netstat
BSD Darwin ; microsoft
Display the contents of network data structures.
Continuously display the information regarding packet traffic on the configured network interfaces.
netstat -i | -I interface [-w seconds][-abdgt]
Display a list of active sockets .
netstat [-AaLlnW] [
-f address_family |
-p protocol]
-I interface]
[-w seconds] [-abdgt]
Present the contents of a network data structures .
netstat [-gilns] [-f address_family]
Statistics for a protocol or address family.
netstat -s [-s] [-f address_family| -p protocol] [-w seconds]
per-interface statistics
netstat -i | -I interface -s [-f address_family| -p
routing,
routing table
netstat -r [-Aaln] [-f address_family]
routing stats
netstat -rs [-s]
mbuf stats
netstat -m [-m]
Without options displays:
-w seconds |
netstat
-m [-m]
> netstat -m 1680/1737 mbufs in use: 622 mbufs allocated to data 1056 mbufs allocated to packet tags 2 mbufs allocated to Appletalk data blocks 57 mbufs allocated to caches 841/ 952 mbuf 2KB clusters in use 0/16 mbuf 4KB clusters in use 1968 KB allocated to network (83.3% in use) 0 requests for memory denied 0 requests for memory delayed 0 calls to drain routines |
netstat -r [-Aaln] [-f address_family]
> netstat -r Routing tables Internet: Destination Gateway Flags Refs Use Netif Expire default Wireless_Broadband UGSc 25 41 en1 127 localhost UCS 0 0 lo0 localhost localhost UH 1 100 lo0 169.254 link#6 UCS 0 0 en1 dynamically allocated 192.168.1 link#6 UCS 13 0 en1 Wireless_Broadband 0:1f:90:2d:33:ab UHLW 4 17 en1 1186 smacker.GERMANS localhost UHS 0 0 lo0 192.168.1.255 ff:ff:ff:ff:ff:ff UHLWb 1 1 en1 Internet6: Destination Gateway Flags Netif Expire localhost link#1 UHL lo0 fe80::%lo0 localhost Uc lo0 localhost link#1 UHL lo0 fe80::%en1 link#6 UC en1 smacker.local 0:19:e3:32:f:8c UHL lo0 ff01:: localhost U lo0 ff02:: localhost UC lo0 ff02:: link#6 UC en1 |
netstat
-rs [-s]
> netstat -rs routing: 0 bad routing redirects 0 dynamically created routes 0 new gateways due to redirects 33 destinations found unreachable 0 uses of a wildcard route 16 routes not in table but not freed |
-a | show protocol-cloned routes. |
-s | show routing statistics instead. |
-l | netstat assumes more columns are there and the maximum transmission unit (mtu ) are also displayed.
|
netstat [-gilns] [-f address_family]
-g |
shows the local and remote addresses, send and receive queue sizes (in bytes), protocol, and the internal state of the protocol.
Address are of the form host.port
or network.port
if a socket's address specifies a network but no specific host address.
Host and network addresses are displayed symbolically according to the /etc/hosts
and /etc/networks
.
If a symbolic name for an address is unknown, or if the -n
is specified, the address is printed numerically, according to the address family. dot format
, refer to inet).
Unspecified, or wildcard, addresses and ports appear as *
.
netstat -f inet Active Internet connections Proto Recv-Q Send-Q Local Address Foreign Address (state) tcp4 0 0 smacker.GERMANS.51555 slammer.GERMANS.netbio ESTABLISHED tcp4 0 0 smacker.GERMANS.50325 esc170.midphase..ssh ESTABLISHED tcp4 0 0 smacker.GERMANS.50303 esc170.midphase..ftp CLOSE_WAIT tcp4 0 0 smacker.GERMANS.49613 esc170.midphase..ftp CLOSE_WAIT udp4 0 0 smacker.GERMANS.netbio *.* udp4 0 0 smacker.GERMANS.netbio *.* udp4 0 0 *.netbios-dgm *.* udp4 0 0 *.netbios-ns *.* udp4 0 0 smacker.GERMANS.kerber *.* udp4 0 0 *.55227 *.* … udp4 0 0 *.52859 *.* udp4 0 0 smacker.GERMANS.ntp *.* udp4 0 0 localhost.ntp *.* udp4 0 0 *.ntp *.* udp4 0 0 *.* *.* udp4 0 0 *.mdns *.* udp4 0 0 *.* *.* |
CLOSED |
mtu
) are also displayed.
The routing table display indicates the available routes and their status. Each route consists of a destination host or network and a gateway to use in forwarding packets. The flags field shows a collection of information about the route stored as binary choices. The individual flags are discussed in more detail in the route(8) and route(4) manual pages. The mapping between letters and flags is:
1 |
Direct routes are created for each interface attached to the local host; the gateway field for such entries shows the address of the outgoing interface.
The refcnt field gives the current number of active uses of the route. Connection oriented protocols normally hold on to a single route for the duration of a connection while connection less protocols obtain a route while sending to the same destination.
The use field provides a count of the number of packets sent using that route.
The interface entry indicates the network interface utilized for the route.
When netstat
is invoked with -w wait
a running count of statistics related to network interfaces or protocols.
By default, this display summarizes information for all interfaces.
Information for a specific interface may be displayed with -I
.
> netstat -A Active Internet connections Proto Recv-Q Send-Q Local Address Foreign Address (state) udp4 0 0 smacker.GERMANS.netbio *.* udp4 0 0 smacker.GERMANS.netbio *.* udp4 0 0 smacker.GERMANS.ntp *.* udp4 0 0 smacker.GERMANS.kerber *.* udp6 0 0 smacker.local.kerberos *.* udp6 0 0 localhost.kerberos *.* udp4 0 0 *.61492 *.* udp4 0 0 *.61420 *.* udp4 0 0 *.52348 *.* udp4 0 0 *.57114 *.* udp4 0 0 *.53745 *.* udp4 0 0 *.60167 *.* udp4 0 0 *.52932 *.* udp4 0 0 *.49719 *.* udp4 0 0 *.52426 *.* udp4 0 0 *.60775 *.* udp4 0 0 *.54721 *.* udp4 0 0 *.netbios-dgm *.* udp4 0 0 *.netbios-ns *.* udp4 0 0 *.* *.* udp6 0 0 smacker.local.ntp *.* udp6 0 0 localhost.ntp *.* udp4 0 0 localhost.ntp *.* udp6 0 0 localhost.ntp *.* udp6 0 0 *.ntp *.* udp4 0 0 *.ntp *.* udp6 0 0 *.mdns *.* udp4 0 0 *.mdns *.* udp4 0 0 *.* *.* icm6 0 0 *.* *.* Active LOCAL (UNIX) domain sockets Address Type Recv-Q Send-Q Inode Conn Refs Nextref Addr 2bce088 stream 0 0 0 55ded48 0 0 55ded48 stream 0 0 0 2bce088 0 0 2ca3440 stream 0 0 0 2bcea18 0 0 /var/run/asl_input 2bcea18 stream 0 0 0 2ca3440 0 0 2ca3770 stream 0 0 0 2bceb28 0 0 /var/run/asl_input 2bceb28 stream 0 0 0 2ca3770 0 0 … many simular entries ommited … 2ca3330 stream 0 0 0 2cbd660 0 0 2cbd660 stream 0 0 0 2ca3330 0 0 Address Type Recv-Q Send-Q Inode Conn Refs Nextref Addr 2cbd3b8 stream 0 0 31c9680 0 0 0 /tmp/launch-BPZQcK/:0 2cbd770 stream 0 0 31c97a0 0 0 0 /tmp/launch-M1pYIi/Listeners 2cbd990 stream 0 0 31c98c0 0 0 0 /tmp/launch-HmDrRD/Render 2cbd6e8 stream 0 0 31c99e0 0 0 0 /private/tmp/com.hp.launchport 26babb0 stream 0 0 31c9cb0 0 0 0 /tmp/launchd-106.s5jA82/sock Address Type Recv-Q Send-Q Inode Conn Refs Nextref Addr 2ca3e58 stream 0 0 0 2cbd4c8 0 0 2cbd4c8 stream 0 0 0 2ca3e58 0 0 2cbdb28 stream 0 0 0 2cbd2a8 0 0 2cbd2a8 stream 0 0 0 2cbdb28 0 0 2ca37f8 stream 0 0 0 2cbd908 0 0 /var/run/mDNSResponder 2cbd908 stream 0 0 0 2ca37f8 0 0 … many simular entries ommited … 2bcef68 stream 0 0 2bbe6c0 0 0 0 /var/run/pppconfd 26bac38 stream 0 0 27a2ac0 0 0 0 /var/tmp/launchd/sock 26bacc0 stream 0 0 27a2be0 0 0 0 /private/var/run/cupsd 26bad48 stream 0 0 27a2d00 0 0 0 /var/run/usbmuxd 26bae58 stream 0 0 27a2e20 0 0 0 /var/run/asl_input 26baf68 stream 0 0 27a2eb0 0 0 0 /var/run/portmap.socket 26baee0 stream 0 0 27a2f40 0 0 0 /var/run/mDNSResponder Address Type Recv-Q Send-Q Inode Conn Refs Nextref Addr 55deee0 dgram 0 0 0 2cbd110 2cbd110 0 2cbd110 dgram 0 0 0 55deee0 55deee0 0 2ca3f68 dgram 0 0 0 2bce000 2bce000 0 2bce000 dgram 0 0 0 2ca3f68 2ca3f68 0 … many simular entries ommited … 2bce990 dgram 0 0 0 26badd0 0 2bce6e8 2bce6e8 dgram 0 0 0 26badd0 0 2ca3908 2ca3908 dgram 0 0 0 26badd0 0 2ca3ee0 2ca3b28 dgram 0 0 0 2ca33b8 2ca33b8 0 2ca33b8 dgram 0 0 0 2ca3b28 2ca3b28 0 2cbd198 dgram 0 0 0 2ca3198 2ca3198 0 2ca3198 dgram 0 0 0 2cbd198 2cbd198 0 2ca3ee0 dgram 0 0 0 26badd0 0 2ca34c8 2ca34c8 dgram 0 0 0 26badd0 0 2cbd440 2cbd440 dgram 0 0 0 26badd0 0 2bce660 2cbd330 dgram 0 0 0 2cbd220 2cbd220 0 2cbd220 dgram 0 0 0 2cbd330 2cbd330 0 2bce660 dgram 0 0 0 26badd0 0 26ba3b8 26ba2a8 dgram 0 0 0 26ba220 26ba220 0 26ba220 dgram 0 0 0 26ba2a8 26ba2a8 0 26ba3b8 dgram 0 0 0 26badd0 0 26ba660 26ba660 dgram 0 0 0 26badd0 0 26ba7f8 26ba7f8 dgram 0 0 0 26badd0 0 0 26badd0 dgram 0 0 27a2d90 0 2bce990 0 /var/run/syslog |
June 15, 2001 Darwin
-a |
netstat -e Interface Statistics Received Sent Bytes 966629805 107094276 Unicast packets 827616 496033 Non-unicast packets 344958 100182 Discards 0 0 Errors 0 0 Unknown protocols 0 netstat -a -b Without -b does not provide name of executable The requested operation requires elevation.† netstat -a -b Active Connections † Proto Local Address Foreign Address State TCP 0.0.0.0:21 kitchen:0 LISTENING [FileZilla Server.exe] TCP 0.0.0.0:135 kitchen:0 LISTENING RpcSs [svchost.exe] TCP 0.0.0.0:445 kitchen:0 LISTENING Can not obtain ownership information TCP 0.0.0.0:2869 kitchen:0 LISTENING Can not obtain ownership information TCP 0.0.0.0:5357 kitchen:0 LISTENING Can not obtain ownership information TCP 0.0.0.0:49152 kitchen:0 LISTENING [wininit.exe] TCP 0.0.0.0:49153 kitchen:0 LISTENING eventlog [svchost.exe] TCP 0.0.0.0:49154 kitchen:0 LISTENING Schedule [svchost.exe] TCP 0.0.0.0:49156 kitchen:0 LISTENING [lsass.exe] TCP 0.0.0.0:49157 kitchen:0 LISTENING [services.exe] TCP 0.0.0.0:49158 kitchen:0 LISTENING [spoolsv.exe] TCP 127.0.0.1:2559 kitchen:0 LISTENING [daemonu.exe] TCP 127.0.0.1:5354 kitchen:0 LISTENING [mDNSResponder.exe] TCP 127.0.0.1:5354 kitchen:49155 ESTABLISHED [mDNSResponder.exe] TCP 127.0.0.1:14147 kitchen:0 LISTENING [FileZilla Server.exe] TCP 127.0.0.1:27015 kitchen:0 LISTENING [AppleMobileDeviceService.exe] TCP 127.0.0.1:27015 kitchen:49190 ESTABLISHED [AppleMobileDeviceService.exe] TCP 127.0.0.1:49155 kitchen:5354 ESTABLISHED [AppleMobileDeviceService.exe] TCP 127.0.0.1:49190 kitchen:27015 ESTABLISHED [iTunesHelper.exe] TCP 127.0.0.1:56761 kitchen:56762 ESTABLISHED [firefox.exe] TCP 127.0.0.1:56762 kitchen:56761 ESTABLISHED [firefox.exe] TCP 127.0.0.1:56763 kitchen:56764 ESTABLISHED [firefox.exe] TCP 127.0.0.1:56764 kitchen:56763 ESTABLISHED [firefox.exe] TCP 127.0.0.1:59243 kitchen:0 LISTENING [KhalScroll.exe] TCP 192.168.1.5:139 kitchen:0 LISTENING Can not obtain ownership information TCP 192.168.1.5:4242 kitchen:0 LISTENING [SATARaid5ConfigService.exe] TCP 192.168.1.5:4242 kitchen:56746 ESTABLISHED [SATARaid5ConfigService.exe] TCP 192.168.1.5:56285 63.118.252.8:http CLOSE_WAIT [OUTLOOK.EXE] TCP 192.168.1.5:56286 63.118.252.8:http CLOSE_WAIT [OUTLOOK.EXE] TCP 192.168.1.5:56746 kitchen:4242 ESTABLISHED [javaw.exe] TCP 192.168.1.5:56774 real-world-systems:ssh ESTABLISHED [putty.exe] TCP 192.168.1.5:56791 real-world-systems:http TIME_WAIT TCP 192.168.1.5:56792 real-world-systems:http TIME_WAIT TCP 192.168.1.5:56793 real-world-systems:http TIME_WAIT TCP 192.168.1.5:56797 real-world-systems:http TIME_WAIT TCP 192.168.1.5:56798 real-world-systems:http TIME_WAIT TCP 192.168.1.5:56799 real-world-systems:http TIME_WAIT TCP [::]:21 kitchen:0 LISTENING [FileZilla Server.exe] TCP [::]:135 kitchen:0 LISTENING RpcSs [svchost.exe] TCP [::]:445 kitchen:0 LISTENING Can not obtain ownership information TCP [::]:2869 kitchen:0 LISTENING Can not obtain ownership information TCP [::]:5357 kitchen:0 LISTENING Can not obtain ownership information TCP [::]:49152 kitchen:0 LISTENING [wininit.exe] TCP [::]:49153 kitchen:0 LISTENING eventlog [svchost.exe] TCP [::]:49154 kitchen:0 LISTENING Schedule [svchost.exe] TCP [::]:49156 kitchen:0 LISTENING [lsass.exe] TCP [::]:49157 kitchen:0 LISTENING [services.exe] TCP [::]:49158 kitchen:0 LISTENING [spoolsv.exe] TCP [::1]:14147 kitchen:0 LISTENING [FileZilla Server.exe] TCP [fe80::9027:a9c8:8ff3:cb1d%15]:445 kitchen:49309 ESTABLISHED Can not obtain ownership information TCP [fe80::9027:a9c8:8ff3:cb1d%15]:49309 kitchen:microsoft-ds ESTABLISHED Can not obtain ownership information UDP 0.0.0.0:500 *:* IKEEXT [svchost.exe] UDP 0.0.0.0:3702 *:* EventSystem [svchost.exe] UDP 0.0.0.0:3702 *:* FDResPub [svchost.exe] UDP 0.0.0.0:3702 *:* FDResPub [svchost.exe] UDP 0.0.0.0:3702 *:* EventSystem [svchost.exe] UDP 0.0.0.0:4500 *:* IKEEXT [svchost.exe] UDP 0.0.0.0:5355 *:* Dnscache [svchost.exe] UDP 0.0.0.0:57937 *:* [mDNSResponder.exe] UDP 0.0.0.0:58829 *:* EventSystem [svchost.exe] UDP 0.0.0.0:59858 *:* FDResPub [svchost.exe] UDP 127.0.0.1:1900 *:* SSDPSRV [svchost.exe] UDP 127.0.0.1:48000 *:* [daemonu.exe] UDP 127.0.0.1:54674 *:* SSDPSRV [svchost.exe] UDP 127.0.0.1:57289 *:* [OUTLOOK.EXE] UDP 127.0.0.1:57939 *:* [AppleMobileDeviceService.exe] UDP 127.0.0.1:57940 *:* [AppleMobileDeviceService.exe] UDP 127.0.0.1:60976 *:* [iTunesHelper.exe] UDP 127.0.0.1:60977 *:* [iTunesHelper.exe] UDP 192.168.1.5:137 *:* Can not obtain ownership information UDP 192.168.1.5:138 *:* Can not obtain ownership information UDP 192.168.1.5:1900 *:* SSDPSRV [svchost.exe] UDP 192.168.1.5:5353 *:* [mDNSResponder.exe] UDP 192.168.1.5:54673 *:* SSDPSRV [svchost.exe] UDP [::]:500 *:* IKEEXT [svchost.exe] UDP [::]:3702 *:* EventSystem [svchost.exe] UDP [::]:3702 *:* FDResPub [svchost.exe] UDP [::]:3702 *:* EventSystem [svchost.exe] UDP [::]:3702 *:* FDResPub [svchost.exe] UDP [::]:4500 *:* IKEEXT [svchost.exe] UDP [::]:5355 *:* Dnscache [svchost.exe] UDP [::]:57938 *:* [mDNSResponder.exe] UDP [::]:58830 *:* EventSystem [svchost.exe] UDP [::]:59859 *:* FDResPub [svchost.exe] UDP [::1]:1900 *:* SSDPSRV [svchost.exe] UDP [::1]:5353 *:* [mDNSResponder.exe] UDP [::1]:54672 *:* SSDPSRV [svchost.exe] UDP [fe80::9027:a9c8:8ff3:cb1d%15]:1900 *:* SSDPSRV [svchost.exe] UDP [fe80::9027:a9c8:8ff3:cb1d%15]:54671 *:* SSDPSRV [svchost.exe] netstat -s (reformatted )
IPv4 Statistics Packets Received = 462764 Received Header Errors = 0 Received Address Errors = 11696 Datagrams Forwarded = 0 Unknown Protocols Received = 0 Received Packets Discarded = 20472 Received Packets Delivered = 451658 Output Requests = 204465 Routing Discards = 0 Discarded Output Packets = 81 Output Packet No Route = 23 Reassembly Required = 0 Reassembly Successful = 0 Reassembly Failures = 0 Datagrams Successfully Fragmented = 0 Datagrams Failing Fragmentation = 0 Fragments Created = 0 |