How to use netstat : A Unix networking command

This command displays the different data structure contents linked to the station network configuration. Here we will only talk about two ways to use netstat, but there are many other information that we can get (sockets status, routing table, multicast ).

Network interface statistics: Use the option -I (interface), and specifythe interface name to observe (em0 for instance), and the option -w 1 to display a report every second. If you do not specify this last option, netstat will only give one report in a different style. We can also specify the option -d.

Theses reports include the following information :
(fxp0) : network interface name.
packets : the received/transmitted packets with no errors ;
errs : the received/transmitted packets with errors ;
bytes : The number of received/transmitted bytes ;
colls : the collisions number ;
drops : the dropped packet numbers (with -d).

For instance :
# netstat -w 1 -I fxp0 -d will display a report of the fxp0 interface every second. We get :

Routing table display: Specify the -r option (routing table). It can be also interesting to specify the -n option and -f inet, to disable the name resolution and only list IPv4 information (use inet6 to display the IPv6 table).

Various fields signification (for a thorough explanation, use man) :
Destination : the destination network of host address ;
Gateway : the router address, the local link or the remote interface address on thelink ;
Flags :
U : Indicates route is ”up” ;
G : Route is to a gateway ;
S : Static route (manual addition) ;
H : Route is to a host and not a network ;
D : Route was created dynamically by a redirect ;
Refs : The ref field gives the current number of active uses of the route ;
Use : The use field provides a count of the number of packets sent using that route. ;
Netif : The interface entry indicates the network interface utilized for the route ;
Expire : The Expire entry is the result of FreeBSD’s unfortunate co-mingling network layer routing information with layer 2 ARP information. The only entries with ”Expire” values are actually ARP entries.