NETSTAT(8)          Linux Programmer's Manual          NETSTAT(8)

       netstat  -  Display  network  connections, routing tables,
       interface statistics, masquerade connections, netlink mes-
       sages, and multicast memberships

       netstat   [-venaoc]   [--tcp|-t]   [--udp|-u]   [--raw|-w]
       [--groups|-g] [--unix|-x] [--inet|--ip]  [--ax25]  [--ipx]

       netstat   [-veenc]  [--inet]  [--ipx]  [--netrom]  [--ddp]
       [--ax25] {--route|-r}

       netstat [-veenpac] {--interfaces|-i} [iface]

       netstat [-enc] {--masquerade|-M}

       netstat [-cn] {--netlink|-N}

       netstat {-V|--version} {-h|--help}

       Netstat displays information of the Linux networking  sub-

   (no option)
       You  can view the status of network connections by listing
       the open sockets. This is the default  operation:  If  you
       don't  specify any address families, then the active sock-
       ets of all configured address families  will  be  printed.
       With  -e  you  get  some additional informations (userid).
       With the -v switch you can  make  netstat  complain  about
       known address families which are not supported by the ker-
       nel. The -o option displays some additional information on
       networking  timers. Enabling the -p will show you the pro-
       cess PID and name of the program holding the  socket.   -a
       print all sockets, including the listening server sockets.
       The address family inet will  display  raw,  udp  and  tcp

   -r, --route
       With  the  -r,  --route option, you get the kernel routing
       tables in the same format as route -e  use.   netstat  -er
       will  use the output format of route.  Please see route(8)
       for details.

   -g, --groups
       With the .BR -g ", " --groups option, multicast group mem-
       bership information for IPv4 and IPv6 is displayed.

   -i, --interface iface
       If you use the -i, --interfaces option, a table of all (or
       the  specified  iface)  networking  interfaces   will   be
       printed.  The  output  uses the ifconfig -e format, and is
       described in ifconfig(8).  netstat -ei will print a  table
       or  a single interface entry just like ifconfig does. With
       the -a switch, you can include interfaces  which  are  not
       configured (i.e. don't have the U=UP flag set).

   -M, --masquerade
       A  list  of  all  masqueraded sessions can be viewed, too.
       With the -e switch you can include some more  informations
       about  sequenze  numbering  and  deltas,  caused  by  data
       rewrites on FTP sessions (PORT command).  Masquerade  sup-
       port  is  used  to  hide  hosts  with  unofficial  network
       addresses  from  the  outside  world,  as   described   in
       ipfw(4),ipfwadm(8) and ipfw(8).

   -N, --netlink
       Recent  kernels  have  a kernel/user communication support
       called netlink. You can get  messages  about  creation  or
       deletion of interfaces or routes from /dev/route (36,0).

   -v, --verbose
       Tell  the  user  what  is going on by being verbose. Espe-
       cially print some usefull informations about  unconfigured
       address families.

   -n, --numeric
       shows  numerical  addresses instead of trying to determine
       symbolic host, port or user names.

   -p, --programs
       displays process name and PID of the owner of each  socket
       it dumps. You have to be the owner of such process to have
       all it's sockets matched to it or generally root user will
       see all the necessary information in place.

   -A, --af family
       use  a different method to set the address families.  fam-
       ily is a comma (',') seperated list of address family key-
       words like inet, unix, ipx, ax25, netrom and ddp.  This is
       has the same effect as  using  the  long  options  --inet,
       --unix, --ipx, --ax25, --netrom and --ddp.

   -c, --continous
       This  will cause netstat to print the selected table every
       second continously on the screen until you interrupt it.

   Active Internet connections (TCP, UDP, RAW)
       The protocol (tcp, udp, raw) used by the socket.

       The count of bytes not copied by  the  user  program  con-
       nected to this socket.

       The count of bytes not acknoledged by the remote host.

   Local Address
       The  local address (local hostname) and port number of the
       socket. Unless the -n switch is given, the socket  address
       is resolved to its canonical hostname, and the port number
       is translated into the corresponding service name.

   Foreign Address
       The remote address (remote hostname) and port number of he
       socket.  As  with  the  local  address:port, the -n switch
       turns off hostname and service name resolution.

       The state of the socket. Since there are no states in  RAW
       and  usually  no  states used in UDP, this row may be left
       blank. Normally this can be one of several values:

              The socket has an established connection.

              The socket is actively attempting  to  establish  a

              A  connection  request  has  been received from the

              The socket is closed, and the connection  is  shut-
              ting down.

              Connection is closed, and the socket is waiting for
              a shutdown from the remote end.

              The socket is waiting after close to handle packets
              still in the network.

       CLOSED The socket is not being used.

              The  remote  end  has  shut  down,  waiting for the
              socket to close.

              The remote end shut down, and the socket is closed.
              Waiting for acknowledgement.

       LISTEN The  socket  is listening for incoming connections.
              Those sockets are only displayed if  the  -a,--lis-
              tening switch is set.

              Both  sockets are shut down but we still don't have
              all our data sent.

              The state of the socket is unknown.

       The name or the UID of the owner of the socket.

   PID/Program name
       Slash-separated pair of the PID and process  name  of  the
       program  holding this socket. Option -p enables display of
       this column. You will also need  root  privileges  as  you
       have  to  have  access rights to process to be able to see
       the program's sockets matched up to it.  This  identifica-
       tion information is not yet available for IPX sockets.

       (this needs to be written)

   Active UNIX domain Sockets
       The protocol (usually unix) used by the socket.

       The  reference  count  (i.e.  attached  processes via this

       The flags displayed is  SO_ACCEPTON  (displayed  as  ACC),
       SO_WAITDATA  (W)  or SO_NOSPACE (N).  SO_ACCECPTON is used
       on unconnected sockets if  their  corresponding  processes
       are waiting for a connect request. The other flags are not
       of normal interest.

       There are several types of socket access:

              The socket is  used  in  Datagram  (connectionless)

              This is a stream (connection) socket.

              The socket is used as a raw socket.

              This one serves reliably-delivered messages.

              This is a sequential packet socket.

              RAW interface access socket.

              Who  ever  knows,  what  the future will bring us -
              just fill in here :-)

       This field will contain one of the following Keywords:

       FREE   The socket is not allocated

              The socket is listening for a  connection  request.
              Those  sockets  are only displayed if the -a,--lis-
              tening switch is set.

              The socket is about to establish a connection.

              The socket is connected.

              The socket is disconnecting.

              The socket is not connected to another one.

              This state should never happen.

   PID/Program name
       PID and process name of the program holding  this  socket.
       More info available in Active Internet connections section
       written above.

       This displays the path name  as  which  the  corresponding
       processes attached to the socket.

   Active IPX sockets
       (this needs to be done by somebody who knows it)

   Active NET/ROM sockets
       (this needs to be done by somebody who knows it)

   Active AX.25 sockets
       (this needs to be done by somebody who knows it)

       Since  kernel  release  2.2  netstat  -i  does not display
       interface statistics for alias interfaces anymore. To  get
       per  alias  interface  counters you need to setup explicit
       rules using the ipchains(8) command.

       /etc/services -- The services translation file

       /proc/net/dev -- devices information

       /proc/net/raw -- RAW socket information

       /proc/net/tcp -- TCP socket information

       /proc/net/udp -- UDP socket information

       /proc/net/igmp -- IGMP multicast information

       /proc/net/unix -- Unix domain socket information

       /proc/net/ipx -- IPX socket information

       /proc/net/ax25 -- AX25 socket information

       /proc/net/appeltalk -- DDP (appeltalk) socket information

       /proc/net/nr -- NET/ROM socket information

       /proc/net/route -- Kernel IP routing information

       /proc/net/ax25_route -- Kernel AX25 routing information

       /proc/net/ipx_route -- Kernel IPX routing information

       /proc/net/nr_nodes -- Kernel NET/ROM nodelist

       /proc/net/nr_neigh -- Kernel NET/ROM neighbours

       /proc/net/ip_masquerade -- Kernel masqueraded connections

       route(8),  ifconfig(8),   ipfw(4),   ipfw(8),   ipfwadm(8)

       Occasionally  strange  information  may appear if a socket
       changes as it is viewed. This is unlikely to occur.
       The netstat -i options is  described  as  it  should  work
       after  some  code  cleanup of the BETA release of the net-
       tools package.

       The netstat user interface was written by Fred  Baumgarten
       <> the man page basically
       by Matt Welsh <>. It was updated by Alan
       Cox  <>  but  could  do  with a bit more
       work.  It was updated  again  by  Tuan  Hoang  <tuan@opti->.
       The  man  page  and  the command included in the net-tools
       package  is  totally  rewritten   from   Bernd   Eckenfels

net-tools                  25 Feb 1999                          1