1NETSTAT(8) Linux Programmer's Manual NETSTAT(8)
2
6 netstat - Print network connections, routing tables, interface statis‐
7 tics, masquerade connections, and multicast memberships
8
11 netstat [address_family_options] [--tcp|-t] [--udp|-u] [--raw|-w]
12 [--listening|-l] [--all|-a] [--numeric|-n] [--numeric-hosts][--numeric-
13 ports][--numeric-ports] [--symbolic|-N] [--extend|-e[--extend|-e]]
14 [--timers|-o] [--program|-p] [--verbose|-v] [--continuous|-c] [delay]
15 netstat {--route|-r} [address_family_options]
17 [--extend|-e[--extend|-e]] [--verbose|-v] [--numeric|-n] [--numeric-
18 hosts][--numeric-ports][--numeric-ports] [--continuous|-c] [delay]
19 netstat {--interfaces|-I|-i} [iface] [--all|-a] [--extend|-e] [--ver‐
21 bose|-v] [--program|-p] [--numeric|-n] [--numeric-hosts][--numeric-
22 ports][--numeric-ports] [--continuous|-c] [delay]
23 netstat {--groups|-g} [--numeric|-n] [--numeric-hosts][--numeric-
25 ports][--numeric-ports] [--continuous|-c] [delay]
26 netstat {--masquerade|-M} [--extend|-e] [--numeric|-n] [--numeric-
28 hosts][--numeric-ports][--numeric-ports] [--continuous|-c] [delay]
29 netstat {--statistics|-s} [--tcp|-t] [--udp|-u] [--raw|-w] [delay]
31 netstat {--version|-V}
33 netstat {--help|-h}
35 address_family_options:
37 [--protocol={inet,unix,ipx,ax25,netrom,ddp}[,...]] [--unix|-x]
39 [--inet|--ip] [--ax25] [--ipx] [--netrom] [--ddp]
40
43 This program is obsolete. Replacement for netstat is ss. Replacement
44 for netstat -r is ip route. Replacement for netstat -i is ip -s link.
45 Replacement for netstat -g is ip maddr.
46
49 Netstat prints information about the Linux networking subsystem. The
50 type of information printed is controlled by the first argument, as
51 follows:
52 (none)
54 By default, netstat displays a list of open sockets. If you don't
55 specify any address families, then the active sockets of all configured
56 address families will be printed.
57 --route , -r
59 Display the kernel routing tables.
60 --groups , -g
62 Display multicast group membership information for IPv4 and IPv6.
63 --interfaces=iface , -I=iface , -i
65 Display a table of all network interfaces, or the specified iface.
66 --masquerade , -M
68 Display a list of masqueraded connections.
69 --statistics , -s
71 Display summary statistics for each protocol.
72
74 --verbose , -v
75 Tell the user what is going on by being verbose. Especially print some
76 useful information about unconfigured address families.
77 --numeric , -n
79 Show numerical addresses instead of trying to determine symbolic host,
80 port or user names.
81 --numeric-hosts
83 shows numerical host addresses but does not affect the resolution of
84 port or user names.
85 --numeric-ports
87 shows numerical port numbers but does not affect the resolution of host
88 or user names.
89 --numeric-users
91 shows numerical user IDs but does not affect the resolution of host or
92 port names.
93 --protocol=family , -A
96 Specifies the address families (perhaps better described as low level
97 protocols) for which connections are to be shown. family is a comma
98 (',') separated list of address family keywords like inet, unix, ipx,
99 ax25, netrom, and ddp. This has the same effect as using the --inet,
100 --unix (-x), --ipx, --ax25, --netrom, and --ddp options.
101 The address family inet includes raw, udp and tcp protocol sockets.
103 -c, --continuous
105 This will cause netstat to print the selected information every second
106 continuously.
107 -e, --extend
109 Display additional information. Use this option twice for maximum
110 detail.
111 -o, --timers
113 Include information related to networking timers.
114 -p, --program
116 Show the PID and name of the program to which each socket belongs.
117 -l, --listening
119 Show only listening sockets. (These are omitted by default.)
120 -a, --all
122 Show both listening and non-listening sockets. With the --interfaces
123 option, show interfaces that are not marked
124 -F
126 Print routing information from the FIB. (This is the default.)
127 -C
129 Print routing information from the route cache.
130 -Z --context
132 If SELinux enabled print SELinux context.
133 -T --notrim
135 Stop trimming long addresses.
136 delay
138 Netstat will cycle printing through statistics every delay seconds.
139 UP.
140
142 Active Internet connections (TCP, UDP, raw)
143 Proto
144 The protocol (tcp, udp, raw) used by the socket.
145 Recv-Q
147 The count of bytes not copied by the user program connected to this
148 socket.
149 Send-Q
151 The count of bytes not acknowledged by the remote host.
152 Local Address
154 Address and port number of the local end of the socket. Unless the
155 --numeric (-n) option is specified, the socket address is resolved to
156 its canonical host name (FQDN), and the port number is translated into
157 the corresponding service name.
158 Foreign Address
160 Address and port number of the remote end of the socket. Analogous to
161 "Local Address."
162 State
164 The state of the socket. Since there are no states in raw mode and usu‐
165 ally no states used in UDP, this column may be left blank. Normally
166 this can be one of several values:
167 ESTABLISHED
169 The socket has an established connection.
170 SYN_SENT
172 The socket is actively attempting to establish a connection.
173 SYN_RECV
175 A connection request has been received from the network.
176 FIN_WAIT1
178 The socket is closed, and the connection is shutting down.
179 FIN_WAIT2
181 Connection is closed, and the socket is waiting for a shutdown
182 from the remote end.
183 TIME_WAIT
185 The socket is waiting after close to handle packets still in the
186 network.
187 CLOSED The socket is not being used.
189 CLOSE_WAIT
191 The remote end has shut down, waiting for the socket to close.
192 LAST_ACK
194 The remote end has shut down, and the socket is closed. Waiting
195 for acknowledgement.
196 LISTEN The socket is listening for incoming connections. Such sockets
198 are not included in the output unless you specify the --listen‐
199 ing (-l) or --all (-a) option.
200 CLOSING
202 Both sockets are shut down but we still don't have all our data
203 sent.
204 UNKNOWN
206 The state of the socket is unknown.
207 User
209 The username or the user id (UID) of the owner of the socket.
210 PID/Program name
212 Slash-separated pair of the process id (PID) and process name of the
213 process that owns the socket. --program causes this column to be
214 included. You will also need superuser privileges to see this informa‐
215 tion on sockets you don't own. This identification information is not
216 yet available for IPX sockets.
217 Timer
219 (this needs to be written)
220 Active UNIX domain Sockets
222 Proto
223 The protocol (usually unix) used by the socket.
224 RefCnt
226 The reference count (i.e. attached processes via this socket).
227 Flags
229 The flags displayed is SO_ACCEPTON (displayed as ACC), SO_WAITDATA (W)
230 or SO_NOSPACE (N). SO_ACCECPTON is used on unconnected sockets if
231 their corresponding processes are waiting for a connect request. The
232 other flags are not of normal interest.
233 Type
235 There are several types of socket access:
236 SOCK_DGRAM
238 The socket is used in Datagram (connectionless) mode.
239 SOCK_STREAM
241 This is a stream (connection) socket.
242 SOCK_RAW
244 The socket is used as a raw socket.
245 SOCK_RDM
247 This one serves reliably-delivered messages.
248 SOCK_SEQPACKET
250 This is a sequential packet socket.
251 SOCK_PACKET
253 Raw interface access socket.
254 UNKNOWN
256 Who ever knows what the future will bring us - just fill in here
257 :-)
258 State
260 This field will contain one of the following Keywords:
261 FREE The socket is not allocated
263 LISTENING
265 The socket is listening for a connection request. Such sockets
266 are only included in the output if you specify the --listening
267 (-l) or --all (-a) option.
268 CONNECTING
270 The socket is about to establish a connection.
271 CONNECTED
273 The socket is connected.
274 DISCONNECTING
276 The socket is disconnecting.
277 (empty)
279 The socket is not connected to another one.
280 UNKNOWN
282 This state should never happen.
283 PID/Program name
285 Process ID (PID) and process name of the process that has the socket
286 open. More info available in Active Internet connections section writ‐
287 ten above.
288 Path
290 This is the path name as which the corresponding processes attached to
291 the socket.
292 Active IPX sockets
294 (this needs to be done by somebody who knows it)
295 Active NET/ROM sockets
297 (this needs to be done by somebody who knows it)
298 Active AX.25 sockets
300 (this needs to be done by somebody who knows it)
301
303 Starting with Linux release 2.2 netstat -i does not show interface sta‐
304 tistics for alias interfaces. To get per alias interface counters you
305 need to setup explicit rules using the ipchains(8) command.
306
309 /etc/services -- The services translation file
310 /proc -- Mount point for the proc filesystem, which gives access to
312 kernel status information via the following files.
313 /proc/net/dev -- device information
315 /proc/net/raw -- raw socket information
317 /proc/net/tcp -- TCP socket information
319 /proc/net/udp -- UDP socket information
321 /proc/net/igmp -- IGMP multicast information
323 /proc/net/unix -- Unix domain socket information
325 /proc/net/ipx -- IPX socket information
327 /proc/net/ax25 -- AX25 socket information
329 /proc/net/appletalk -- DDP (appletalk) socket information
331 /proc/net/nr -- NET/ROM socket information
333 /proc/net/route -- IP routing information
335 /proc/net/ax25_route -- AX25 routing information
337 /proc/net/ipx_route -- IPX routing information
339 /proc/net/nr_nodes -- NET/ROM nodelist
341 /proc/net/nr_neigh -- NET/ROM neighbours
343 /proc/net/ip_masquerade -- masqueraded connections
345 /proc/net/snmp -- statistics
347
349 ss(8),ip(8)
350
352 Occasionally strange information may appear if a socket changes as it
353 is viewed. This is unlikely to occur.
354
356 The netstat user interface was written by Fred Baumgarten
357 <dc6iq@insu1.etec.uni-karlsruhe.de> the man page basically by Matt
358 Welsh <mdw@tc.cornell.edu>. It was updated by Alan Cox
359 <Alan.Cox@linux.org> but could do with a bit more work. It was updated
360 again by Tuan Hoang <tqhoang@bigfoot.com>.
361 The man page and the command included in the net-tools package is
362 totally rewritten by Bernd Eckenfels <ecki@linux.de>.
363net-tools 19 December 2000 NETSTAT(8)