1NETSTAT(8) Linux Programmer's Manual NETSTAT(8)
2
6 netstat - Print network connections, routing tables, interface statis‐
7 tics, masquerade connections, and multicast memberships
8
11 netstat [address_family_options] [--tcp|-t] [--udp|-u] [--raw|-w]
12 [--listening|-l] [--all|-a] [--numeric|-n] [--numeric-hosts][--numeric-
13 ports][--numeric-ports] [--symbolic|-N] [--extend|-e[--extend|-e]]
14 [--timers|-o] [--program|-p] [--verbose|-v] [--continuous|-c] [delay]
15 netstat {--route|-r} [address_family_options]
17 [--extend|-e[--extend|-e]] [--verbose|-v] [--numeric|-n] [--numeric-
18 hosts][--numeric-ports][--numeric-ports] [--continuous|-c] [delay]
19 netstat {--interfaces|-i} [iface] [--all|-a] [--extend|-e[--extend|-e]]
21 [--verbose|-v] [--program|-p] [--numeric|-n] [--numeric-
22 hosts][--numeric-ports][--numeric-ports] [--continuous|-c] [delay]
23 netstat {--groups|-g} [--numeric|-n] [--numeric-hosts][--numeric-
25 ports][--numeric-ports] [--continuous|-c] [delay]
26 netstat {--masquerade|-M} [--extend|-e] [--numeric|-n] [--numeric-
28 hosts][--numeric-ports][--numeric-ports] [--continuous|-c] [delay]
29 netstat {--statistics|-s} [--tcp|-t] [--udp|-u] [--raw|-w] [delay]
31 netstat {--version|-V}
33 netstat {--help|-h}
35 address_family_options:
37 [--protocol={inet,unix,ipx,ax25,netrom,ddp}[,...]] [--unix|-x]
39 [--inet|--ip] [--ax25] [--ipx] [--netrom] [--ddp]
40
43 Netstat prints information about the Linux networking subsystem. The
44 type of information printed is controlled by the first argument, as
45 follows:
46 (none)
48 By default, netstat displays a list of open sockets. If you don't
49 specify any address families, then the active sockets of all configured
50 address families will be printed.
51 --route , -r
53 Display the kernel routing tables.
54 --groups , -g
56 Display multicast group membership information for IPv4 and IPv6.
57 --interface=iface , -i
59 Display a table of all network interfaces, or the specified iface).
60 --masquerade , -M
62 Display a list of masqueraded connections.
63 --statistics , -s
65 Display summary statistics for each protocol.
66
68 --verbose , -v
69 Tell the user what is going on by being verbose. Especially print some
70 useful information about unconfigured address families.
71 --numeric , -n
73 Show numerical addresses instead of trying to determine symbolic host,
74 port or user names.
75 --numeric-hosts
77 shows numerical host addresses but does not affect the resolution of
78 port or user names.
79 --numeric-ports
81 shows numerical port numbers but does not affect the resolution of host
82 or user names.
83 --numeric-users
85 shows numerical user IDs but does not affect the resolution of host or
86 port names.
87 --protocol=family , -A
90 Specifies the address families (perhaps better described as low level
91 protocols) for which connections are to be shown. family is a comma
92 (',') separated list of address family keywords like inet, unix, ipx,
93 ax25, netrom, and ddp. This has the same effect as using the --inet,
94 --unix (-x), --ipx, --ax25, --netrom, and --ddp options.
95 The address family inet includes raw, udp and tcp protocol sockets.
97 -c, --continuous
99 This will cause netstat to print the selected information every second
100 continuously.
101 -e, --extend
103 Display additional information. Use this option twice for maximum
104 detail.
105 -o, --timers
107 Include information related to networking timers.
108 -p, --program
110 Show the PID and name of the program to which each socket belongs.
111 -l, --listening
113 Show only listening sockets. (These are omitted by default.)
114 -a, --all
116 Show both listening and non-listening sockets. With the --interfaces
117 option, show interfaces that are not marked
118 -F
120 Print routing information from the FIB. (This is the default.)
121 -C
123 Print routing information from the route cache.
124 -Z --context
126 If SELinux enabled print SELinux context.
127 -T --notrim
129 Stop trimming long addresses.
130 delay
132 Netstat will cycle printing through statistics every delay seconds.
133 UP.
134
136 Active Internet connections (TCP, UDP, raw)
137 Proto
138 The protocol (tcp, udp, raw) used by the socket.
139 Recv-Q
141 The count of bytes not copied by the user program connected to this
142 socket.
143 Send-Q
145 The count of bytes not acknowledged by the remote host.
146 Local Address
148 Address and port number of the local end of the socket. Unless the
149 --numeric (-n) option is specified, the socket address is resolved to
150 its canonical host name (FQDN), and the port number is translated into
151 the corresponding service name.
152 Foreign Address
154 Address and port number of the remote end of the socket. Analogous to
155 "Local Address."
156 State
158 The state of the socket. Since there are no states in raw mode and usu‐
159 ally no states used in UDP, this column may be left blank. Normally
160 this can be one of several values:
161 ESTABLISHED
163 The socket has an established connection.
164 SYN_SENT
166 The socket is actively attempting to establish a connection.
167 SYN_RECV
169 A connection request has been received from the network.
170 FIN_WAIT1
172 The socket is closed, and the connection is shutting down.
173 FIN_WAIT2
175 Connection is closed, and the socket is waiting for a shutdown
176 from the remote end.
177 TIME_WAIT
179 The socket is waiting after close to handle packets still in the
180 network.
181 CLOSED The socket is not being used.
183 CLOSE_WAIT
185 The remote end has shut down, waiting for the socket to close.
186 LAST_ACK
188 The remote end has shut down, and the socket is closed. Waiting
189 for acknowledgement.
190 LISTEN The socket is listening for incoming connections. Such sockets
192 are not included in the output unless you specify the --listen‐
193 ing (-l) or --all (-a) option.
194 CLOSING
196 Both sockets are shut down but we still don't have all our data
197 sent.
198 UNKNOWN
200 The state of the socket is unknown.
201 User
203 The username or the user id (UID) of the owner of the socket.
204 PID/Program name
206 Slash-separated pair of the process id (PID) and process name of the
207 process that owns the socket. --program causes this column to be
208 included. You will also need superuser privileges to see this informa‐
209 tion on sockets you don't own. This identification information is not
210 yet available for IPX sockets.
211 Timer
213 (this needs to be written)
214 Active UNIX domain Sockets
216 Proto
217 The protocol (usually unix) used by the socket.
218 RefCnt
220 The reference count (i.e. attached processes via this socket).
221 Flags
223 The flags displayed is SO_ACCEPTON (displayed as ACC), SO_WAITDATA (W)
224 or SO_NOSPACE (N). SO_ACCECPTON is used on unconnected sockets if
225 their corresponding processes are waiting for a connect request. The
226 other flags are not of normal interest.
227 Type
229 There are several types of socket access:
230 SOCK_DGRAM
232 The socket is used in Datagram (connectionless) mode.
233 SOCK_STREAM
235 This is a stream (connection) socket.
236 SOCK_RAW
238 The socket is used as a raw socket.
239 SOCK_RDM
241 This one serves reliably-delivered messages.
242 SOCK_SEQPACKET
244 This is a sequential packet socket.
245 SOCK_PACKET
247 Raw interface access socket.
248 UNKNOWN
250 Who ever knows what the future will bring us - just fill in here
251 :-)
252 State
254 This field will contain one of the following Keywords:
255 FREE The socket is not allocated
257 LISTENING
259 The socket is listening for a connection request. Such sockets
260 are only included in the output if you specify the --listening
261 (-l) or --all (-a) option.
262 CONNECTING
264 The socket is about to establish a connection.
265 CONNECTED
267 The socket is connected.
268 DISCONNECTING
270 The socket is disconnecting.
271 (empty)
273 The socket is not connected to another one.
274 UNKNOWN
276 This state should never happen.
277 PID/Program name
279 Process ID (PID) and process name of the process that has the socket
280 open. More info available in Active Internet connections section writ‐
281 ten above.
282 Path
284 This is the path name as which the corresponding processes attached to
285 the socket.
286 Active IPX sockets
288 (this needs to be done by somebody who knows it)
289 Active NET/ROM sockets
291 (this needs to be done by somebody who knows it)
292 Active AX.25 sockets
294 (this needs to be done by somebody who knows it)
295
297 Starting with Linux release 2.2 netstat -i does not show interface sta‐
298 tistics for alias interfaces. To get per alias interface counters you
299 need to setup explicit rules using the ipchains(8) command.
300
303 /etc/services -- The services translation file
304 /proc -- Mount point for the proc filesystem, which gives access to
306 kernel status information via the following files.
307 /proc/net/dev -- device information
309 /proc/net/raw -- raw socket information
311 /proc/net/tcp -- TCP socket information
313 /proc/net/udp -- UDP socket information
315 /proc/net/igmp -- IGMP multicast information
317 /proc/net/unix -- Unix domain socket information
319 /proc/net/ipx -- IPX socket information
321 /proc/net/ax25 -- AX25 socket information
323 /proc/net/appletalk -- DDP (appletalk) socket information
325 /proc/net/nr -- NET/ROM socket information
327 /proc/net/route -- IP routing information
329 /proc/net/ax25_route -- AX25 routing information
331 /proc/net/ipx_route -- IPX routing information
333 /proc/net/nr_nodes -- NET/ROM nodelist
335 /proc/net/nr_neigh -- NET/ROM neighbours
337 /proc/net/ip_masquerade -- masqueraded connections
339 /proc/net/snmp -- statistics
341
343 route(8), ifconfig(8), ipchains(8), iptables(8), proc(5)
344
346 Occasionally strange information may appear if a socket changes as it
347 is viewed. This is unlikely to occur.
348
350 The netstat user interface was written by Fred Baumgarten
351 <dc6iq@insu1.etec.uni-karlsruhe.de> the man page basically by Matt
352 Welsh <mdw@tc.cornell.edu>. It was updated by Alan Cox
353 <Alan.Cox@linux.org> but could do with a bit more work. It was updated
354 again by Tuan Hoang <tqhoang@bigfoot.com>.
355 The man page and the command included in the net-tools package is
356 totally rewritten by Bernd Eckenfels <ecki@linux.de>.
357net-tools 19 December 2000 NETSTAT(8)