1NETSTAT(8) Linux Programmer's Manual NETSTAT(8)
2
6 netstat - Print network connections, routing tables, interface statis‐
7 tics, masquerade connections, and multicast memberships
8
11 netstat [address_family_options] [--tcp|-t] [--udp|-u] [--raw|-w]
12 [--listening|-l] [--all|-a] [--numeric|-n] [--numeric-hosts][--numeric-
13 ports][--numeric-ports] [--symbolic|-N] [--extend|-e[--extend|-e]]
14 [--timers|-o] [--program|-p] [--verbose|-v] [--continuous|-c] [delay]
15 netstat {--route|-r} [address_family_options]
17 [--extend|-e[--extend|-e]] [--verbose|-v] [--numeric|-n] [--numeric-
18 hosts][--numeric-ports][--numeric-ports] [--continuous|-c] [delay]
19 netstat {--interfaces|-I|-i} [iface] [--all|-a] [--extend|-e] [--ver‐
21 bose|-v] [--program|-p] [--numeric|-n] [--numeric-hosts][--numeric-
22 ports][--numeric-ports] [--continuous|-c] [delay]
23 netstat {--groups|-g} [--numeric|-n] [--numeric-hosts][--numeric-
25 ports][--numeric-ports] [--continuous|-c] [delay]
26 netstat {--masquerade|-M} [--extend|-e] [--numeric|-n] [--numeric-
28 hosts][--numeric-ports][--numeric-ports] [--continuous|-c] [delay]
29 netstat {--statistics|-s} [--tcp|-t] [--udp|-u] [--raw|-w] [delay]
31 netstat {--version|-V}
33 netstat {--help|-h}
35 address_family_options:
37 [--protocol={inet,inet6,unix,ipx,ax25,netrom,ddp, ... } ] [--unix|-x]
39 [--inet|--ip] [--ax25] [--ipx] [--netrom] [--ddp]
40
43 This program is obsolete. Replacement for netstat is ss. Replacement
44 for netstat -r is ip route. Replacement for netstat -i is ip -s link.
45 Replacement for netstat -g is ip maddr.
46
49 Netstat prints information about the Linux networking subsystem. The
50 type of information printed is controlled by the first argument, as
51 follows:
52 (none)
54 By default, netstat displays a list of open sockets. If you don't
55 specify any address families, then the active sockets of all configured
56 address families will be printed.
57 --route , -r
59 Display the kernel routing tables.
60 --groups , -g
62 Display multicast group membership information for IPv4 and IPv6.
63 --interfaces=iface , -I=iface , -i
65 Display a table of all network interfaces, or the specified iface.
66 --masquerade , -M
68 Display a list of masqueraded connections.
69 --statistics , -s
71 Display summary statistics for each protocol.
72
74 --verbose , -v
75 Tell the user what is going on by being verbose. Especially print some
76 useful information about unconfigured address families.
77 --numeric , -n
79 Show numerical addresses instead of trying to determine symbolic host,
80 port or user names.
81 --numeric-hosts
83 shows numerical host addresses but does not affect the resolution of
84 port or user names.
85 --numeric-ports
87 shows numerical port numbers but does not affect the resolution of host
88 or user names.
89 --numeric-users
91 shows numerical user IDs but does not affect the resolution of host or
92 port names.
93 --protocol=family , -A
96 Specifies the address families (perhaps better described as low level
97 protocols) for which connections are to be shown. family is a comma
98 (',') separated list of address family keywords like inet, inet6, unix,
99 ipx, ax25, netrom, and ddp. This has the same effect as using the
100 --inet, --inet6, --unix (-x), --ipx, --ax25, --netrom, and --ddp
101 options.
102 The address family inet includes raw, udp and tcp protocol sockets.
104 -c, --continuous
106 This will cause netstat to print the selected information every second
107 continuously.
108 -e, --extend
110 Display additional information. Use this option twice for maximum
111 detail.
112 -o, --timers
114 Include information related to networking timers.
115 -p, --program
117 Show the PID and name of the program to which each socket belongs.
118 -l, --listening
120 Show only listening sockets. (These are omitted by default.)
121 -a, --all
123 Show both listening and non-listening (for TCP this means established
124 connections) sockets. With the --interfaces option, show interfaces
125 that are not marked
126 -F
128 Print routing information from the FIB. (This is the default.)
129 -C
131 Print routing information from the route cache.
132 -Z --context
134 If SELinux enabled print SELinux context.
135 -T --notrim
137 Stop trimming long addresses.
138 delay
140 Netstat will cycle printing through statistics every delay seconds.
141 UP.
142
144 Active Internet connections (TCP, UDP, raw)
145 Proto
146 The protocol (tcp, udp, raw) used by the socket.
147 Recv-Q
149 The count of bytes not copied by the user program connected to this
150 socket.
151 Send-Q
153 The count of bytes not acknowledged by the remote host.
154 Local Address
156 Address and port number of the local end of the socket. Unless the
157 --numeric (-n) option is specified, the socket address is resolved to
158 its canonical host name (FQDN), and the port number is translated into
159 the corresponding service name.
160 Foreign Address
162 Address and port number of the remote end of the socket. Analogous to
163 "Local Address."
164 State
166 The state of the socket. Since there are no states in raw mode and usu‐
167 ally no states used in UDP, this column may be left blank. Normally
168 this can be one of several values:
169 ESTABLISHED
171 The socket has an established connection.
172 SYN_SENT
174 The socket is actively attempting to establish a connection.
175 SYN_RECV
177 A connection request has been received from the network.
178 FIN_WAIT1
180 The socket is closed, and the connection is shutting down.
181 FIN_WAIT2
183 Connection is closed, and the socket is waiting for a shutdown
184 from the remote end.
185 TIME_WAIT
187 The socket is waiting after close to handle packets still in the
188 network.
189 CLOSED The socket is not being used.
191 CLOSE_WAIT
193 The remote end has shut down, waiting for the socket to close.
194 LAST_ACK
196 The remote end has shut down, and the socket is closed. Waiting
197 for acknowledgement.
198 LISTEN The socket is listening for incoming connections. Such sockets
200 are not included in the output unless you specify the --listen‐
201 ing (-l) or --all (-a) option.
202 CLOSING
204 Both sockets are shut down but we still don't have all our data
205 sent.
206 UNKNOWN
208 The state of the socket is unknown.
209 User
211 The username or the user id (UID) of the owner of the socket.
212 PID/Program name
214 Slash-separated pair of the process id (PID) and process name of the
215 process that owns the socket. --program causes this column to be
216 included. You will also need superuser privileges to see this informa‐
217 tion on sockets you don't own. This identification information is not
218 yet available for IPX sockets.
219 Timer
221 (this needs to be written)
222 Active UNIX domain Sockets
224 Proto
225 The protocol (usually unix) used by the socket.
226 RefCnt
228 The reference count (i.e. attached processes via this socket).
229 Flags
231 The flags displayed is SO_ACCEPTON (displayed as ACC), SO_WAITDATA (W)
232 or SO_NOSPACE (N). SO_ACCECPTON is used on unconnected sockets if
233 their corresponding processes are waiting for a connect request. The
234 other flags are not of normal interest.
235 Type
237 There are several types of socket access:
238 SOCK_DGRAM
240 The socket is used in Datagram (connectionless) mode.
241 SOCK_STREAM
243 This is a stream (connection) socket.
244 SOCK_RAW
246 The socket is used as a raw socket.
247 SOCK_RDM
249 This one serves reliably-delivered messages.
250 SOCK_SEQPACKET
252 This is a sequential packet socket.
253 SOCK_PACKET
255 Raw interface access socket.
256 UNKNOWN
258 Who ever knows what the future will bring us - just fill in here
259 :-)
260 State
262 This field will contain one of the following Keywords:
263 FREE The socket is not allocated
265 LISTENING
267 The socket is listening for a connection request. Such sockets
268 are only included in the output if you specify the --listening
269 (-l) or --all (-a) option.
270 CONNECTING
272 The socket is about to establish a connection.
273 CONNECTED
275 The socket is connected.
276 DISCONNECTING
278 The socket is disconnecting.
279 (empty)
281 The socket is not connected to another one.
282 UNKNOWN
284 This state should never happen.
285 PID/Program name
287 Process ID (PID) and process name of the process that has the socket
288 open. More info available in Active Internet connections section writ‐
289 ten above.
290 Path
292 This is the path name as which the corresponding processes attached to
293 the socket.
294 Active IPX sockets
296 (this needs to be done by somebody who knows it)
297 Active NET/ROM sockets
299 (this needs to be done by somebody who knows it)
300 Active AX.25 sockets
302 (this needs to be done by somebody who knows it)
303
305 Starting with Linux release 2.2 netstat -i does not show interface sta‐
306 tistics for alias interfaces. To get per alias interface counters you
307 need to setup explicit rules using the ipchains(8) command.
308
311 /etc/services -- The services translation file
312 /proc -- Mount point for the proc filesystem, which gives access to
314 kernel status information via the following files.
315 /proc/net/dev -- device information
317 /proc/net/raw -- raw socket information
319 /proc/net/tcp -- TCP socket information
321 /proc/net/udp -- UDP socket information
323 /proc/net/igmp -- IGMP multicast information
325 /proc/net/unix -- Unix domain socket information
327 /proc/net/ipx -- IPX socket information
329 /proc/net/ax25 -- AX25 socket information
331 /proc/net/appletalk -- DDP (appletalk) socket information
333 /proc/net/nr -- NET/ROM socket information
335 /proc/net/route -- IP routing information
337 /proc/net/ax25_route -- AX25 routing information
339 /proc/net/ipx_route -- IPX routing information
341 /proc/net/nr_nodes -- NET/ROM nodelist
343 /proc/net/nr_neigh -- NET/ROM neighbours
345 /proc/net/ip_masquerade -- masqueraded connections
347 /proc/net/snmp -- statistics
349
351 ss(8),ip(8)
352
354 Occasionally strange information may appear if a socket changes as it
355 is viewed. This is unlikely to occur.
356
358 The netstat user interface was written by Fred Baumgarten
359 <dc6iq@insu1.etec.uni-karlsruhe.de> the man page basically by Matt
360 Welsh <mdw@tc.cornell.edu>. It was updated by Alan Cox
361 <Alan.Cox@linux.org> but could do with a bit more work. It was updated
362 again by Tuan Hoang <tqhoang@bigfoot.com>.
363 The man page and the command included in the net-tools package is
364 totally rewritten by Bernd Eckenfels <ecki@linux.de>.
365net-tools 19 December 2000 NETSTAT(8)