solaris - netstat (1)
NAME
netstat - show network status
SYNOPSIS
netstat [ -anv ] [ system ] [ core ]
netstat [ -s | -g | -m | -p | -f address_family ]
[ -P protocol ] [ -n ] [ system ] [ core ]
netstat -i | -I interface [ interval ] [ system ] [ core ]
netstat -r [ -anv ] [ system ] [ core ]
netstat -M [ -ns ] [ system ] ] core ]
DESCRIPTION
netstat displays the contents of various network-related
data structures in various formats, depending on the options
you select.
The first form of the command displays a list of active
sockets for each protocol. The second form selects one from
among various other network data structures. The third form
displays the routing table and the fourth form the multicast
routing table.
OPTIONS
-a Show the state of all sockets and all
routing table entries; normally sockets
used by server processes are not shown and
only interface, host, network and default
routes are shown.
-f address_family
Limit statistics or address control block
reports to those of the specified
address_family, which can be one of:
inet For the AF_INET address family
unix For the AF_UNIX address family.
-g Show the multicast group memberships for
all interfaces.
-i Show the state of the interfaces that are
used for TCP/IP traffic. (See
ifconfig(1M)).
-m Show the STREAMS statistics.
-n Show network addresses as numbers. netstat
normally displays addresses as symbols.
display formats.
-p Show the address resolution (ARP) tables.
-r Show the routing tables.
-s Show per-protocol statistics. When used
with the -M option, show multicast routing
statistics instead.
-v Verbose. Show additional information for
the sockets and the routing table.
-I interface Show the state of a particular interface.
interface can be any valid interface such
as ie0 or le0.
-M Show the multicast routing tables. When
used with the -s option, show multicast
routing statistics instead.
-P protocol Limit display of statistics or state of
all sockets to those applicable to proto-
col.
DISPLAYS
Active Sockets (First Form)
The display for each active socket shows the local and
remote address, the send and receive queue sizes (in bytes),
the send and receive windows (in bytes), and the internal
state of the protocol.
The symbolic format normally used to display socket
addresses is either:
hostname.port
when the name of the host is specified, or:
network.port
if a socket address specifies a network but no specific
host.
The numeric host address or network number associated with
the socket is used to look up the corresponding symbolic
hostname or network name in the hosts or networks database.
If the network or hostname for an address is not known (or
if the -n option is specified), the numerical network
address is shown. Unspecified, or "wildcard", addresses and
Internet naming conventions, refer to inet(7P).
TCP Sockets
The possible state values for TCP sockets are as follows:
CLOSED Closed. The socket is not being
used.
LISTEN Listening for incoming connections.
SYN_SENT Actively trying to establish con-
nection.
SYN_RECEIVED Initial synchronization of the con-
nection under way.
ESTABLISHED Connection has been established.
CLOSE_WAIT Remote shut down; waiting for the
socket to close.
FIN_WAIT_1 Socket closed; shutting down con-
nection.
CLOSING Closed, then remote shutdown;
awaiting acknowledgement.
LAST_ACK Remote shut down, then closed;
awaiting acknowledgement.
FIN_WAIT_2 Socket closed; waiting for shutdown
from remote.
TIME_WAIT Wait after close for remote shut-
down retransmission.
Network Data Structures (Second Form)
The form of the display depends upon which of the -i, -g,
-m, -p or -s options you select. If you specify more than
one of these options, netstat displays the information for
each one of them.
Routing Table (Third Form)
The routing table display lists the available routes and the
status of each. Each route consists of a destination host
or network, and a gateway to use in forwarding packets. The
flags column shows the status of the route (U if "up"),
whether the route is to a gateway (G), and whether the route
was created dynamically by a redirect (D). If the -a option
is specified there will be routing entries with flags for
combined routing and address resolution entries (A), broad-
cast addresses (B), and the local addresses for the host
(L).
Interface routes are created for each interface attached to
the local host; the gateway field for such entries shows the
address of the outgoing interface.
The refcnt column gives the current number of routes that
share the same link layer address.
The use column displays the number of packets sent using an
combined routing and address resolution (A) or a broadcast
(B) route. For a local (L) route this count is the number
of packets received, and for all other routes it is the
number of times the routing entry has been used to create a
new combined route and address resolution entry.
The interface entry indicates the network interface utilized
for the route.
Multicast Routing Tables (Fourth Form)
The multicast routing table consists of the virtual inter-
face table and the actual routing table.
SEE ALSO
ifconfig(1M), iostat(1M), vmstat(1M), hosts(4), networks(4),
protocols(4), services(4)
NOTES
The kernel's tables can change while netstat is examining
them, creating incorrect or partial displays.