


NETSTAT(8)	    Linux Programmer's Manual	       NETSTAT(8)


NAME

       netstat	-  Display  network  connections, routing tables,
       interface statistics, masquerade connections, netlink mes
       sages, and multicast memberships
	   netstat - ʾӣѡ·ӿ״̬αװӣ
	   ·Ϣ鲥Ա顣

SYNOPSIS

       netstat	 [-venaoc]   [--tcp|-t]	  [--udp|-u]   [--raw|-w]
       [--groups|-g] [--unix|-x] [--inet|--ip]	[--ax25]  [--ipx]
       [--netrom]

	   netstat	 [-veenc]  [--inet]  [--ipx]  [--netrom]  [--ddp]
       [--ax25] {--route|-r}

       netstat [-veenpac] {--interfaces|-i} [iface]

       netstat [-enc] {--masquerade|-M}

       netstat [-cn] {--netlink|-N}

       netstat {-V|--version} {-h|--help}

DESCRIPTION

       Netstat displays information of the Linux networking  sub
       system.
	   netstatʾLinuxϵͳϢ

   (no option)
   ѡʱ
       You  can view the status of network connections by listing
       the open sockets. This is the default  operation:  If  you
       don't  specify any address families, then the active sock
       ets of all configured address families  will  be	 printed.
       With  -e	 you  get  some additional informations (userid).
       With the -v switch you can  make	 netstat  complain  about
       known address families which are not supported by the ker
       nel. The -o option displays some additional information on
       networking  timers. Enabling the -p will show you the pro
       cess PID and name of the program holding the  socket.   -a
       print all sockets, including the listening server sockets.
       The address family inet will  display  raw,  udp	 and  tcp
       sockets.
	   ͨ򿪵׽ʾӵ״̬ȱʡǣ
	   ָκεַ壬ôӡõַЧ
	   ׽֡-eԻһЩϢ(uid)-vʾ
	   δֵַ֧֪Ϣ-oʾʱ
	   ĶϢ-pʾ׽ֵĽPIDͳ
	   -aԴӡȫ׽֣׽ַ֡inet
	   ʾԭʼUDPTCPص׽֡

   -r, --route
       With  the  -r,  --route option, you get the kernel routing
       tables in the same format as route -e  use.   netstat  -er
       will  use the output format of route.  Please see route(8)
       for details.
	   -r--routeѡԻroute -eͬʽں
	   ѡ·netstat -erѡĸʽϸڲμroute(8)

   -g, --groups
       With the -g, --groups option, IGMP multicast group member
       ship information for IPv4 and IPv6 is displayed.
	   -g--groupsѡʾIPv4  IPv6IGMP鲥Ա
	   Ϣ

   -i, --interface iface
       If you use the -i, --interfaces option, a table of all (or
       the  specified  iface)  networking  interfaces	will   be
       printed.	 The  output  uses the ifconfig -e format, and is
       described in ifconfig(8).  netstat -ei will print a  table
       or  a single interface entry just like ifconfig does. With
       the -a switch, you can include interfaces  which	 are  not
       configured (i.e. don't have the U=UP flag set).
	   -i--interfacesѡԴӡһӿ(ָ
	   iface)бϢʹifconfig -eͬĸʽ
	   ifconfig(8)бnetstat -eiԴӡifconfig
	   һݻ򵥸ӿĿ-aѡ԰δõĽӿ(
	   U=UP־)

   -M, --masquerade
       A  list	of  all	 masqueraded sessions can be viewed, too.
       With the -e switch you can include some more  informations
       about  sequenze	numbering  and	deltas,	 caused	 by  data
       rewrites on FTP sessions (PORT command).	 Masquerade  sup
       port  is	 used  to  hide	 hosts	with  unofficial  network
       addresses  from	the  outside  world,  as   described   in
       ipfw(4),ipfwadm(8) and ipfw(8).
	   ʾһоαװͨб-eѡ԰һЩ
	   ɻFTPԻд(˿)Ĺкź
	   Ϣαװ֧ڶڲʹ÷ʽַ
	   ipfw(4)ipfwadm(8)  ipfw(8)

   -N, --netlink
       Recent  kernels	have  a kernel/user communication support
       called netlink. You can get  messages  about  creation  or
       deletion of interfaces or routes from /dev/route (36,0).
	   ǰں֧һں/ûͨųΪ·Դ
	   /dev/route(36,0)ùڽӿڻ·ɾϢ

OPTIONS
ѡ
   -v, --verbose
       Tell  the  user	what  is going on by being verbose. Espe
       cially print some usefull informations about  unconfigured
       address families.
	   ϸģʽСرǴӡһЩδõַϢ

   -n, --numeric
       shows  numerical	 addresses instead of trying to determine
       symbolic host, port or user names.
	   ʾʽַȡ˿ڻû

   -p, --programs
       displays process name and PID of the owner of each  socket
       it dumps. You have to be the owner of such process to have
       all it's sockets matched to it or generally root user will
       see all the necessary information in place.
	   ʾÿ׽ֵPIDΪֽ
	   ʹÿ׽ֶƥ䵽һ
	   rootûԲ鿴бҪϢ

   -A, --af family
       use  a different method to set the address families.  fam
       ily is a comma (',') seperated list of address family key
       words like inet, unix, ipx, ax25, netrom and ddp.  This is
       has the same effect as  using  the  long	 options  --inet,
       --unix, --ipx, --ax25, --netrom and --ddp.
	   òͬķõַ塣ַһ(',')ڵַؼ
	   бзָinet, unix, ipx, ax25, netrom  ddp
	   ѡͬЧ--inet,--unix, --ipx, --ax25, --netrom 
	    --ddp

   -c, --continous
       This  will cause netstat to print the selected table every
       second continously on the screen until you interrupt it.
	   ѡʹnetstatĻÿӡѡıֱû
	   жϡ

OUTPUT
Ϣ
   Active Internet connections (TCP, UDP, RAW)
   ЧInternet(TCPUDPRAW)
   Proto
       The protocol (tcp, udp, raw) used by the socket.
	   ׽ʹõЭ(TCPUDPRAW)

   Recv-Q
       The count of bytes not copied by	 the  user  program  con
       nected to this socket.
	   ûӴ׽δֽ

   Send-Q
       The count of bytes not acknoledged by the remote host.
	   Զδȷϵֽ

   Local Address
       The  local address (local hostname) and port number of the
       socket. Unless the -n switch is given, the socket  address
       is resolved to its canonical hostname, and the port number
       is translated into the corresponding service name.
	   ׽ֵıصַ()Ͷ˿ںšǸ-nѡ
	   ׽ֵַ׼н˿ںתӦķ
	   

   Foreign Address
       The remote address (remote hostname) and port number of he
       socket.	As  with  the  local  address:port, the -n switch
       turns off hostname and service name resolution.
	   ׽ֵԶ̵ַ(Զ)Ͷ˿ںšñصַ:˿
	   ʽʱ-nѡرͷܡ

   State
       The state of the socket. Since there are no states in  RAW
       and  usually  no	 states used in UDP, this row may be left
       blank. Normally this can be one of several values:
	   ׽ֵ״̬ΪRAWЭû״̬UDPҲ״
	   ̬ϢԴաͨΪ¼ֵ֮һ

       ESTABLISHED
	      The socket has an established connection.
		  ׽һЧӡ

       SYN_SENT
	      The socket is actively attempting	 to  establish	a
	      connection.
		  ׽ŬԽһӡ

       SYN_RECV
	      A	 connection  request  has  been received from the
	      network.
		  յһ

       FIN_WAIT1
	      The socket is closed, and the connection	is  shut
	      ting down.
		  ׽ѹرգѶϿ

       FIN_WAIT2
	      Connection is closed, and the socket is waiting for
	      a shutdown from the remote end.
		  ѹرգ׽ֵȴԶ̷ֹ

       TIME_WAIT
	      The socket is waiting after close to handle packets
	      still in the network.
		  ׽ڹرմеȴ

       CLOSED 
	      The socket is not being used.
		  ׽δá

       CLOSE_WAIT
	      The  remote  end	has  shut  down,  waiting for the
	      socket to close.
		  Զ̷ѹرգȴ׽ֹرա

       LAST_ACK
	      The remote end shut down, and the socket is closed.
	      Waiting for acknowledgement.
		  Զ̷ֹ׽ѹرաȴȷϡ

       LISTEN 
	      The  socket  is listening for incoming connections.
	      Those sockets are only displayed if  the	-a,--lis
	      tening switch is set.
		  ׽ּӡ-a,--listeningѡ
		  ֻʾЩ׽֡

       CLOSING
	      Both  sockets are shut down but we still don't have
	      all our data sent.
		  ׽ֶѹرգδݷ

       UNKNOWN
	      The state of the socket is unknown.
		  ׽״̬δ֪

   User
       The name or the UID of the owner of the socket.
	   ׽ƻUID

   PID/Program name
       Slash-separated pair of the PID and process  name  of  the
       program	holding this socket. Option -p enables display of
       this column. You will also need	root  privileges  as  you
       have  to	 have  access rights to process to be able to see
       the program's sockets matched up to it.	This  identifica
       tion information is not yet available for IPX sockets.
	   б߷ָĴ׽ֳPIDżѡ-pʾ
	   Ŀ⻹ҪrootȨޣΪжԽ̵ķȨ
	   鿴׽ֵƥIPX׽ֻ޷ôϢ

   Timer
       (this needs to be written)
	   

   Active UNIX domain Sockets
   ЧUNIX׽
   Proto
       The protocol (usually unix) used by the socket.
	   ׽õЭ(unix)

   RefCnt
       The  reference  count  (i.e.  attached  processes via this
       socket).
	   ʹ(ͨ׽Ľ)

   Flags
       The flags displayed is  SO_ACCEPTON  (displayed	as  ACC),
       SO_WAITDATA  (W)	 or SO_NOSPACE (N).  SO_ACCECPTON is used
       on unconnected sockets if  their	 corresponding	processes
       are waiting for a connect request. The other flags are not
       of normal interest.
	   ʾı־ΪSO_ACCEPTON(ʾΪACC)SO_WAITDATA(W)
       SO_NOSPACE(N)ӦĽ̵ȴһô
	   SO_ACCECPTONδӵ׽֡־ͨҪ

   Type
       There are several types of socket access:
	   ׽ʹõһЩͣ

       SOCK_DGRAM
	      The socket is  used  in  Datagram	 (connectionless)
	      mode.
		  ׽ݱ()ģʽ

       SOCK_STREAM
	      This is a stream (connection) socket.
		  ģʽ()׽

       SOCK_RAW
	      The socket is used as a raw socket.
		  ׽RAWģʽ

       SOCK_RDM
	      This one serves reliably-delivered messages.
		  һַɿԴϢ

       SOCK_SEQPACKET
	      This is a sequential packet socket.
		  ׽֡

       SOCK_PACKET
	      RAW interface access socket.
		  RAWӿʹ׽֡

       UNKNOWN
	      Who  ever	 knows,	 what  the future will bring us -
	      just fill in here :-)
		  ˽ṩд

   State
       This field will contain one of the following Keywords:
	   ֶΰ¹ؼ֮һ

       FREE   
	      The socket is not allocated
		  ׽δ䡣

       LISTENING
	      The socket is listening for a  connection	 request.
	      Those  sockets  are only displayed if the -a,--lis
	      tening switch is set.
		  ׽ּһ-a,--listeningѡ
		  ֻʾЩ׽֡

       CONNECTING
	      The socket is about to establish a connection.
		  ڽӵ׽֡

       CONNECTED
	      The socket is connected.
		  ׽ӡ

       DISCONNECTING
	      The socket is disconnecting.
		  ׽ѶϿ

       (empty)
	      The socket is not connected to another one.
		  ׽δ

       UNKNOWN
	      This state should never happen.
		  ״̬δ֡

   PID/Program name
       PID and process name of the program holding  this  socket.
       More info available in Active Internet connections section
       written above.
	   ׽ֵĳPIDдЧInternet
	   ĲиϸϢ

   Path
       This displays the path name  as	which  the  corresponding
       processes attached to the socket.
	   Ӧ׽ʱʾ·

   Active IPX sockets
       (this needs to be done by somebody who knows it)
	   (˲Ҫ˽)

   Active NET/ROM sockets
       (this needs to be done by somebody who knows it)
	   (˲Ҫ˽)

   Active AX.25 sockets
       (this needs to be done by somebody who knows it)
	   (˲Ҫ˽)

NOTES
ע
       Since  kernel  release  2.2  netstat  -i	 does not display
       interface statistics for alias interfaces anymore. To  get
       per  alias  interface  counters you need to setup explicit
       rules using the ipchains(8) command.
	   ںrelease  2.2ʼnetstat  -iʾӿڵͳ
	   ϢҪÿӿڵļҪipchains(8)
	   ӦĹ

FILES
ļ
       /etc/services -- The services translation file
	   ļ

       /proc/net/dev -- devices information
	   豸Ϣ

       /proc/net/raw -- RAW socket information
	   RAW׽Ϣ

       /proc/net/tcp -- TCP socket information
	   TCP׽Ϣ

       /proc/net/udp -- UDP socket information
	   UDP׽Ϣ

       /proc/net/igmp -- IGMP multicast information
	   IGMP鲥Ϣ

       /proc/net/unix -- Unix domain socket information
	   Unix׽Ϣ

       /proc/net/ipx -- IPX socket information
	   IPX׽Ϣ

       /proc/net/ax25 -- AX25 socket information
	   AX25׽Ϣ

       /proc/net/appletalk -- DDP (appletalk) socket information
	   DDP(appletalk)׽Ϣ

       /proc/net/nr -- NET/ROM socket information
	   NET/ROM׽Ϣ

       /proc/net/route -- Kernel IP routing information
	   ںIPѡ·Ϣ

       /proc/net/ax25_route -- Kernel AX25 routing information
	   ںAX25ѡ·Ϣ

       /proc/net/ipx_route -- Kernel IPX routing information
	   ںIPXѡ·Ϣ

       /proc/net/nr_nodes -- Kernel NET/ROM nodelist
	   ںNET/ROMڵ

       /proc/net/nr_neigh -- Kernel NET/ROM neighbours
	   ںNET/ROMվ

       /proc/net/ip_masquerade -- Kernel masqueraded connections
	   ںαװ

SEE ALSO

       route(8),  ifconfig(8),	 ipfw(4),   ipfw(8),   ipfwadm(8)
       ipchains(8)

BUGS

       Occasionally  strange  information  may appear if a socket
       changes as it is viewed. This is unlikely to occur.
       The netstat -i options is  described  as	 it  should  work
       after  some  code  cleanup of the BETA release of the net-
       tools package.
	   ʾ׽ָĿܻżֹϢδᷢ
	   BETA繤һЩnetstat -iѡ
	   

AUTHORS

       The netstat user interface was written by Fred  Baumgarten
       <dc6iq@insu1.etec.uni-karlsruhe.de> the man page basically
       by Matt Welsh <mdw@tc.cornell.edu>. It was updated by Alan
       Cox  <Alan.Cox@linux.org>  but  could  do  with a bit more
       work.  It was updated again by  Tuan  Hoang  <tqhoang@big
       foot.com>.
	   Fred  Baumgarten<dc6iq@insu1.etec.uni-karlsruhe.de>
	   netstatûӿڣMatt Welsh <mdw@tc.cornell.edu>
	   ֲҳ¹Alan Cox <Alan.Cox@linux.org>ɡ
	   Tuan  Hoang <tqhoang@bigfoot.com>˸¡

       The  man	 page  and  the command included in the net-tools
       package	is  totally  rewritten	 from	Bernd	Eckenfels
       <ecki@linux.de>.
	   Bernd	Eckenfels <ecki@linux.de>׫дֲҳ繤
	   

[İά] meaculpa email:meaculpa@21cn.com
[İ¸] 2000/12/08
MAN-PAGEƻ:http://www.cmpp.net/