack ?).
RX-OVR
packets that we were unable to receive that fast way.
TX-OK
error free transmitted packets for this interface.
TX-ERR
buggy transmitted packets.
TX-DRP
dropped transmitteded packets.
TX-OVR
packets that we were unable to transmit.
Flags
The following flags may occur on the given interfaces:
- A
-
This interface will receive all Multicast adresses.
- B
-
Broadcasts are ok here.
- D
-
Debugging is turned on..
- L
-
Interface is a loopback device.
- M
-
all packets are received (Promisc-Mode).
- N
-
Trailers are avoided.
- O
-
No Addres Resolution Protocol on this Interface.
- P
-
Interface is a Point-to-Point connection.
- R
-
Interface is running.
- U
-
Interface is up.
Options
- -a
-
Display information about all internet sockets, i.e. TCP, UDP, RAW and UNIX
including those sockets that are listening only.
- -i
-
Show network devices statistics.
- -c
-
Generate a continuous listing of network status: network status is displayed
every second until the program is interrupted.
- -n
-
Causes netstat not to resolve hostnames and service names when displaying
remote and local address and port information.
- -o
-
Display timer states, expiration times and backoff state.
- -r
-
Display kernel routing table.
- -t
-
Display information about TCP sockets only, including those that are
listening.
- -u
-
Display information about UDP sockets only.
- -v
-
Print version information.
- -w
-
Display information about raw sockets.
- -x
-
Display information about UNIX domain sockets.
FILES
/etc/services
-- The services translation file
/proc/net/socket
-- devices information
/proc/net/raw
-- RAW socket information
/proc/net/route
-- Kernel routing information
/proc/net/tcp
-- TCP socket information
/proc/net/udp
-- UDP socket information
/proc/net/unix
-- Unix domain socket information
BUGS
Occasionally strange information may appear if a socket changes
as it is viewed. This is unlikely to occur.
AUTHORS
The netstat user interface was written by Fred Baumgarten
<dc6iq@insu1.etec.uni-karlsruhe.de> the man page basically
by Matt Welsh <mdw@tc.cornell.edu>. It was updated by
Alan Cox <Alan.Cox@linux.org> but could do with a bit more
work.
Index
- NAME
-
- SYNOPSIS
-
- DESCRIPTION
-
- Proto
-
- Recv-Q
-
- Send-Q
-
- Local Address
-
- Foreign Address
-
- (State)
-
- Proto
-
- RefCnt
-
- Flags
-
- Type
-
- State
-
- Path
-
- Destination net/address
-
- Gateway address
-
- Flags
-
- RefCnt
-
- Use
-
- Iface
-
- Iface
-
- MTU
-
- RX-OK
-
- RX-ERR
-
- RX-DRP
-
- RX-OVR
-
- TX-OK
-
- TX-ERR
-
- TX-DRP
-
- TX-OVR
-
- Flags
-
- Options
-
- FILES
-
- BUGS
-
- AUTHORS
-
This document was created by
man2html,
using the manual pages.
Time: 15:26:23 GMT, November 05, 2024