1 '\" te
   2 .\" Copyright 2018, Joyent, Inc.
   3 .\" Copyright (C) 2002, Sun Microsystems, Inc. All Rights Reserved
   4 .\" Copyright 1989 AT&T
   5 .\" Copyright (c) 1983 Regents of the University of California. All rights reserved. The Berkeley software License Agreement specifies the terms and conditions for redistribution.
   6 .TH NETSTAT 1M "Sep 02, 2015"
   7 .SH NAME
   8 netstat \- show network status
   9 .SH SYNOPSIS
  10 .LP
  11 .nf
  12 \fBnetstat\fR [\fB-anvR\fR] [\fB-f\fR \fIaddress_family\fR] [\fB-P\fR \fIprotocol\fR]
  13 .fi
  14 
  15 .LP
  16 .nf
  17 \fBnetstat\fR \fB-g\fR [\fB-nv\fR] [\fB-f\fR \fIaddress_family\fR]
  18 .fi
  19 
  20 .LP
  21 .nf
  22 \fBnetstat\fR \fB-p\fR [\fB-n\fR] [\fB-f\fR \fIaddress_family\fR]
  23 .fi
  24 
  25 .LP
  26 .nf
  27 \fBnetstat\fR \fB-s\fR [\fB-f\fR \fIaddress_family\fR] [\fB-P\fR \fIprotocol\fR]
  28      [\fB-T\fR u | d ] [\fIinterval\fR [\fIcount\fR]]
  29 .fi
  30 
  31 .LP
  32 .nf
  33 \fBnetstat\fR \fB-m\fR [\fB-T\fR u | d ] [\fB-v\fR] [\fIinterval\fR [\fIcount\fR]]
  34 .fi
  35 
  36 .LP
  37 .nf
  38 \fBnetstat\fR \fB-i\fR [\fB-I\fR \fIinterface\fR] [\fB-acn\fR] [\fB-f\fR \fIaddress_family\fR]
  39      [\fB-T\fR u | d ] [\fIinterval\fR [\fIcount\fR]]
  40 .fi
  41 
  42 .LP
  43 .nf
  44 \fBnetstat\fR \fB-r\fR [\fB-acnvR\fR] [\fB-f\fR \fIaddress_family\fR | \fIfilter\fR]
  45 .fi
  46 
  47 .LP
  48 .nf
  49 \fBnetstat\fR \fB-M\fR [\fB-cns\fR] [\fB-f\fR \fIaddress_family\fR]
  50 .fi
  51 
  52 .LP
  53 .nf
  54 \fBnetstat\fR \fB-D\fR [\fB-I\fR \fIinterface\fR] [\fB-f\fR \fIaddress_family\fR]
  55 .fi
  56 
  57 .SH DESCRIPTION
  58 .LP
  59 The \fBnetstat\fR command displays the contents of certain network-related data
  60 structures in various formats, depending on the options you select.
  61 .LP
  62 The \fBnetstat\fR command has the several forms shown in the SYNOPSIS section,
  63 above, listed as follows:
  64 .RS +4
  65 .TP
  66 .ie t \(bu
  67 .el o
  68 The first form of the command (with no required arguments) displays a list of
  69 active sockets for each protocol.
  70 .RE
  71 .RS +4
  72 .TP
  73 .ie t \(bu
  74 .el o
  75 The second, third, and fourth forms (\fB-g\fR, \fB-p\fR, and \fB-s\fR options)
  76 display information from various network data structures.
  77 .RE
  78 .RS +4
  79 .TP
  80 .ie t \(bu
  81 .el o
  82 The fifth form (\fB-m\fR option) displays STREAMS memory statistics.
  83 .RE
  84 .RS +4
  85 .TP
  86 .ie t \(bu
  87 .el o
  88 The sixth form (\fB-i\fR option) shows the state of the interfaces.
  89 .RE
  90 .RS +4
  91 .TP
  92 .ie t \(bu
  93 .el o
  94 The seventh form (\fB-r\fR option) displays the routing table.
  95 .RE
  96 .RS +4
  97 .TP
  98 .ie t \(bu
  99 .el o
 100 The eighth form (\fB-M\fR option) displays the multicast routing table.
 101 .RE
 102 .RS +4
 103 .TP
 104 .ie t \(bu
 105 .el o
 106 The ninth form (\fB-D\fR option) displays the state of \fBDHCP\fR on one or all
 107 interfaces.
 108 .RE
 109 .LP
 110 These forms are described in greater detail below.
 111 .LP
 112 With no arguments (the first form), \fBnetstat\fR displays connected sockets
 113 for \fBPF_INET\fR, \fBPF_INET6\fR, and \fBPF_UNIX\fR, unless modified otherwise
 114 by the \fB-f\fR option.
 115 .SH OPTIONS
 116 .ne 2
 117 .na
 118 \fB\fB-a\fR\fR
 119 .ad
 120 .sp .6
 121 .RS 4n
 122 Show the state of all sockets, all routing table entries, or all interfaces,
 123 both physical and logical. Normally, listener sockets used by server processes
 124 are not shown. Under most conditions, only interface, host, network, and
 125 default routes are shown and only the status of physical interfaces is shown.
 126 .RE
 127 
 128 .sp
 129 .ne 2
 130 .na
 131 \fB\fB-c\fR\fR
 132 .ad
 133 .sp .6
 134 .RS 4n
 135 Print IPv4 networks using CIDR (x.y.z.a/NN) notation with the \fB-i\fR,
 136 \fB-r\fR, and \fB-M\fR options. IPv6 networks default to this, but due to
 137 backward compatibility, IPv4 ones do not without this flag.  A noncontiguous
 138 IPv4 netmask will print "/NM" if this flag is enabled.
 139 .RE
 140 
 141 .sp
 142 .ne 2
 143 .na
 144 \fB\fB-f\fR \fIaddress_family\fR\fR
 145 .ad
 146 .sp .6
 147 .RS 4n
 148 Limit all displays to those of the specified \fIaddress_family\fR. The value of
 149 \fIaddress_family\fR can be one of the following:
 150 .sp
 151 .ne 2
 152 .na
 153 \fB\fBinet\fR\fR
 154 .ad
 155 .RS 9n
 156 For the \fBAF_INET\fR address family showing IPv4 information.
 157 .RE
 158 
 159 .sp
 160 .ne 2
 161 .na
 162 \fB\fBinet6\fR\fR
 163 .ad
 164 .RS 9n
 165 For the \fBAF_INET6\fR address family showing IPv6 information.
 166 .RE
 167 
 168 .sp
 169 .ne 2
 170 .na
 171 \fB\fBunix\fR\fR
 172 .ad
 173 .RS 9n
 174 For the \fBAF_UNIX\fR address family.
 175 .RE
 176 
 177 .RE
 178 
 179 .sp
 180 .ne 2
 181 .na
 182 \fB\fB-f\fR \fIfilter\fR\fR
 183 .ad
 184 .sp .6
 185 .RS 4n
 186 With \fB-r\fR only, limit the display of routes to those matching the specified
 187 filter. A filter rule consists of a \fIkeyword\fR:\fIvalue\fR pair. The known
 188 keywords and the value syntax are:
 189 .sp
 190 .ne 2
 191 .na
 192 \fB\fBaf:\fR{\fBinet\fR|\fBinet6\fR|\fBunix\fR|\fInumber\fR}\fR
 193 .ad
 194 .sp .6
 195 .RS 4n
 196 Selects an address family. This is identical to \fB-f\fR \fIaddress_family\fR
 197 and both syntaxes are supported.
 198 .RE
 199 
 200 .sp
 201 .ne 2
 202 .na
 203 \fB\fBoutif\fR:{\fIname\fR|\fIifIndex\fR|\fBany\fR|\fBnone\fR}\fR
 204 .ad
 205 .sp .6
 206 .RS 4n
 207 Selects an output interface. You can specify the interface by name (such as
 208 \fBhme0\fR) or by \fBifIndex\fR number (for example, \fB2\fR). If \fBany\fR is
 209 used, the filter matches all routes having a specified interface (anything
 210 other than null). If \fBnone\fR is used, the filter matches all routes having a
 211 null interface. Note that you can view the index number (\fIifIndex\fR) for an
 212 interface with the \fB-a\fR option of \fBifconfig\fR(1M).
 213 .RE
 214 
 215 .sp
 216 .ne 2
 217 .na
 218 \fB\fBdst\fR:{\fIip-address\fR[/\fImask\fR]|\fBany\fR|\fBnone\fR}\fR
 219 .ad
 220 .sp .6
 221 .RS 4n
 222 Selects a destination IP address. If specified with a mask length, then any
 223 routes with matching or longer (more specific) masks are selected. If \fBany\fR
 224 is used, then all but addresses but 0 are selected. If \fBnone\fR is used, then
 225 address 0 is selected.
 226 .RE
 227 
 228 .sp
 229 .ne 2
 230 .na
 231 \fB\fBflags:\fR[\fB+ -\fR]?[\fBABDGHLMSU\fR]\fB+\fR\fR
 232 .ad
 233 .sp .6
 234 .RS 4n
 235 Selects routes tagged with the specified flags. By default, the flags as
 236 specified must be set in order to match. With a leading \fB+\fR, the flags
 237 specified must be set but others are ignored. With a leading \fB-\fR, the flags
 238 specified must not be set and others are permitted.
 239 .RE
 240 
 241 You can specify multiple instances of \fB-f\fR to specify multiple filters. For
 242 example:
 243 .sp
 244 .in +2
 245 .nf
 246 % netstat -nr -f outif:hme0 -f outif:hme1 -f dst:10.0.0.0/8
 247 .fi
 248 .in -2
 249 .sp
 250 
 251 The preceding command displays routes within network 10.0.0.0/8, with mask
 252 length 8 or greater, and an output interface of either \fBhme0\fR or
 253 \fBhme1\fR, and excludes all other routes.
 254 .RE
 255 
 256 .sp
 257 .ne 2
 258 .na
 259 \fB\fB-g\fR\fR
 260 .ad
 261 .sp .6
 262 .RS 4n
 263 Show the multicast group memberships for all interfaces. If the \fB-v\fR option
 264 is included, source-specific membership information is also displayed. See
 265 DISPLAYS, below.
 266 .RE
 267 
 268 .sp
 269 .ne 2
 270 .na
 271 \fB\fB-i\fR\fR
 272 .ad
 273 .sp .6
 274 .RS 4n
 275 Show the state of the interfaces that are used for \fBIP\fR traffic. Normally
 276 this shows statistics for the physical interfaces. When combined with the
 277 \fB-a\fR option, this will also report information for the logical interfaces.
 278 See \fBifconfig\fR(1M).
 279 .RE
 280 
 281 .sp
 282 .ne 2
 283 .na
 284 \fB\fB-m\fR\fR
 285 .ad
 286 .sp .6
 287 .RS 4n
 288 Show the STREAMS memory statistics.
 289 .RE
 290 
 291 .sp
 292 .ne 2
 293 .na
 294 \fB\fB-n\fR\fR
 295 .ad
 296 .sp .6
 297 .RS 4n
 298 Show network addresses as numbers. \fBnetstat\fR normally displays addresses as
 299 symbols. This option may be used with any of the display formats.
 300 .RE
 301 
 302 .sp
 303 .ne 2
 304 .na
 305 \fB\fB-p\fR\fR
 306 .ad
 307 .sp .6
 308 .RS 4n
 309 Show the net to media tables. See DISPLAYS, below.
 310 .RE
 311 
 312 .sp
 313 .ne 2
 314 .na
 315 \fB\fB-r\fR\fR
 316 .ad
 317 .sp .6
 318 .RS 4n
 319 Show the routing tables. Normally, only interface, host, network, and default
 320 routes are shown, but when this option is combined with the \fB-a\fR option,
 321 all routes will be displayed, including cache. If you have not set up a
 322 multicast route, \fB-ra\fR might not show any multicast routing entries,
 323 although the kernel will derive such an entry if needed.
 324 .RE
 325 
 326 .sp
 327 .ne 2
 328 .na
 329 \fB\fB-s\fR\fR
 330 .ad
 331 .sp .6
 332 .RS 4n
 333 Show per-protocol statistics. When used with the \fB-M\fR option, show
 334 multicast routing statistics instead. When used with the \fB-a\fR option,
 335 per-interface statistics will be displayed, when available, in addition to
 336 statistics global to the system. See DISPLAYS, below.
 337 .RE
 338 
 339 .sp
 340 .ne 2
 341 .na
 342 \fB\fB-T\fR \fBu\fR | \fBd\fR\fR
 343 .ad
 344 .sp .6
 345 .RS 4n
 346 Display a time stamp.
 347 .sp
 348 Specify \fBu\fR for a printed representation of the internal representation of
 349 time. See \fBtime\fR(2). Specify \fBd\fR for standard date format. See
 350 \fBdate\fR(1).
 351 .RE
 352 
 353 .sp
 354 .ne 2
 355 .na
 356 \fB\fB-v\fR\fR
 357 .ad
 358 .sp .6
 359 .RS 4n
 360 Verbose. Show additional information for the sockets, STREAMS memory
 361 statistics, routing table, and multicast group memberships.
 362 .RE
 363 
 364 .sp
 365 .ne 2
 366 .na
 367 \fB\fB-I\fR \fIinterface\fR\fR
 368 .ad
 369 .sp .6
 370 .RS 4n
 371 Show the state of a particular interface. \fIinterface\fR can be any valid
 372 interface such as \fBhme0\fR or \fBeri0\fR. Normally, the status and statistics
 373 for physical interfaces are displayed. When this option is combined with the
 374 \fB-a\fR option, information for the logical interfaces is also reported.
 375 .RE
 376 
 377 .sp
 378 .ne 2
 379 .na
 380 \fB\fB-M\fR\fR
 381 .ad
 382 .sp .6
 383 .RS 4n
 384 Show the multicast routing tables. When used with the \fB-s\fR option, show
 385 multicast routing statistics instead.
 386 .RE
 387 
 388 .sp
 389 .ne 2
 390 .na
 391 \fB\fB-P\fR \fIprotocol\fR\fR
 392 .ad
 393 .sp .6
 394 .RS 4n
 395 Limit display of statistics or state of all sockets to those applicable to
 396 \fIprotocol\fR. The protocol can be one of \fBip\fR, \fBipv6\fR, \fBicmp\fR,
 397 \fBicmpv6\fR, \fBicmp\fR, \fBicmpv6\fR, \fBigmp\fR, \fBudp\fR, \fBtcp\fR,
 398 \fBrawip\fR. \fBrawip\fR can also be specified as \fBraw\fR. The command
 399 accepts protocol options only as all lowercase.
 400 .RE
 401 
 402 .sp
 403 .ne 2
 404 .na
 405 \fB\fB-D\fR\fR
 406 .ad
 407 .sp .6
 408 .RS 4n
 409 Show the status of \fBDHCP\fR configured interfaces.
 410 .RE
 411 
 412 .sp
 413 .ne 2
 414 .na
 415 \fB\fB-R\fR\fR
 416 .ad
 417 .sp .6
 418 .RS 4n
 419 This modifier displays extended security attributes for sockets and routing
 420 table entries. The \fB-R\fR modifier is available only if the system is
 421 configured with the Solaris Trusted Extensions feature.
 422 .sp
 423 With \fB-r\fR only, this option displays the routing entries' gateway security
 424 attributes. See \fBroute\fR(1M) for more information on security attributes.
 425 .sp
 426 When displaying socket information using the first form of the command, this
 427 option displays additional information for Multi-Level Port(MLP) sockets. This
 428 includes:
 429 .RS +4
 430 .TP
 431 .ie t \(bu
 432 .el o
 433 The label for the peer if the socket is connected.
 434 .RE
 435 .RS +4
 436 .TP
 437 .ie t \(bu
 438 .el o
 439 The following flags can be appended to the socket's "State" output:
 440 .RS
 441 
 442 .sp
 443 .ne 2
 444 .na
 445 \fB\fBP\fR\fR
 446 .ad
 447 .RS 5n
 448 The socket is a MLP on zone-private IP addresses.
 449 .RE
 450 
 451 .sp
 452 .ne 2
 453 .na
 454 \fB\fBS\fR\fR
 455 .ad
 456 .RS 5n
 457 The socket is a MLP on IP addresses shared between zones.
 458 .RE
 459 .SH OPERANDS
 460 .ne 2
 461 .na
 462 \fB\fIinterval\fR\fR
 463 .ad
 464 .RS 12n
 465 Display statistics accumulated since last display every \fIinterval\fR seconds,
 466 repeating forever, unless \fIcount\fR is specified. When invoked with
 467 \fIinterval\fR, the first row of netstat output shows statistics accumulated
 468 since last reboot.
 469 .sp
 470 The following options support \fIinterval\fR: \fB-i\fR, \fB-m\fR, \fB-s\fR and
 471 \fB-Ms\fR. Some values are configuration parameters and are just redisplayed at
 472 each interval.
 473 .RE
 474 
 475 .sp
 476 .ne 2
 477 .na
 478 \fB\fIcount\fR\fR
 479 .ad
 480 .RS 12n
 481 Display interface statistics the number of times specified by \fIcount\fR, at
 482 the interval specified by \fIinterval\fR.
 483 .RE
 484 
 485 .SH DISPLAYS
 486 .SS "Active Sockets (First Form)"
 487 .LP
 488 The display for each active socket shows the local and remote address, the send
 489 and receive queue sizes (in bytes), the send and receive windows (in bytes),
 490 and the internal state of the protocol.
 491 .LP
 492 The symbolic format normally used to display socket addresses is either:
 493 .sp
 494 .in +2
 495 .nf
 496 \fBhostname\fR.\fIport\fR
 497 .fi
 498 .in -2
 499 .sp
 500 when the name of the host is specified, or
 501 .sp
 502 .in +2
 503 .nf
 504 \fInetwork\fR.\fIport\fR
 505 .fi
 506 .in -2
 507 .sp
 508 if a socket address specifies a network but no specific host.
 509 .LP
 510 The numeric host address or network number associated with the socket is used
 511 to look up the corresponding symbolic hostname or network name in the
 512 \fIhosts\fR or \fInetworks\fR database.
 513 .LP
 514 If the network or hostname for an address is not known, or if the \fB-n\fR
 515 option is specified, the numerical network address is shown. Unspecified, or
 516 "wildcard", addresses and ports appear as an asterisk (\fB*\fR). For more
 517 information regarding the Internet naming conventions, refer to \fBinet\fR(7P)
 518 and \fBinet6\fR(7P).
 519 .LP
 520 For SCTP sockets, because an endpoint can be represented by multiple addresses,
 521 the verbose option (\fB-v\fR) displays the list of all the local and remote
 522 addresses.
 523 .SS "\fITCP Sockets\fR"
 524 .LP
 525 The possible state values for \fBTCP\fR sockets are as follows:
 526 .sp
 527 .ne 2
 528 .na
 529 \fB\fBBOUND\fR\fR
 530 .ad
 531 .RS 16n
 532 Bound, ready to connect or listen.
 533 .RE
 534 
 535 .sp
 536 .ne 2
 537 .na
 538 \fB\fBCLOSED\fR\fR
 539 .ad
 540 .RS 16n
 541 Closed. The socket is not being used.
 542 .RE
 543 
 544 .sp
 545 .ne 2
 546 .na
 547 \fB\fBCLOSING\fR\fR
 548 .ad
 549 .RS 16n
 550 Closed, then remote shutdown; awaiting acknowledgment.
 551 .RE
 552 
 553 .sp
 554 .ne 2
 555 .na
 556 \fB\fBCLOSE_WAIT\fR\fR
 557 .ad
 558 .RS 16n
 559 Remote shutdown; waiting for the socket to close.
 560 .RE
 561 
 562 .sp
 563 .ne 2
 564 .na
 565 \fB\fBESTABLISHED\fR\fR
 566 .ad
 567 .RS 16n
 568 Connection has been established.
 569 .RE
 570 
 571 .sp
 572 .ne 2
 573 .na
 574 \fB\fBFIN_WAIT_1\fR\fR
 575 .ad
 576 .RS 16n
 577 Socket closed; shutting down connection.
 578 .RE
 579 
 580 .sp
 581 .ne 2
 582 .na
 583 \fB\fBFIN_WAIT_2\fR\fR
 584 .ad
 585 .RS 16n
 586 Socket closed; waiting for shutdown from remote.
 587 .RE
 588 
 589 .sp
 590 .ne 2
 591 .na
 592 \fB\fBIDLE\fR\fR
 593 .ad
 594 .RS 16n
 595 Idle, opened but not bound.
 596 .RE
 597 
 598 .sp
 599 .ne 2
 600 .na
 601 \fB\fBLAST_ACK\fR\fR
 602 .ad
 603 .RS 16n
 604 Remote shutdown, then closed; awaiting acknowledgment.
 605 .RE
 606 
 607 .sp
 608 .ne 2
 609 .na
 610 \fB\fBLISTEN\fR\fR
 611 .ad
 612 .RS 16n
 613 Listening for incoming connections.
 614 .RE
 615 
 616 .sp
 617 .ne 2
 618 .na
 619 \fB\fBSYN_RECEIVED\fR\fR
 620 .ad
 621 .RS 16n
 622 Initial synchronization of the connection under way.
 623 .RE
 624 
 625 .sp
 626 .ne 2
 627 .na
 628 \fB\fBSYN_SENT\fR\fR
 629 .ad
 630 .RS 16n
 631 Actively trying to establish connection.
 632 .RE
 633 
 634 .sp
 635 .ne 2
 636 .na
 637 \fB\fBTIME_WAIT\fR\fR
 638 .ad
 639 .RS 16n
 640 Wait after close for remote shutdown retransmission.
 641 .RE
 642 
 643 .SS "\fISCTP Sockets\fR"
 644 .LP
 645 The possible state values for SCTP sockets are as follows:
 646 .sp
 647 .ne 2
 648 .na
 649 \fB\fBCLOSED\fR\fR
 650 .ad
 651 .RS 21n
 652 Closed. The socket is not being used.
 653 .RE
 654 
 655 .sp
 656 .ne 2
 657 .na
 658 \fB\fBLISTEN\fR\fR
 659 .ad
 660 .RS 21n
 661 Listening for incoming associations.
 662 .RE
 663 
 664 .sp
 665 .ne 2
 666 .na
 667 \fB\fBESTABLISHED\fR\fR
 668 .ad
 669 .RS 21n
 670 Association has been established.
 671 .RE
 672 
 673 .sp
 674 .ne 2
 675 .na
 676 \fB\fBCOOKIE_WAIT\fR\fR
 677 .ad
 678 .RS 21n
 679 \fBINIT\fR has been sent to the peer, awaiting acknowledgment.
 680 .RE
 681 
 682 .sp
 683 .ne 2
 684 .na
 685 \fB\fBCOOKIE_ECHOED\fR\fR
 686 .ad
 687 .RS 21n
 688 State cookie from the INIT-ACK has been sent to the peer, awaiting
 689 acknowledgement.
 690 .RE
 691 
 692 .sp
 693 .ne 2
 694 .na
 695 \fB\fBSHUTDOWN_PENDING\fR\fR
 696 .ad
 697 .RS 21n
 698 \fBSHUTDOWN\fR has been received from the upper layer, awaiting acknowledgement
 699 of all outstanding \fBDATA\fR from the peer.
 700 .RE
 701 
 702 .sp
 703 .ne 2
 704 .na
 705 \fB\fBSHUTDOWN_SENT\fR\fR
 706 .ad
 707 .RS 21n
 708 All outstanding data has been acknowledged in the \fBSHUTDOWN_SENT\fR state.
 709 \fBSHUTDOWN\fR has been sent to the peer, awaiting acknowledgement.
 710 .RE
 711 
 712 .sp
 713 .ne 2
 714 .na
 715 \fB\fBSHUTDOWN_RECEIVED\fR\fR
 716 .ad
 717 .RS 21n
 718 \fBSHUTDOWN\fR has been received from the peer, awaiting acknowledgement of all
 719 outstanding \fBDATA\fR.
 720 .RE
 721 
 722 .sp
 723 .ne 2
 724 .na
 725 \fB\fBSHUTDOWN_ACK_SENT\fR\fR
 726 .ad
 727 .RS 21n
 728 All outstanding data has been acknowledged in the \fBSHUTDOWN_RECEIVED\fR
 729 state. \fBSHUTDOWN_ACK\fR has been sent to the peer.
 730 .RE
 731 
 732 .SS "Network Data Structures (Second Through Fifth Forms)"
 733 .LP
 734 The form of the display depends upon which of the \fB-g\fR, \fB-m\fR, \fB-p\fR,
 735 or \fB-s\fR options you select.
 736 .sp
 737 .ne 2
 738 .na
 739 \fB\fB-g\fR\fR
 740 .ad
 741 .RS 6n
 742 Displays the list of multicast group membership.
 743 .RE
 744 
 745 .sp
 746 .ne 2
 747 .na
 748 \fB\fB-m\fR\fR
 749 .ad
 750 .RS 6n
 751 Displays the memory usage, for example, STREAMS mblks.
 752 .RE
 753 
 754 .sp
 755 .ne 2
 756 .na
 757 \fB\fB-p\fR\fR
 758 .ad
 759 .RS 6n
 760 Displays the net to media mapping table. For IPv4, the address resolution table
 761 is displayed. See \fBarp\fR(1M). For IPv6, the neighbor cache is displayed.
 762 .RE
 763 
 764 .sp
 765 .ne 2
 766 .na
 767 \fB\fB-s\fR\fR
 768 .ad
 769 .RS 6n
 770 Displays the statistics for the various protocol layers.
 771 .RE
 772 
 773 .sp
 774 .LP
 775 The statistics use the MIB specified variables. The defined values for
 776 \fBipForwarding\fR are:
 777 .sp
 778 .ne 2
 779 .na
 780 \fB\fBforwarding (1)\fR\fR
 781 .ad
 782 .RS 21n
 783 Acting as a gateway.
 784 .RE
 785 
 786 .sp
 787 .ne 2
 788 .na
 789 \fB\fBnot-forwarding (2)\fR\fR
 790 .ad
 791 .RS 21n
 792 Not acting as a gateway.
 793 .RE
 794 
 795 .sp
 796 .LP
 797 The IPv6 and ICMPv6 protocol layers maintain per-interface statistics. If the
 798 \fB-a\fR option is specified with the \fB-s\fR option, then the per-interface
 799 statistics as well as the total sums are displayed. Otherwise, just the sum of
 800 the statistics are shown.
 801 .LP
 802 For the second, third, and fourth forms of the command, you must specify at
 803 least \fB-g\fR, \fB-p\fR, or \fB-s\fR. You can specify any combination of these
 804 options. You can also specify \fB-m\fR (the fifth form) with any set of the
 805 \fB-g\fR, \fB-p\fR, and \fB-s\fR options. If you specify more than one of these
 806 options, \fBnetstat\fR displays the information for each one of them.
 807 .SS "Interface Status (Sixth Form)"
 808 .LP
 809 The interface status display lists information for all current interfaces, one
 810 interface per line. If an interface is specified using the \fB-I\fR option, it
 811 displays information for only the specified interface.
 812 .LP
 813 The list consists of the interface name, \fBmtu\fR (maximum transmission unit,
 814 or maximum packet size)(see \fBifconfig\fR(1M)), the network to which the
 815 interface is attached, addresses for each interface, and counter associated
 816 with the interface. The counters show the number of input packets, input
 817 errors, output packets, output errors, and collisions, respectively. For
 818 Point-to-Point interfaces, the Net/Dest field is the name or address on the
 819 other side of the link.
 820 .LP
 821 If the \fB-a\fR option is specified with either the \fB-i\fR option or the
 822 \fB-I\fR option, then the output includes names of the physical interface(s),
 823 counts for input packets and output packets for each logical interface, plus
 824 additional information.
 825 .LP
 826 If the \fB-n\fR option is specified, the list displays the IP address instead
 827 of the interface name.
 828 .LP
 829 If an optional \fIinterval\fR is specified, the output will be continually
 830 displayed in \fIinterval\fR seconds until interrupted by the user or until
 831 \fIcount\fR is reached. See OPERANDS.
 832 .LP
 833 The physical interface is specified using the \fB-I\fR option. When used with
 834 the \fIinterval\fR operand, output for the \fB-I\fR option has the following
 835 format:
 836 .sp
 837 .in +2
 838 .nf
 839 input    eri0          output        input          (Total)   output
 840 packets  errs  packets errs  colls   packets  errs  packets  errs   colls
 841 227681   0     659471  1     502     261331   0     99597    1      502
 842 10       0     0       0     0       10       0     0        0      0
 843 8        0     0       0     0       8        0     0        0      0
 844 10       0     2       0     0       10       0     2        0      0
 845 .fi
 846 .in -2
 847 .sp
 848 .LP
 849 If the input interface is not specified, the first interface of address family
 850 \fBinet\fR or \fBinet6\fR will be displayed.
 851 .SS "Routing Table (Seventh Form)"
 852 .LP
 853 The routing table display lists the available routes and the status of each.
 854 Each route consists of a destination host or network, and a gateway to use in
 855 forwarding packets. The \fIflags\fR column shows the status of the route. These
 856 flags are as follows:
 857 .sp
 858 .ne 2
 859 .na
 860 \fB\fBU\fR\fR
 861 .ad
 862 .RS 5n
 863 Indicates route is \fBup\fR.
 864 .RE
 865 
 866 .sp
 867 .ne 2
 868 .na
 869 \fB\fBG\fR\fR
 870 .ad
 871 .RS 5n
 872 Route is to a gateway.
 873 .RE
 874 
 875 .sp
 876 .ne 2
 877 .na
 878 \fB\fBH\fR\fR
 879 .ad
 880 .RS 5n
 881 Route is to a host and not a network.
 882 .RE
 883 
 884 .sp
 885 .ne 2
 886 .na
 887 \fB\fBM\fR\fR
 888 .ad
 889 .RS 5n
 890 Redundant route established with the \fB-multirt\fR option.
 891 .RE
 892 
 893 .sp
 894 .ne 2
 895 .na
 896 \fB\fBS\fR\fR
 897 .ad
 898 .RS 5n
 899 Route was established using the \fB-setsrc\fR option.
 900 .RE
 901 
 902 .sp
 903 .ne 2
 904 .na
 905 \fB\fBD\fR\fR
 906 .ad
 907 .RS 5n
 908 Route was created dynamically by a redirect.
 909 .RE
 910 
 911 .sp
 912 .LP
 913 If the \fB-a\fR option is specified, there will be routing entries with the
 914 following flags:
 915 .sp
 916 .ne 2
 917 .na
 918 \fB\fBA\fR\fR
 919 .ad
 920 .RS 5n
 921 Combined routing and address resolution entries.
 922 .RE
 923 
 924 .sp
 925 .ne 2
 926 .na
 927 \fB\fBB\fR\fR
 928 .ad
 929 .RS 5n
 930 Broadcast addresses.
 931 .RE
 932 
 933 .sp
 934 .ne 2
 935 .na
 936 \fB\fBL\fR\fR
 937 .ad
 938 .RS 5n
 939 Local addresses for the host.
 940 .RE
 941 
 942 .LP
 943 Interface routes are created for each interface attached to the local host; the
 944 gateway field for such entries shows the address of the outgoing interface.
 945 .LP
 946 The \fBuse\fR column displays the number of packets sent using a combined
 947 routing and address resolution (\fBA\fR) or a broadcast (\fBB\fR) route. For a
 948 local (\fBL\fR) route, this count is the number of packets received, and for
 949 all other routes it is the number of times the routing entry has been used to
 950 create a new combined route and address resolution entry.
 951 .LP
 952 The \fIinterface\fR entry indicates the network interface utilized for the
 953 route.
 954 .SS "Multicast Routing Tables (Eighth Form)"
 955 .LP
 956 The multicast routing table consists of the virtual interface table and the
 957 actual routing table.
 958 .SS "DHCP Interface Information (Ninth Form)"
 959 .LP
 960 The \fBDHCP\fR interface information consists of the interface name, its
 961 current state, lease information, packet counts, and a list of flags.
 962 .LP
 963 The states correlate with the specifications set forth in \fIRFC 2131\fR.
 964 .LP
 965 Lease information includes:
 966 .RS +4
 967 .TP
 968 .ie t \(bu
 969 .el o
 970 when the lease began;
 971 .RE
 972 .RS +4
 973 .TP
 974 .ie t \(bu
 975 .el o
 976 when lease renewal will begin; and
 977 .RE
 978 .RS +4
 979 .TP
 980 .ie t \(bu
 981 .el o
 982 when the lease will expire.
 983 .RE
 984 .sp
 985 .LP
 986 The flags currently defined include:
 987 .sp
 988 .ne 2
 989 .na
 990 \fB\fBBOOTP\fR\fR
 991 .ad
 992 .RS 11n
 993 The interface has a lease obtained through \fBBOOTP\fR (IPv4 only).
 994 .RE
 995 
 996 .sp
 997 .ne 2
 998 .na
 999 \fB\fBBUSY\fR\fR
1000 .ad
1001 .RS 11n
1002 The interface is busy with a \fBDHCP\fR transaction.
1003 .RE
1004 
1005 .sp
1006 .ne 2
1007 .na
1008 \fB\fBPRIMARY\fR\fR
1009 .ad
1010 .RS 11n
1011 The interface is the primary interface. See \fBdhcpinfo\fR(1) and
1012 \fBifconfig\fR(1M).
1013 .RE
1014 
1015 .sp
1016 .ne 2
1017 .na
1018 \fB\fBFAILED\fR\fR
1019 .ad
1020 .RS 11n
1021 The interface is in failure state and must be manually restarted.
1022 .RE
1023 
1024 .LP
1025 Packet counts are maintained for the number of packets sent, the number of
1026 packets received, and the number of lease offers declined by the \fBDHCP\fR
1027 client. All three counters are initialized to zero and then incremented while
1028 obtaining a lease. The counters are reset when the period of lease renewal
1029 begins for the interface. Thus, the counters represent either the number of
1030 packets sent, received, and declined while obtaining the current lease, or the
1031 number of packets sent, received, and declined while attempting to obtain a
1032 future lease.
1033 .SH FILES
1034 .ne 2
1035 .na
1036 \fB\fB/etc/default/inet_type\fR\fR
1037 .ad
1038 .RS 26n
1039 \fBDEFAULT_IP\fR setting
1040 .RE
1041 
1042 .SH SEE ALSO
1043 .LP
1044 \fBarp\fR(1M), \fBdhcpinfo\fR(1), \fBdhcpagent\fR(1M), \fBifconfig\fR(1M),
1045 \fBiostat\fR(1M), \fBkstat\fR(1M), \fBmibiisa\fR(1M), \fBndp\fR(1M), \fBsavecore\fR(1M),
1046 \fBvmstat\fR(1M), \fBhosts\fR(4), \fBinet_type\fR(4), \fBnetworks\fR(4),
1047 \fBprotocols\fR(4), \fBservices\fR(4), \fBattributes\fR(5), \fBdhcp\fR(5),
1048 \fBkstat\fR(7D), \fBinet\fR(7P), \fBinet6\fR(7P)
1049 .sp
1050 .LP
1051 Droms, R., \fIRFC 2131, Dynamic Host Configuration Protocol\fR, Network Working
1052 Group, March 1997.
1053 .sp
1054 .LP
1055 Droms, R. \fIRFC 3315, Dynamic Host Configuration Protocol for IPv6
1056 (DHCPv6)\fR. Cisco Systems. July 2003.
1057 .SH NOTES
1058 .LP
1059 When displaying interface information, \fBnetstat\fR honors the
1060 \fBDEFAULT_IP\fR setting in \fB/etc/default/inet_type\fR. If it is set to
1061 \fBIP_VERSION4\fR, then \fBnetstat\fR will omit information relating to IPv6
1062 interfaces, statistics, connections, routes and the like.
1063 .LP
1064 However, you can override the \fBDEFAULT_IP\fR setting in
1065 \fB/etc/default/inet_type\fR on the command-line. For example, if you have used
1066 the command-line to explicitly request IPv6 information by using the
1067 \fBinet6\fR address family or one of the IPv6 protocols, it will override the
1068 \fBDEFAULT_IP\fR setting.
1069 .LP
1070 If you need to examine network status information following a kernel crash, use
1071 the \fBmdb\fR(1) utility on the \fBsavecore\fR(1M) output.
1072 .LP
1073 The \fBnetstat\fR utility obtains TCP statistics from the system by opening
1074 \fB/dev/tcp\fR and issuing queries. Because of this, \fBnetstat\fR might
1075 display an extra, unused connection in \fBIDLE\fR state when reporting
1076 connection status.
1077 .LP
1078 Previous versions of \fBnetstat\fR had undocumented methods for reporting
1079 kernel statistics published using the \fBkstat\fR(7D) facility. This
1080 functionality has been removed. Use \fBkstat\fR(1M) instead.
1081 .LP
1082 \fBnetstat\fR restricts its output to information that is relevant to the zone
1083 in which \fBnetstat\fR runs. (This is true for both shared-IP and exclusive-IP
1084 zones.)