1NETSTAT(8)            Linux System Administrator's Manual           NETSTAT(8)
2
3
4

NAME

6       netstat  - Print network connections, routing tables, interface statis‐
7       tics, masquerade connections, and multicast memberships
8
9

SYNOPSIS

11       netstat [address_family_options] [--tcp|-t]  [--udp|-u]  [--udplite|-U]
12       [--sctp|-S]   [--raw|-w]  [--l2cap|-2]  [--rfcomm|-f]  [--listening|-l]
13       [--all|-a]    [--numeric|-n]    [--numeric-hosts]     [--numeric-ports]
14       [--numeric-users]       [--symbolic|-N]      [--extend|-e[--extend|-e]]
15       [--timers|-o]    [--program|-p]    [--verbose|-v]     [--continuous|-c]
16       [--wide|-W] [delay]
17
18       netstat              {--route|-r}              [address_family_options]
19       [--extend|-e[--extend|-e]]        [--verbose|-v]         [--numeric|-n]
20       [--numeric-hosts] [--numeric-ports] [--numeric-users] [--continuous|-c]
21       [delay]
22
23       netstat {--interfaces|-I|-i}  [--all|-a]  [--extend|-e]  [--verbose|-v]
24       [--program|-p]   [--numeric|-n]   [--numeric-hosts]   [--numeric-ports]
25       [--numeric-users] [--continuous|-c] [delay]
26
27       netstat      {--groups|-g}       [--numeric|-n]       [--numeric-hosts]
28       [--numeric-ports] [--numeric-users] [--continuous|-c] [delay]
29
30       netstat       {--masquerade|-M}       [--extend|-e]      [--numeric|-n]
31       [--numeric-hosts] [--numeric-ports] [--numeric-users] [--continuous|-c]
32       [delay]
33
34       netstat    {--statistics|-s}   [--tcp|-t]   [--udp|-u]   [--udplite|-U]
35       [--sctp|-S] [--raw|-w] [delay]
36
37       netstat {--version|-V}
38
39       netstat {--help|-h}
40
41       address_family_options:
42
43       [-4|--inet]                   [-6|--inet6]                    [--proto‐
44       col={inet,inet6,unix,ipx,ax25,netrom,ddp,bluetooth, ... } ] [--unix|-x]
45       [--inet|--ip|--tcpip] [--ax25] [--x25] [--rose]  [--ash]  [--bluetooth]
46       [--ipx] [--netrom] [--ddp|--appletalk] [--econet|--ec]
47
48

NOTES

50       This  program  is  mostly  obsolete.   Replacement  for  netstat is ss.
51       Replacement for netstat -r is ip route.  Replacement for netstat -i  is
52       ip -s link.  Replacement for netstat -g is ip maddr.
53
54

DESCRIPTION

56       Netstat  prints  information about the Linux networking subsystem.  The
57       type of information printed is controlled by  the  first  argument,  as
58       follows:
59
60   (none)
61       By  default,  netstat  displays  a  list of open sockets.  If you don't
62       specify any address families, then the active sockets of all configured
63       address families will be printed.
64
65   --route, -r
66       Display  the kernel routing tables. See the description in route(8) for
67       details.  netstat -r and route -e produce the same output.
68
69   --groups, -g
70       Display multicast group membership information for IPv4 and IPv6.
71
72   --interfaces=iface , -I=iface , -i
73       Display a table of all network interfaces, or the specified iface.
74
75   --masquerade, -M
76       Display a list of masqueraded connections.
77
78   --statistics, -s
79       Display summary statistics for each protocol.
80

OPTIONS

82   --verbose, -v
83       Tell the user what is going on by being verbose. Especially print  some
84       useful information about unconfigured address families.
85
86   --wide, -W
87       Do not truncate IP addresses by using output as wide as needed. This is
88       optional for now to not break existing scripts.
89
90   --numeric, -n
91       Show numerical addresses instead of trying to determine symbolic  host,
92       port or user names.
93
94   --numeric-hosts
95       shows  numerical  host  addresses but does not affect the resolution of
96       port or user names.
97
98   --numeric-ports
99       shows numerical port numbers but does not affect the resolution of host
100       or user names.
101
102   --numeric-users
103       shows  numerical user IDs but does not affect the resolution of host or
104       port names.
105
106
107   --protocol=family, -A
108       Specifies the address families (perhaps better described as  low  level
109       protocols)  for  which  connections are to be shown.  family is a comma
110       (',') separated list of address family keywords like inet, inet6, unix,
111       ipx,  ax25,  netrom,  econet,  ddp,  and  bluetooth.  This has the same
112       effect as using the --inet|-4, --inet6|-6,  --unix|-x,  --ipx,  --ax25,
113       --netrom, --ddp, and --bluetooth options.
114
115       The address family inet (Iv4) includes raw, udp, udplite and tcp proto‐
116       col sockets.
117
118       The address family bluetooth (Iv4) includes l2cap and  rfcomm  protocol
119       sockets.
120
121   -c, --continuous
122       This  will cause netstat to print the selected information every second
123       continuously.
124
125   -e, --extend
126       Display additional information.  Use  this  option  twice  for  maximum
127       detail.
128
129   -o, --timers
130       Include information related to networking timers.
131
132   -p, --program
133       Show the PID and name of the program to which each socket belongs.
134
135   -l, --listening
136       Show only listening sockets.  (These are omitted by default.)
137
138   -a, --all
139       Show  both  listening and non-listening (for TCP this means established
140       connections) sockets.  With the --interfaces  option,  show  interfaces
141       that are not up
142
143   -F
144       Print routing information from the FIB.  (This is the default.)
145
146   -C
147       Print routing information from the route cache.
148
149   delay
150       Netstat will cycle printing through statistics every delay seconds.
151

OUTPUT

153   Active Internet connections (TCP, UDP, UDPLite, raw)
154   Proto
155       The protocol (tcp, udp, udpl, raw) used by the socket.
156
157   Recv-Q
158       Established:  The  count  of  bytes not copied by the user program con‐
159       nected to this socket.  Listening: Since Kernel 2.6.18 this column con‐
160       tains the current syn backlog.
161
162   Send-Q
163       Established:  The  count  of bytes not acknowledged by the remote host.
164       Listening: Since Kernel 2.6.18 this column contains the maximum size of
165       the syn backlog.
166
167   Local Address
168       Address  and  port  number  of the local end of the socket.  Unless the
169       --numeric (-n) option is specified, the socket address is  resolved  to
170       its  canonical host name (FQDN), and the port number is translated into
171       the corresponding service name.
172
173   Foreign Address
174       Address and port number of the remote end of the socket.  Analogous  to
175       "Local Address".
176
177   State
178       The state of the socket. Since there are no states in raw mode and usu‐
179       ally no states used in UDP and UDPLite, this column may be left  blank.
180       Normally this can be one of several values:
181
182       ESTABLISHED
183              The socket has an established connection.
184
185       SYN_SENT
186              The socket is actively attempting to establish a connection.
187
188       SYN_RECV
189              A connection request has been received from the network.
190
191       FIN_WAIT1
192              The socket is closed, and the connection is shutting down.
193
194       FIN_WAIT2
195              Connection  is  closed, and the socket is waiting for a shutdown
196              from the remote end.
197
198       TIME_WAIT
199              The socket is waiting after close to handle packets still in the
200              network.
201
202       CLOSE  The socket is not being used.
203
204       CLOSE_WAIT
205              The remote end has shut down, waiting for the socket to close.
206
207       LAST_ACK
208              The  remote end has shut down, and the socket is closed. Waiting
209              for acknowledgement.
210
211       LISTEN The socket is listening for incoming connections.  Such  sockets
212              are  not included in the output unless you specify the --listen‐
213              ing (-l) or --all (-a) option.
214
215       CLOSING
216              Both sockets are shut down but we still don't have all our  data
217              sent.
218
219       UNKNOWN
220              The state of the socket is unknown.
221
222   User
223       The username or the user id (UID) of the owner of the socket.
224
225   PID/Program name
226       Slash-separated  pair  of  the process id (PID) and process name of the
227       process that owns the socket.   --program  causes  this  column  to  be
228       included.  You will also need superuser privileges to see this informa‐
229       tion on sockets you don't own.  This identification information is  not
230       yet available for IPX sockets.
231
232   Timer
233       TCP  timer associated with this socket. The format is timer(a/b/c). The
234       timer is one of the following values:
235
236       off    There is no timer set for this socket.
237
238       on     The retransmission timer is active for the socket.
239
240       keepalive
241              The keepalive timer is active for the socket.
242
243       timewait
244              The connection is closing and the timewait timer is  active  for
245              the socket.
246
247       The values in the brackets:
248
249       a      Timer value.
250
251       b      Number of retransmissions sent.
252
253       c      Number of keepalives sent.
254
255   Active UNIX domain Sockets
256   Proto
257       The protocol (usually unix) used by the socket.
258
259   RefCnt
260       The reference count (i.e. attached processes via this socket).
261
262   Flags
263       The  flags displayed is SO_ACCEPTON (displayed as ACC), SO_WAITDATA (W)
264       or SO_NOSPACE (N).  SO_ACCECPTON is  used  on  unconnected  sockets  if
265       their  corresponding  processes  are waiting for a connect request. The
266       other flags are not of normal interest.
267
268   Type
269       There are several types of socket access:
270
271       SOCK_DGRAM
272              The socket is used in Datagram (connectionless) mode.
273
274       SOCK_STREAM
275              This is a stream (connection) socket.
276
277       SOCK_RAW
278              The socket is used as a raw socket.
279
280       SOCK_RDM
281              This one serves reliably-delivered messages.
282
283       SOCK_SEQPACKET
284              This is a sequential packet socket.
285
286       SOCK_PACKET
287              Raw interface access socket.
288
289       UNKNOWN
290              Who ever knows what the future will bring us - just fill in here
291              :-)
292
293   State
294       This field will contain one of the following Keywords:
295
296       FREE   The socket is not allocated
297
298       LISTENING
299              The  socket is listening for a connection request.  Such sockets
300              are only included in the output if you specify  the  --listening
301              (-l) or --all (-a) option.
302
303       CONNECTING
304              The socket is about to establish a connection.
305
306       CONNECTED
307              The socket is connected.
308
309       DISCONNECTING
310              The socket is disconnecting.
311
312       (empty)
313              The socket is not connected to another one.
314
315       UNKNOWN
316              This state should never happen.
317
318   PID/Program name
319       Process  ID  (PID)  and process name of the process that has the socket
320       open.  More info available in Active Internet connections section writ‐
321       ten above.
322
323   Path
324       This  is the path name as which the corresponding processes attached to
325       the socket.
326
327   Active IPX sockets
328       (this needs to be done by somebody who knows it)
329
330   Active NET/ROM sockets
331       (this needs to be done by somebody who knows it)
332
333   Active AX.25 sockets
334       (this needs to be done by somebody who knows it)
335

FILES

337       /etc/services -- The services translation file
338
339       /proc -- Mount point for the proc filesystem,  which  gives  access  to
340       kernel status information via the following files.
341
342       /proc/net/dev -- device information
343
344       /proc/net/raw -- raw socket information
345
346       /proc/net/tcp -- TCP socket information
347
348       /proc/net/udp -- UDP socket information
349
350       /proc/net/udplite -- UDPLite socket information
351
352       /proc/net/igmp -- IGMP multicast information
353
354       /proc/net/unix -- Unix domain socket information
355
356       /proc/net/ipx -- IPX socket information
357
358       /proc/net/ax25 -- AX25 socket information
359
360       /proc/net/appletalk -- DDP (appletalk) socket information
361
362       /proc/net/nr -- NET/ROM socket information
363
364       /proc/net/route -- IP routing information
365
366       /proc/net/ax25_route -- AX25 routing information
367
368       /proc/net/ipx_route -- IPX routing information
369
370       /proc/net/nr_nodes -- NET/ROM nodelist
371
372       /proc/net/nr_neigh -- NET/ROM neighbours
373
374       /proc/net/ip_masquerade -- masqueraded connections
375
376       /sys/kernel/debug/bluetooth/l2cap -- Bluetooth L2CAP information
377
378       /sys/kernel/debug/bluetooth/rfcomm -- Bluetooth serial connections
379
380       /proc/net/snmp -- statistics
381

SEE ALSO

383       route(8), ifconfig(8), iptables(8), proc(5) ss(8) ip(8)
384

BUGS

386       Occasionally  strange  information may appear if a socket changes as it
387       is viewed. This is unlikely to occur.
388

AUTHORS

390       The  netstat  user   interface   was   written   by   Fred   Baumgarten
391       <dc6iq@insu1.etec.uni-karlsruhe.de>,  the  man  page  basically by Matt
392       Welsh   <mdw@tc.cornell.edu>.   It   was   updated    by    Alan    Cox
393       <Alan.Cox@linux.org>,   updated   again  by  Tuan  Hoang  <tqhoang@big‐
394       foot.com>. The man page and the command included in the net-tools pack‐
395       age  is  totally rewritten by Bernd Eckenfels <ecki@linux.de>.  UDPLite
396       options were added by Brian Micek <bmicek@gmail.com>
397
398
399
400net-tools                         2014-10-07                        NETSTAT(8)
Impressum