NETSTAT(8)

NAME
netstat - Display active network connections

SYNOPSIS
netstat [[-a | [-t | -u | -w]] [-n | -o] | -x] [-c] netstat -r [-c] [-n] netstat -v

DESCRIPTION
netstat displays the status of network connections on either TCP, UDP or RAW sockets to the system. By default, netstat only displays status on those TCP sockets which are not in the LISTEN state (i.e. connections to active processes). To obtain information about the kernel routing table, netstat may be invoked with the option -r. A listing of internal UNIX connetions can be obtained by invoking netstat with the option -x,

Netstat's display includes the following information for each socket:

  Proto
The protocol (either TCP or UDP) used by the socket.

  Recv-Q
The count of bytes not copied by the user program connected to this socket.

  Send-Q
The count of bytes not acknoledged by the remote host.

  Local Address
The local address (local hostname) and port number of the socket. Unless the -n switch is given, the socket address is resolved to its canonical hostname, and the port number is translated into the corresponding service name.

  Foreign Address
The remote address (remote hostname) and port number of he socket. As with the local address:port, the -n switch turns off hostname and service name resolution.

  (State)
The state of the socket. Since there are no states in RAW and usually no states used in UDP, this row may be left blank. Normally this can be one of several values:

ESTABLISHED
    The socket has an established connection.

SYN_SENT
    The socket is actively attempting to establish a connection.

SYN_RECV
    The connection is being initialized.

FIN_WAIT1
    The socket is closed, and the connection is shutting down.

FIN_WAIT2
    Connection is closed, and the socket is waiting for a shutdown from the remote end.

TIME_WAIT
    The socket is waiting after close for remote shutdown retransmission.

CLOSED
    The socket is not being used.

CLOSE_WAIT
    The remote end has shut down, waiting for the socket to close.

LAST_ACK
    The remote end shut down, and the socket is closed. Waiting for acknowledgement.

LISTEN
    The socket is listening for incoming connections.

UNKNOWN
    The state of the socket is unknown.

If netstat is invoked with the option -o, additional information will be displayed aftere the state info. These informations are shown like this: keyword (time/backoff) and an optional asterisk. The keyword shows the state of the timer belonging to the socket, the time (in seconds) displayed is how long it will take the timer to expire, the backoff value indicates the current retry count for data transmission and the asterisk indicates that this timer is in the expiration queue. The latter might be removed in future but is helpful for debugging the TCP-Code for now.

Being invoked with the option -x, netstat displys a list of all active UNIX internal communication sockets.

Netstat's display includes the following information for each socket:

  Proto
The protocol (usually unix) used by the socket.

  RefCnt
The reference count (i.e. attached processes via this socket).

  Flags
The only known Flag to me is SO_ACCEPTON (displayed as ACC) otherwise left blank. SO_ACCECPTON is used on unconnected sockets if their corresponding processes are waiting for a connect request.

  Type
There are several types of socket access:

SOCK_DGRAM
    The socket is used in Datagram (connectionless) mode.

SOCK_STREAM
    This is a stream (connection) socket.

SOCK_RAW
    The socket is used as a raw socket.

SOCK_RDM
    This one serves reliably-delivered messages.

SOCK_SEQPACKET
    This is a sequential packet socket.

SOCK_PACKET
    This socket type is used as a linux specific way to get packets at the dev- (kernel)-level. It is assumed to be used to write things like RARP (Reverse Address Resolution Protocol) and similar things on the user level.

UNKNOWN
    Who ever knows, what future will bering up - just fill in here :-)

  State
This field will contain one of the following Keywords:

FREE
    The socket is not allocated

LISTENING
    The socket is listening for a connection request.

UNCONNECTED
    The socket is not connected to another one.

CONNECTING
    The socket is about to establish a connection.

CONNECTED
    The socket is connected.

DISCONNECTING
    The socket is disconnecting.

UNKNOWN
    This state should never happen.

  Path
This displays the path name as which the corresponding processes attached to the socket.

The network routing table (invoked with netstat -r) shows up the following information:

  Destination net/address
The destination adress of a resolved host or hand-entered network is displayed. Unless the option -n is given, the hosts or nets are resolved. An entry named "default" shows up the default route for the kernel.

  Gateway address
If there is no Asterisk ('*') displayed - any data will be routed to the dedicated gateway.

  Flags
Possible routeing flags are:

U   This route is useable

G   Destiantion is a gateway

H   Destiantion is a Host entry

N   Destiantion is a Net entry

R   Route will be reinstated after time-out

D   This one is created dynamically (by redirection)

M   This one is modified dynamically (by redirection)

  RefCnt
Reference count for this route

  Use
How many times this route was used yet

  Iface
This is the name of the Interface, where this route belongs to

  Options

-a  Display information about all internet sockets, i.e. TCP, UDP and RAW, including those sockets that are listening only.

-c  Generate a continuous listing of network status: network status is displayed every second until the program is interrupted.

-n  Causes netstat not to resolve hostnames and service names when displaying remote and local address and port information.

-o  Display timer states, expiration times and backoff state.

-r  Display kernel routing table.

-t  Display information about TCP sockets only, including those that are listening.

-u  Display information about UDP sockets only.

-v  Print version information.

-w  Display information about raw sockets.

-x  Display information about UNIX domain sockets.

FILES
/proc/net/tcp -- TCP socket information /proc/net/udp -- UDP socket information /proc/net/raw -- RAW socket information /proc/net/unix -- Unix domain socket information /proc/net/route -- Kernel routing information /etc/services -- The services translation file

BUGS
None reported yet (05/20/1993).

AUTHORS
The netstat user interface was written by Fred Baumgarten <dc6iq@insu1.etec.uni-karlsruhe.de> the man page basically by Matt Welsh <mdw@tc.cornell.edu>.