Overview SYNOPSIS
netstat [address_family_options] [--tcp|-t] [--udp|-u] [--raw|-w] [--listening|-l] [--all|-a] [--numeric|-n] [--numeric-hosts][--numeric-ports][--numeric-ports] [--symbolic|-N] [--extend|-e[--extend|-e]] [--timers|-o] [--program|-p] [--verbose|-v] [--continuous|-c] [delay] netstat {--route|-r} [address_family_options] [--extend|-e[--extend|-e]] [--verbose|-v] [--numeric|-n] [--numeric-hosts][--numeric-ports][--numeric-ports] [--continuous|-c] [delay] netstat {--interfaces|-i} [iface] [--all|-a] [--extend|-e[--extend|-e]] [--verbose|-v] [--program|-p] [--numeric|-n] [--numeric-hosts][--numeric-ports][--numeric-ports] [--continuous|-c] [delay] netstat {--groups|-g} [--numeric|-n] [--numeric-hosts][--numeric-ports][--numeric-ports] [--continuous|-c] [delay] netstat {--masquerade|-M} [--extend|-e] [--numeric|-n] [--numeric-hosts][--numeric-ports][--numeric-ports] [--continuous|-c] [delay] netstat {--statistics|-s} [--tcp|-t] [--udp|-u] [--raw|-w] [delay] netstat {--version|-V} netstat {--help|-h} address_family_options:
[--protocol={inet,unix,ipx,ax25,netrom,ddp}[,...]] [--unix|-x] [--inet|--ip] [--ax25] [--ipx] [--netrom] [--ddp]
Description DESCRIPTION
Netstat displays information of the Linux networking subsystem. Type of information is controlled by the output of the first parameter, like this:
(none)
When no option, netstat displays open sockets. If you do not specify any address families, then print out the effective sockets of all configured address families.
--route , -r
Display the kernel routing table.
--groups , -g
Display the IGMP multicast group membership information for IPv4 and IPv6.
--interface=iface , -i
Display a list of all network interfaces, or the specified iface .
--masquerade , -M
It displays a list of all camouflaged session.
--statistics , -s
Display statistics for each protocol.
Options OPTIONS
--verbose , -v
Verbose mode. In particular, print some useful information about unconfigured address families.
--numeric , -n
Display in digital form rather than resolve the host address, port or user names.
--numeric-hosts
Show host in digital form but does not affect the resolution of port or user names.
--numeric-ports
Digital display port number, but it does not affect the resolution of host or user names.
--numeric-users
Digital display of a user ID, but it does not affect resolve the host name and port.
--protocol=family , -A
Specifies which address family (perhaps better described in the underlying protocol) to be displayed. family in a comma-separated list of group addresses, such as inet , UNIX , IPX , for ax25 , NetRom , and DDP . And such use --inet , --unix ( -x ), --ipx , --ax25 , --netrom , and --ddp same effect options. Address family inet includes raw, udp and tcp protocol sockets.
-c, --continuous
Will netstat continuously outputs the selected information every second.
-e, --extend
Display additional information. Use this option twice to get all the details.
-o, --timers
It contains information related to the network timer.
-p, --program
The PID and process name of each socket belongs.
-l, --listening
Show only listening socket (this is the default option)
-a, --all
Display all is or is not listening socket. Plus --interfaces option will display unmarked interface.
-F
Display the routing information in the FIB. (This is the default option)
-C
Display the routing information in the routing cache.
delay
The cyclic output netstat statistics every delay seconds.
Output OUTPUT
Internet network connection is active (TCP, UDP, raw)
Proto
Socket protocol used.
Recv-Q
The number of bytes of user program connected to this socket is not copied.
Send-Q
The number of the remote host unacknowledged bytes.
Local Address
Socket local address (local hostname) and port number. Unless given -n --numeric ( -n ) option, or the socket address is resolved as fully qualified host name (FQDN), and port number is converted to the appropriate service name.
Foreign Address
Socket remote address (remote hostname) and port number. Analogous to "Local Address."
State
State of the socket. Because there is no state in the RAW protocol, and UDP do not have status information, so this line blank. Usually it is one of the following values:
- ESTABLISHED
- Socket has an active connection.
- SYN_SENT
- Socket try to establish a connection.
- SYN_RECV
- A connection request is received from the network.
- FIN_WAIT1
- Socket is closed, the connection is disconnected.
- FIN_WAIT2
- Connection has been closed, the socket for the remote party aborted.
- TIME_WAIT
- After closing, the socket is still waiting for a packet in the network processing
- CLOSED
- The socket is not available.
- CLOSE_WAIT
- The remote party has closed, waiting for the socket to close.
- LAST_ACK
- Suspend remote party, the socket is closed. Waiting for confirmation.
- LISTEN
- Socket to listen for incoming connections. If not set --listening ( -l ) or --all ( -a ) option, these connections are not shown.
- CLOSING
- Sockets are closed, and all the data has not been sent.
- UNKNOWN
- Socket status is unknown.
User
Socket owner's name or UID.
PID/Program name
With PID and process name separated by a slash socket processing program. --program so that this section be displayed. You need superuser permissions to view information about the sockets is not your own. IPX socket on this information is not yet available.
Timer
(this needs to be written)
UNIX domain sockets activities
Proto
Socket protocol used (usually unix).
RefCnt
Use the number (that is, through the process of this socket connection number).
Flags
Label indicates SO_ACCEPTON (shown as the ACC ), SO_WAITDATA ( W is ) or SO_NOSPACE ( N ). If the corresponding process waits for a connection request, then the Socket SO_ACCECPTON for unconnected. Other signs are usually not important
Type
Some types of sockets used:
- SOCK_DGRAM
- The socket for the datagram (connectionless) mode.
- SOCK_STREAM
- Stream mode (connected to) the socket
- SOCK_RAW
- The socket for RAW mode.
- SOCK_RDM
- The reliability of a service delivery information.
- SOCK_SEQPACKET
- Continuous Packet socket.
- SOCK_PACKET
- RAW socket interface.
- UNKNOWN
- Who knows if in the future it will tell us, just fill in here :-)
State
This field contains one of the following keywords:
- FREE
- The socket is not allocated.
- LISTENING
- Socket is listening for a connection request. Unless set --listening ( the -l ) or --all ( -a ) option, otherwise it is not displayed.
- CONNECTING
- Socket is about to establish a connection.
- CONNECTED
- Socket is already connected.
- DISCONNECTING
- Socket has been disconnected.
- (empty)
- The socket is not connected.
- UNKNOWN
- ! It should not occur in this state.
PID/Program name
This process socket process name and PID. Section above on the activities of Internet connections have more detailed information.
Path
It displays the path name when the corresponding process connected to the socket.
IPX socket activities
(this needs to be done by somebody who knows it)
Active NET/ROM sockets
(this needs to be done by somebody who knows it)
Active AX.25 sockets
(this needs to be done by somebody who knows it)
Note NOTES
From linux 2.2 kernel start netstat -i no longer displays statistics for alias interfaces. For each alias interface counters, you need to use ipchains (8) command.
FILES file
/ etc / Services - Services interpret the file
/ proc - proc file system mount point. proc file system kernel state information is given by the following documents.
/ proc / NET / dev - device information
/ proc / NET / RAW - RAW socket information
/ proc / NET / tcp - TCP socket information
/ proc / NET / udp - UDP socket information
/ proc / NET / igmp - IGMP multicast information
/ proc / NET / UNIX - Unix domain socket information
/ proc / NET / IPX - IPX socket information
/ proc / NET / ax25 - AX25 socket information
/ proc / NET / AppleTalk - DDP (AppleTalk) socket information
/ proc / NET / NR - the NET / a ROM socket information
/ proc / NET / route - IP routing information
/ proc / NET / ax25_route - AX25 routing information
/ proc / NET / ipx_route - IPX routing information
/ proc / NET / nr_nodes - the NET / ROM node list
/ proc / NET / nr_neigh - the NET / a ROM neighbors
/ proc / NET / ip_masquerade - Camouflage connection
/ proc / NET / snmp - statistics