>netstat -gi
Name Mtu Network Address Ipkts Ierrs Opkts Oerrs Coll
lo0 16384 <Link#1> 582 0 582 0 0
lo0 16384 localhost fe80::1 582 - 582 - -
lo0 16384 127 localhost 582 - 582 - -
lo0 16384 localhost ::1 582 - 582 - -
gif0* 1280 <Link#2> 0 0 0 0 0
stf0* 1280 <Link#3> 0 0 0 0 0
en0 1500 <Link#4> 00:11:24:47:3f:aa 0 0 0 0 0
fw0 2030 <Link#5> 00:11:24:ff:fe:47:3f:aa 0 0 0 0 0
en1 1500 <Link#6> 00:19:e3:32:0f:8c 16916 0 8141 0 0
|
OUTPUT
shows the local and remote addresses, send and receive queue sizes (in bytes), protocol, and the internal state of the protocol.
Address are of the form host.port or network.port if a socket's address specifies a network but no specific host address.
Host and network addresses are displayed symbolically according to the /etc/hosts and /etc/networks.
If a symbolic name for an address is unknown, or if the -n is specified, the address is printed numerically, according to the address family. dot format, refer to inet).
Unspecified, or wildcard, addresses and ports appear as *.
netstat -f inet
Active Internet connections
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp4 0 0 smacker.GERMANS.51555 slammer.GERMANS.netbio ESTABLISHED
tcp4 0 0 smacker.GERMANS.50325 esc170.midphase..ssh ESTABLISHED
tcp4 0 0 smacker.GERMANS.50303 esc170.midphase..ftp CLOSE_WAIT
tcp4 0 0 smacker.GERMANS.49613 esc170.midphase..ftp CLOSE_WAIT
udp4 0 0 smacker.GERMANS.netbio *.*
udp4 0 0 smacker.GERMANS.netbio *.*
udp4 0 0 *.netbios-dgm *.*
udp4 0 0 *.netbios-ns *.*
udp4 0 0 smacker.GERMANS.kerber *.*
udp4 0 0 *.55227 *.*
…
udp4 0 0 *.52859 *.*
udp4 0 0 smacker.GERMANS.ntp *.*
udp4 0 0 localhost.ntp *.*
udp4 0 0 *.ntp *.*
udp4 0 0 *.* *.*
udp4 0 0 *.mdns *.*
udp4 0 0 *.* *.*
|
Internet domain socket states:
CLOSED| not in use.
| LISTEN listening for incoming connections. only displayed with -a .
| SYN_SENT| actively trying to establish a connection to a remote peer.
| SYN_RCVD| passively received a connection request from a remote peer.
| ESTABLISHED| has an established connection between a local application and a remote peer.
| CLOSE_WAIT| closed by the remote peer, and the system is waiting for the local application to close its half of the connection.
| LAST_ACK| closed by the remote peer and local application, waiting for the remote peer to acknowledge the close.
| FIN_WAIT_1| closed by the local application, the remote peer has not yet acknowledged the close, and the system is waiting for it to close its half of the connection.
| FIN_WAIT_2| closed by the local
application, the remote peer has acknowledged the close, and the system
is waiting for it to close its half of the connection.
| CLOSING| closed by the local application
and the remote peer simultaneously, and the remote peer has not yet
acknowledged the close attempt of the local application.
| TIME_WAIT| closed by the local
application and the remote peer, waiting to be sure that the remote peer received the last acknowledgement.
| | | | | | | | | | | |
The interface display provides a table of cumulative statistics regarding packets
transferred, errors, and collisions. The network addresses of the interface and the
maximum transmission unit (mtu) are also displayed.
The routing table display indicates the available routes and their status. Each
route consists of a destination host or network and a gateway to use in forwarding
packets. The flags field shows a collection of information about the route stored as
binary choices. The individual flags are discussed in more detail in the route(8)
and route(4) manual pages. The mapping between letters and flags is:
1RTF_PROTO1|
| 2RTF_PROTO2|
| 3RTF_PROTO3|
| BRTF_BLACKHOLE| discard packets (during updates)
| bRTF_BROADCAST| a broadcast address
| CRTF_CLONING| Generate new routes on use
| cRTF_PRCLONING| Protocol-specified generate new routes on use
| DRTF_DYNAMIC| Created dynamically (by redirect)
| GRTF_GATEWAY| Destination requires forwarding by intermediary
| HRTF_HOST| net otherwise
| LRTF_LLINFO| Valid protocol to link address translation
| MRTF_MODIFIED| Modified dynamically (by redirect)
| RRTF_REJECT| Host or net unreachable
| SRTF_STATIC| Manually added
| URTF_UP| Route usable
| WRTF_WASCLONED| Route was generated as a result of cloning
| XRTF_XRESOLVE| External daemon translates proto to link address
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
Direct routes are created for each interface attached to the local host; the gateway field for such entries shows the address of the outgoing interface.
The refcnt field gives the current number of active uses of the route. Connection oriented protocols normally hold on to a single route for the duration of a connection while connection less protocols obtain a route while sending to the same destination.
The use field provides a count of the number of packets sent using that route.
The interface entry indicates the network interface utilized for the route.
When netstat is invoked with -w wait a running count of statistics related to network interfaces or protocols.
By default, this display summarizes information for all interfaces.
Information for a specific interface may be displayed with -I.
> netstat -A
Active Internet connections
Proto Recv-Q Send-Q Local Address Foreign Address (state)
udp4 0 0 smacker.GERMANS.netbio *.*
udp4 0 0 smacker.GERMANS.netbio *.*
udp4 0 0 smacker.GERMANS.ntp *.*
udp4 0 0 smacker.GERMANS.kerber *.*
udp6 0 0 smacker.local.kerberos *.*
udp6 0 0 localhost.kerberos *.*
udp4 0 0 *.61492 *.*
udp4 0 0 *.61420 *.*
udp4 0 0 *.52348 *.*
udp4 0 0 *.57114 *.*
udp4 0 0 *.53745 *.*
udp4 0 0 *.60167 *.*
udp4 0 0 *.52932 *.*
udp4 0 0 *.49719 *.*
udp4 0 0 *.52426 *.*
udp4 0 0 *.60775 *.*
udp4 0 0 *.54721 *.*
udp4 0 0 *.netbios-dgm *.*
udp4 0 0 *.netbios-ns *.*
udp4 0 0 *.* *.*
udp6 0 0 smacker.local.ntp *.*
udp6 0 0 localhost.ntp *.*
udp4 0 0 localhost.ntp *.*
udp6 0 0 localhost.ntp *.*
udp6 0 0 *.ntp *.*
udp4 0 0 *.ntp *.*
udp6 0 0 *.mdns *.*
udp4 0 0 *.mdns *.*
udp4 0 0 *.* *.*
icm6 0 0 *.* *.*
Active LOCAL (UNIX) domain sockets
Address Type Recv-Q Send-Q Inode Conn Refs Nextref Addr
2bce088 stream 0 0 0 55ded48 0 0
55ded48 stream 0 0 0 2bce088 0 0
2ca3440 stream 0 0 0 2bcea18 0 0 /var/run/asl_input
2bcea18 stream 0 0 0 2ca3440 0 0
2ca3770 stream 0 0 0 2bceb28 0 0 /var/run/asl_input
2bceb28 stream 0 0 0 2ca3770 0 0
… many simular entries ommited …
2ca3330 stream 0 0 0 2cbd660 0 0
2cbd660 stream 0 0 0 2ca3330 0 0
Address Type Recv-Q Send-Q Inode Conn Refs Nextref Addr
2cbd3b8 stream 0 0 31c9680 0 0 0 /tmp/launch-BPZQcK/:0
2cbd770 stream 0 0 31c97a0 0 0 0 /tmp/launch-M1pYIi/Listeners
2cbd990 stream 0 0 31c98c0 0 0 0 /tmp/launch-HmDrRD/Render
2cbd6e8 stream 0 0 31c99e0 0 0 0 /private/tmp/com.hp.launchport
26babb0 stream 0 0 31c9cb0 0 0 0 /tmp/launchd-106.s5jA82/sock
Address Type Recv-Q Send-Q Inode Conn Refs Nextref Addr
2ca3e58 stream 0 0 0 2cbd4c8 0 0
2cbd4c8 stream 0 0 0 2ca3e58 0 0
2cbdb28 stream 0 0 0 2cbd2a8 0 0
2cbd2a8 stream 0 0 0 2cbdb28 0 0
2ca37f8 stream 0 0 0 2cbd908 0 0 /var/run/mDNSResponder
2cbd908 stream 0 0 0 2ca37f8 0 0
… many simular entries ommited …
2bcef68 stream 0 0 2bbe6c0 0 0 0 /var/run/pppconfd
26bac38 stream 0 0 27a2ac0 0 0 0 /var/tmp/launchd/sock
26bacc0 stream 0 0 27a2be0 0 0 0 /private/var/run/cupsd
26bad48 stream 0 0 27a2d00 0 0 0 /var/run/usbmuxd
26bae58 stream 0 0 27a2e20 0 0 0 /var/run/asl_input
26baf68 stream 0 0 27a2eb0 0 0 0 /var/run/portmap.socket
26baee0 stream 0 0 27a2f40 0 0 0 /var/run/mDNSResponder
Address Type Recv-Q Send-Q Inode Conn Refs Nextref Addr
55deee0 dgram 0 0 0 2cbd110 2cbd110 0
2cbd110 dgram 0 0 0 55deee0 55deee0 0
2ca3f68 dgram 0 0 0 2bce000 2bce000 0
2bce000 dgram 0 0 0 2ca3f68 2ca3f68 0
… many simular entries ommited …
2bce990 dgram 0 0 0 26badd0 0 2bce6e8
2bce6e8 dgram 0 0 0 26badd0 0 2ca3908
2ca3908 dgram 0 0 0 26badd0 0 2ca3ee0
2ca3b28 dgram 0 0 0 2ca33b8 2ca33b8 0
2ca33b8 dgram 0 0 0 2ca3b28 2ca3b28 0
2cbd198 dgram 0 0 0 2ca3198 2ca3198 0
2ca3198 dgram 0 0 0 2cbd198 2cbd198 0
2ca3ee0 dgram 0 0 0 26badd0 0 2ca34c8
2ca34c8 dgram 0 0 0 26badd0 0 2cbd440
2cbd440 dgram 0 0 0 26badd0 0 2bce660
2cbd330 dgram 0 0 0 2cbd220 2cbd220 0
2cbd220 dgram 0 0 0 2cbd330 2cbd330 0
2bce660 dgram 0 0 0 26badd0 0 26ba3b8
26ba2a8 dgram 0 0 0 26ba220 26ba220 0
26ba220 dgram 0 0 0 26ba2a8 26ba2a8 0
26ba3b8 dgram 0 0 0 26badd0 0 26ba660
26ba660 dgram 0 0 0 26badd0 0 26ba7f8
26ba7f8 dgram 0 0 0 26badd0 0 0
26badd0 dgram 0 0 27a2d90 0 2bce990 0 /var/run/syslog
|
SEE
fstat(1), nfsstat(1), ps(1), sockstat(1), inet(4), unix(4), hosts(5), networks(5),
protocols(5), services(5), iostat(8), trpt(8), vmstat(8)
June 15, 2001 Darwin
Microsoft version
NETSTAT [-a] [-b] [-e] [-f] [-n] [-o] [-p proto] [-r] [-s] [-t] [interval]
-a | all connections and listening ports.
| -b binary executable involved in creating each connection or
listening port.
In some cases well-known executables host multiple independent components,
sequence of components involved in creating the connection
or listening port is displayed, the executable
name is in [] at the bottom, on top is the component it called,
and so forth until TCP/IP was reached.
Time-consuming and will fail without sufficient permissions.
| -e | Ethernet statistics. This may be combined with the -s option.
| -f | Fully Qualified Domain Names (FQDN) for foreign addresses.
| -n | numerical form.
| -o | the owning process ID associated with each connection.
| -p proto proto may be: TCP, UDP, TCPv6, or UDPv6.
With -s to display per-protocol statistics, proto may be :
IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, or UDPv6.
| -s | statistics. By default, statistics are
shown for IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, and UDPv6;
| -r | routing table.
| -t current connection offload state.
| interval Redisplays pausing interval seconds between each display.
| | | | | | | | | | | |
examples
netstat -e
Interface Statistics
Received Sent
Bytes 966629805 107094276
Unicast packets 827616 496033
Non-unicast packets 344958 100182
Discards 0 0
Errors 0 0
Unknown protocols 0
netstat -a -b Without -b does not provide name of executable
The requested operation requires elevation.†
netstat -a -b
Active Connections †
Proto Local Address Foreign Address State
TCP 0.0.0.0:21 kitchen:0 LISTENING [FileZilla Server.exe]
TCP 0.0.0.0:135 kitchen:0 LISTENING RpcSs [svchost.exe]
TCP 0.0.0.0:445 kitchen:0 LISTENING Can not obtain ownership information
TCP 0.0.0.0:2869 kitchen:0 LISTENING Can not obtain ownership information
TCP 0.0.0.0:5357 kitchen:0 LISTENING Can not obtain ownership information
TCP 0.0.0.0:49152 kitchen:0 LISTENING [wininit.exe]
TCP 0.0.0.0:49153 kitchen:0 LISTENING eventlog [svchost.exe]
TCP 0.0.0.0:49154 kitchen:0 LISTENING Schedule [svchost.exe]
TCP 0.0.0.0:49156 kitchen:0 LISTENING [lsass.exe]
TCP 0.0.0.0:49157 kitchen:0 LISTENING [services.exe]
TCP 0.0.0.0:49158 kitchen:0 LISTENING [spoolsv.exe]
TCP 127.0.0.1:2559 kitchen:0 LISTENING [daemonu.exe]
TCP 127.0.0.1:5354 kitchen:0 LISTENING [mDNSResponder.exe]
TCP 127.0.0.1:5354 kitchen:49155 ESTABLISHED [mDNSResponder.exe]
TCP 127.0.0.1:14147 kitchen:0 LISTENING [FileZilla Server.exe]
TCP 127.0.0.1:27015 kitchen:0 LISTENING [AppleMobileDeviceService.exe]
TCP 127.0.0.1:27015 kitchen:49190 ESTABLISHED [AppleMobileDeviceService.exe]
TCP 127.0.0.1:49155 kitchen:5354 ESTABLISHED [AppleMobileDeviceService.exe]
TCP 127.0.0.1:49190 kitchen:27015 ESTABLISHED [iTunesHelper.exe]
TCP 127.0.0.1:56761 kitchen:56762 ESTABLISHED [firefox.exe]
TCP 127.0.0.1:56762 kitchen:56761 ESTABLISHED [firefox.exe]
TCP 127.0.0.1:56763 kitchen:56764 ESTABLISHED [firefox.exe]
TCP 127.0.0.1:56764 kitchen:56763 ESTABLISHED [firefox.exe]
TCP 127.0.0.1:59243 kitchen:0 LISTENING [KhalScroll.exe]
TCP 192.168.1.5:139 kitchen:0 LISTENING Can not obtain ownership information
TCP 192.168.1.5:4242 kitchen:0 LISTENING [SATARaid5ConfigService.exe]
TCP 192.168.1.5:4242 kitchen:56746 ESTABLISHED [SATARaid5ConfigService.exe]
TCP 192.168.1.5:56285 63.118.252.8:http CLOSE_WAIT [OUTLOOK.EXE]
TCP 192.168.1.5:56286 63.118.252.8:http CLOSE_WAIT [OUTLOOK.EXE]
TCP 192.168.1.5:56746 kitchen:4242 ESTABLISHED [javaw.exe]
TCP 192.168.1.5:56774 real-world-systems:ssh ESTABLISHED [putty.exe]
TCP 192.168.1.5:56791 real-world-systems:http TIME_WAIT
TCP 192.168.1.5:56792 real-world-systems:http TIME_WAIT
TCP 192.168.1.5:56793 real-world-systems:http TIME_WAIT
TCP 192.168.1.5:56797 real-world-systems:http TIME_WAIT
TCP 192.168.1.5:56798 real-world-systems:http TIME_WAIT
TCP 192.168.1.5:56799 real-world-systems:http TIME_WAIT
TCP [::]:21 kitchen:0 LISTENING [FileZilla Server.exe]
TCP [::]:135 kitchen:0 LISTENING RpcSs [svchost.exe]
TCP [::]:445 kitchen:0 LISTENING Can not obtain ownership information
TCP [::]:2869 kitchen:0 LISTENING Can not obtain ownership information
TCP [::]:5357 kitchen:0 LISTENING Can not obtain ownership information
TCP [::]:49152 kitchen:0 LISTENING [wininit.exe]
TCP [::]:49153 kitchen:0 LISTENING eventlog [svchost.exe]
TCP [::]:49154 kitchen:0 LISTENING Schedule [svchost.exe]
TCP [::]:49156 kitchen:0 LISTENING [lsass.exe]
TCP [::]:49157 kitchen:0 LISTENING [services.exe]
TCP [::]:49158 kitchen:0 LISTENING [spoolsv.exe]
TCP [::1]:14147 kitchen:0 LISTENING [FileZilla Server.exe]
TCP [fe80::9027:a9c8:8ff3:cb1d%15]:445 kitchen:49309 ESTABLISHED Can not obtain ownership information
TCP [fe80::9027:a9c8:8ff3:cb1d%15]:49309 kitchen:microsoft-ds ESTABLISHED Can not obtain ownership information
UDP 0.0.0.0:500 *:* IKEEXT [svchost.exe]
UDP 0.0.0.0:3702 *:* EventSystem [svchost.exe]
UDP 0.0.0.0:3702 *:* FDResPub [svchost.exe]
UDP 0.0.0.0:3702 *:* FDResPub [svchost.exe]
UDP 0.0.0.0:3702 *:* EventSystem [svchost.exe]
UDP 0.0.0.0:4500 *:* IKEEXT [svchost.exe]
UDP 0.0.0.0:5355 *:* Dnscache [svchost.exe]
UDP 0.0.0.0:57937 *:* [mDNSResponder.exe]
UDP 0.0.0.0:58829 *:* EventSystem [svchost.exe]
UDP 0.0.0.0:59858 *:* FDResPub [svchost.exe]
UDP 127.0.0.1:1900 *:* SSDPSRV [svchost.exe]
UDP 127.0.0.1:48000 *:* [daemonu.exe]
UDP 127.0.0.1:54674 *:* SSDPSRV [svchost.exe]
UDP 127.0.0.1:57289 *:* [OUTLOOK.EXE]
UDP 127.0.0.1:57939 *:* [AppleMobileDeviceService.exe]
UDP 127.0.0.1:57940 *:* [AppleMobileDeviceService.exe]
UDP 127.0.0.1:60976 *:* [iTunesHelper.exe]
UDP 127.0.0.1:60977 *:* [iTunesHelper.exe]
UDP 192.168.1.5:137 *:* Can not obtain ownership information
UDP 192.168.1.5:138 *:* Can not obtain ownership information
UDP 192.168.1.5:1900 *:* SSDPSRV [svchost.exe]
UDP 192.168.1.5:5353 *:* [mDNSResponder.exe]
UDP 192.168.1.5:54673 *:* SSDPSRV [svchost.exe]
UDP [::]:500 *:* IKEEXT [svchost.exe]
UDP [::]:3702 *:* EventSystem [svchost.exe]
UDP [::]:3702 *:* FDResPub [svchost.exe]
UDP [::]:3702 *:* EventSystem [svchost.exe]
UDP [::]:3702 *:* FDResPub [svchost.exe]
UDP [::]:4500 *:* IKEEXT [svchost.exe]
UDP [::]:5355 *:* Dnscache [svchost.exe]
UDP [::]:57938 *:* [mDNSResponder.exe]
UDP [::]:58830 *:* EventSystem [svchost.exe]
UDP [::]:59859 *:* FDResPub [svchost.exe]
UDP [::1]:1900 *:* SSDPSRV [svchost.exe]
UDP [::1]:5353 *:* [mDNSResponder.exe]
UDP [::1]:54672 *:* SSDPSRV [svchost.exe]
UDP [fe80::9027:a9c8:8ff3:cb1d%15]:1900 *:* SSDPSRV [svchost.exe]
UDP [fe80::9027:a9c8:8ff3:cb1d%15]:54671 *:* SSDPSRV [svchost.exe]
netstat -s (reformatted )
IPv4 Statistics
Packets Received = 462764
Received Header Errors = 0
Received Address Errors = 11696
Datagrams Forwarded = 0
Unknown Protocols Received = 0
Received Packets Discarded = 20472
Received Packets Delivered = 451658
Output Requests = 204465
Routing Discards = 0
Discarded Output Packets = 81
Output Packet No Route = 23
Reassembly Required = 0
Reassembly Successful = 0
Reassembly Failures = 0
Datagrams Successfully Fragmented = 0
Datagrams Failing Fragmentation = 0
Fragments Created = 0
IPv6
names ommitted for breviety
= 16496
= 0
= 0
= 0
= 0
= 5114
= 16389
= 18100
= 0
= 0
= 10
= 174
= 87
= 0
= 0
= 0
= 0
ICMPv4
Received Sent
Messages 136 1276
Errors 0 0
Destination Unreachable 118 1259
Time Exceeded 0 0
Parameter Problems 0 0
Source Quenches 0 0
Redirects 0 0
Echo Replies 3 14
Echos 15 3
Timestamps 0 0
Timestamp Replies 0 0
Address Masks 0 0
Address Mask Replies 0 0
Router Solicitations 0 0
Router Advertisements 0 0
ICMPv6 Statistics
Received Sent
Messages 24 20
Errors 0 0
Destination Unreachable 0 0
Packet Too Big 0 0
Time Exceeded 0 0
Parameter Problems 0 0
Echos 0 0
Echo Replies 0 0
MLD Queries 0 0
MLD Reports 0 0
MLD Dones 0 0
Router Solicitations 0 16
Router Advertisements 9 0
Neighbor Solicitations 1 3
Neighbor Advertisements 14 1
Redirects 0 0
Router Renumberings 0 0
TCP Statistics for IPv4
Active Opens = 7613
Passive Opens = 482
Failed Connection Attempts = 181
Reset Connections = 322
Current Connections = 13
Segments Received = 413240
Segments Sent = 314623
Segments Retransmitted = 12568
IPv6
= 17
= 18
= 0
= 2
= 2
= 4091
= 2701
= 1389
UDP Statistics for IPv4
Datagrams Received = 102677
No Ports = 20464
Receive Errors = 5
Datagrams Sent = 27028
IPv6
= 4685
= 5114
= 0
= 10560
| | | | | | | |
|