show network status
netstat [ -AaiLmnrsu ]
[ -f address_family ]
[ -I interface ]
[ -M corefile ]
[ -N system ]
[ -p protocol_name]
[ -w interval ]
[ [ interval ] [ system ] [ corefile ] ]
command symbolically displays the contents of various network-related
data structures. The options have the following meanings:
The arguments interval, system,
and corefile are the old syntax alternative
to specifying the -w, -N,
and -M options. (See ``Limitations''.)
Show the address of any associated protocol control blocks; used
Show the state of all sockets; sockets used by
server processes are not shown in the default display
Limit statistics and control block displays to
The only address_family values currently supported are
inet and unix.
Show the state of interfaces which have been auto-configured
(interfaces statically configured into a system, but not
located at boot time, are not shown).
Show interface state for interface only.
Display Global Multiprocessor Locking Statistics.
Show STREAMS memory usage.
If the -a flag is used in conjunction with -m,
then additional information about the allocation of message
blocks for networking data structures is shown as well.
Use corefile as the system core image instead
of the default /dev/kmem. (See ``Limitations''.)
Show network addresses as numbers (normally netstat
interprets addresses and attempts to display them
Use system as the system namelist instead of
the default /unix. (See ``Limitations''.)
Limit statistics and control block displays to
protocol-name, for example, tcp.
Show the routing tables.
Show per-protocol statistics.
Equivalent to specifying -f unix.
regarding packet traffic on the configured network interfaces,
sampling and displaying an update every interval seconds.
Address and port formats
In all displays, address formats are of the
form host.port or network
(if a socket's address specifies a network but no specific host address).
When known, host addresses, network addresses, and port
numbers are displayed symbolically.
The symbolic name for a network address is obtained from the
The symbolic name for a host address is obtained from the database
/etc/hosts, unless the system is using the Domain Name
in this later case the symbolic name is obtained from the
DNS name resolver.
The symbolic name for a port is obtained from the database
If a symbolic name for an address or port is unknown, or if
option is specified, the address is printed in the
Internet ``dot format''
for more information regarding this format)
and the port is identified by its number.
or ``wildcard,'' addresses and ports appear as ``''.
There are a number of display formats, depending on the information
The default display appears when netstat is invoked without
This display, about active sockets, shows the local
and remote addresses, send and receive queue sizes (in bytes), protocol,
and, optionally, the internal state of the protocol.
The -i interface display provides a table of cumulative
statistics regarding packets transferred, errors, and collisions.
The network address (currently Internet specific) of the interface
and the maximum transmission unit (``mtu'') are also displayed.
If the -a flag is used in conjunction with the -i flag,
information about multicast addresses will also be displayed.
The -r routing table display indicates the available routes and
their status. Each route consists of a destination host or network
and a gateway to use in forwarding packets. The
Flags field shows
the state of the route (``U'' if ``up''), and whether the route
is to a gateway (``G''). Direct routes are created for each
interface attached to the local host. The
Refs field gives the
current number of active uses of the route. Connection-oriented
protocols normally hold on to a single route for the duration of
a connection, while connectionless protocols obtain a route then
discard it. The
Use field provides a count of the number of packets
sent using that route. The
Interface field indicates the network
interface utilized for the route.
is used in conjunction with
option, link-level (ARP) routes will be displayed as well as regular
In addition, some flags that are normally suppressed
(``M, N, P'') will be displayed.
Additional flags that may be shown in the routing table display are:
The -w display consists of a column summarizing
information for a default single interface and a column summarizing
information for all interfaces. The default single interface may
be changed by specifying a different interface using the
-I option. The first
line of each screen of information contains a summary since the
system was last rebooted. Subsequent lines of output show values
accumulated over the preceding interval.
The route is currently marked as ``losing'' because the kernel has detected
a transmission problem.
The route is a ``cloning'' route via an interface. New routes for
specific destinations will be derived from this route.
The route was created as the result of a redirect message being received.
The route is to a host.
The route has associated link-level information,
such as an ARP entry.
The route has been modified since its creation, possibly due to a redirect.
The Path MTU discovery algorithm has discovered
a new MTU for this route.
Path MTU discovery is being performed on this route.
The route is marked as ``reject'' to prevent any traffic from flowing
to this destination.
The route was statically configured.
The route is resolved externally by a user-level process. This is not
supported in the current implementation.
Interface statistics are dependent on the link driver. If it does not
attach itself to the ifstats structure in the kernel
or support the MACIOC_GETSTAT ioctl, the
No Statistics Available will be printed for that interface.
Use of the old syntax for specifying interval,
system, and corefile
(that is. without a preceding argument) is discouraged, as support
for this may disappear in the future.
As netstat gets most of its information from
mechanisms other than reading kernel memory, it can only
be used on a running system.
system and corefile do not provide
the ability to examine system dump images. They allow
netstat to find the correct kernel image after
a kernel relink has renamed the kernel from which
the system was rebooted.
© 2003 Caldera International, Inc. All rights reserved.
SCO OpenServer Release 5.0.7 -- 11 February 2003