Netstat


Netstat

Purpose:

Use the TSO NETSTAT command to display the network status of the local host.

Format

>>──NETSTAT──────────────────────────────────────────────────────────────>

>──┬─┤ Option ├──┬────────────┬──┬────────────┬──┬───────────────┬─┬────><

│ └─┤ Target ├─┘ └─┤ Output ├─┘ └─(──┤ Select ├─┘ │

└─┤ Command ├──┬────────────┬───────────────────────────────────┘

└─┤ Target ├─┘

Option:

┌─COnn───────────────────────────┐

├──┼────────────────────────────────┼────────────────────────────────────┤

│ (1) │

├─ALL────────────────────────────┤

│ (1,2,3) │

├─ALLConn────────────────────────┤

├─ARp ─┬─net address─┬───────────┤

│ └─ALL─────────┘ │

│ (1) │

├─BYTEinfo─────┬──────────┬──────┤

│ └─IDLETIME─┘ │

├─CACHinfo───────────────────────┤

│ (1) │

├─CLients────────────────────────┤

├─CONFIG─────────────────────────┤

│ (1,2,3) │

├─COnn───────────────────────────┤

├─DEvlinks───────────────────────┤

│ (2) │

├─Gate─────┬────────┬────────────┤

│ └─DETAIL─┘ │

├─┬─HElp─┬───────────────────────┤

│ └─?────┘ │

├─HOme───────────────────────────┤

├─PORTList───────────────────────┤

├─ROUTe──────────────────────────┤

├─SLAP───────────────────────────┤

├─SOCKets────────────────────────┤

│ (1,2,3,4,5) │

├─TELnet──┬────────┬─────────────┤

│ └─DETAIL─┘ │

├─Up─────────────────────────────┤

└─VIPADyn────────────────────────┘

Target:

├────TCp tcpname─────────────────────────────────────────────────────────┤

Output Option:

├──┬─REPort──┬──────────────┬─┬──────────────────────────────────────────┤

│ ├─DSN──dsnname─┤ │

│ └─HLQ──hlqname─┘ │

└─STACk────────────────────┘

Select String:

<──────────────┐ (1)

├──┬─CLIent─────clientname──┴────────────┬───────────────────────────────┤

│ <─────────────────────┐ (2)│

├─IPAddr───┬─ipaddr────────────┬┴─────┤

│ └─ipaddr/subnetmask─┘ │

│ <───────────┐ (3) │

├─POrt─────portnum──┴─────────────────┤

│ <────────────┐ (4) │

├─APPLname─────applname──┴────────────┤

│ <──────────┐ (5) │

└─LUName─────luname──┴────────────────┘

Command:

├──DRop n────────────────────────────────────────────────────────────────┤

Notes:

(1) The CLIent select string is valid with ALL, ALLConn, BYTEinfo, COnn,

CLients, and TELnet.

(2) The IPAddr select string is valid only with ALLConn, COnn, Gate, and

TELnet.

(3) The POrt select string is valid only with ALLConn, COnn, and TELnet.

(4) The APPLname select string is valid only with TELnet.

(5) The LUName select string is valid only with TELnet.

Note: The minimum abbreviation for each parameter is shown in uppercase letters.

Parameters

ALL

Provides detailed information about TCP/IP connections. This option is useful for debugging the TCP/IP address space. For more information about maintaining the TCP/IP address

space, see OS/390 SecureWay Communications Server: IP Configuration.

If a UDP socket is being used for outgoing multicast data, this parameter displays the time-to-live value, indicates whether the datagrams are also sent to loopback, and displays the

IP address of the link on which the datagrams are being sent. If a UDP socket is being used for incoming multicast data, this parameter lists the multicast groups by way of their IP

addresses (up to a maximum of 20) for which data is being received and the IP address of the associated link.

ALLConn

Specifies that all information for all connections, including recently closed connections, is displayed.

ARp

Queries the ARP cache information.

net address Queries the ARP cache for a given address.

ALL Queries all ARP cache entries.

Note: The ARP counter data will not reflect activity for any devices which support ARP offload. Refer to the OS/390 SecureWay Communications Server: IP Configuration and the

OS/390 SecureWay Communications Server: SNA Network Implementation Guide for more information.

BYTEinfo

Displays the byte-count information about each connection. This option is most useful when used in conjunction with the REPORT or STACK options.

The following information is given for each connection:

Client ID

Bytes sent on the connection

Bytes received on the connection

Local port

Foreign socket

State

IDLETIME Displays the preceding information plus the idle time for each connection.

The idle time is displayed in the following format:

hours:minutes:seconds

CACHinfo

Displays information about Fast Response Cache Accelerator (Cache Accelerator) statistics. Statistics are displayed for each listening socket configured for Cache Accelerator

support.

For each listening socket configured for Cache Accelerator support, the following information is displayed:

Client The user name of the application that bound the listening socket.

Socket The local IP address and port pair to that the listening socket is bound.

MaxCacheSize The maximum number of 4K pages that may be used for storing cache objects by the Cache Accelerator for the given socket.

CurrCacheSize The number of 4K pages currently being used for storing cache objects by the Cache Accelerator.

MaxNumObjects The maximum number of cache objects that may be stored by the Cache Accelerator.

CurrNumObjects The current number of cache objects stored by the Cache Accelerator.

NumConns The number of connections established through a listening socket which has been configured with Cache Accelerator support.

ConnsProcessed The number of connections that have successfully completed an in-kernel transaction, resulting in a response being transmitted to the client. This counter is

incremented at most once per connection.

Note: It is possible for a single connection to be processed by the Cache Accelerator for some cache entries and then deferred to the application for additional processing. If

this occurs, the connection will be included in both ConnsProcessed and ConnsDeferred.

ConnsDeferred The number of connections that require user-space application processing.

Note: This counter is not incremented due to the connection timeout expiration, even if the action taken is to defer the connection.

ConnsTimedOut The number of times the connection timeout timer has expired.

RequestsProcessed The number of connection requests that were at least partially processed by the Cache Accelerator.

Note: It is possible for a single connection to be processed by the Cache Accelerator for some cache objects and then deferred to the application for additional processing. If

this occurs, the connection is included in both RequestsProcessed and RequestsDeferred.

IncompleteRequests The number of times a request is received from the client where additional data is required to process the request. This counter may be incremented multiple

times for a single connection.

NumCacheHits The number of cache objects that were successfully located and transmitted to clients.

NumCacheMisses The number of cache objects that were not successfully located and transmitted to clients.

NumUnprodCacheHits The number of cache entries succesfully found within the cache but not transmitted to the client.

CLients

Provides the following information about each client:

Client's authorization

Elapsed time since the client was last used

CONFIG

Provides the following TCP/IP configuration data:

Configured IP information

Configured TCP information

Configured UDP information

SMF parameters

GLOBALCONFIG Profile information

Note: The TCPIPSTATS field shown under the SMF PARAMETERS section of the NETSTAT CONFIG output reflects the value of TcpIpStatistics or NoTcpIpStatistics specified on the

SMFCONFIG statement in the TCP/IP Profile or Obeyfile. The TCPIPSTATS field shown under the GLOBAL CONFIGURATION section of the NETSTAT CONFIG output reflects the

value from the ASSORTEDPARMS or GLOBALCONFIG statements in the TCP/IP Profile or Obeyfile.

Data trace settings

Dynamic VIPA information

COnn

Provides the following information about each active TCP/IP connection. An active connection is a connection that is not in the closed or time-wait state.

Client name

Client ID

Local IP address

Foreign IP address

Connection state

COnn is the default parameter.

A connection progresses through a series of states during its lifetime. The following are the possible states for a TCP connection.

┌─────────────┬──────────────────────────────────────────────────────────┐

│ State │ Description │

├─────────────┼──────────────────────────────────────────────────────────┤

│ LISTEN │ Waiting for a connection request from any remote TCP and │

│ │ port │

│ SYN-SENT │ Waiting for a matching connection request after having │

│ │ sent a connection request │

│ SYN-RECEIVED│ Waiting for a confirming connection request │

│ │ acknowledgment after having both received and sent a │

│ │ connection request │

│ ESTABLISHED │ Represents an open connection; this is the normal state │

│ │ for the data transfer phase of the connection │

│ FIN-WAIT-1 │ Waiting for a connection termination request from the │

│ │ remote TCP, or an acknowledgment of the connection │

│ │ termination request │

│ FIN-WAIT-2 │ Waiting for a connection termination request from the │

│ │ remote TCP │

│ CLOSE-WAIT │ Waiting for a connection termination request from the │

│ │ local user │

│ CLOSING │ Waiting for a connection termination request │

│ │ acknowledgment from the remote TCP │

│ LAST-ACK │ Waiting for an acknowledgment of the connection │

│ │ termination request previously sent to the remote TCP │

└─────────────┴──────────────────────────────────────────────────────────┘

For more information about the TCP connection states, refer to

RFC793.

DEvlinks

Displays the following information about devices and defined links in

the TCP/IP address space:

Device name

Device type

Device number

Link name

Link type

Status of the link

The following list describes the possible link statuses:

│ Status │ Description │

│ Starting │ A START of the device has been issued by the operator, │

│ │ and TCP/IP has been sent an Activation request to the │

│ │ Data Link Control (DLC) layer. │

│ Enabling │ DLC has acknowledged the Activation request from TCP/IP, │

│ │ and TCP/IP has requested DLC to allow TCP/IP to receive │

│ │ inbound connections for the device. │

│ Sent SETUP │ DLC has acknowledged the Activation request from TCP/IP, │

│ │ and TCP/IP has requested DLC to perform the initial I/O │

│ │ sequence with the device. │

│ Connecting │ DLC has accepted the Initial I/O Sequence request. │

│ Connecting2 │ The control connection for a Common Link Access to │

│ │ Workstation protocol (CLAW) device has been established, │

│ │ and the second connection (on which IP traffic is │

│ │ carried) is being established. │

│ Negotiating │ The initial I/O sequence with the device is complete, │

│ │ and TCP/IP is performing additional link-layer │

│ │ initialization. │

│ Ready │ The initialization sequence with the device is complete. │

│ │ The device is now ready. │

│ Sent CLEAR │ The operator has issued a STOP of the device, and TCP/IP │

│ │ has sent a Deactivation request to DLC. │

│ Deactivated │ DLC has performed the first stage of an orderly device │

│ │ deactivation. │

│ Not active │ The device is not active. (The device has never been │

│ │ started, or has been stopped after having been started.) │

Net number

Displays the link adapter number, if applicable.

Queue size

This field is significant only for links on LCS and ATM devices.

ARP MAC addresses

This field is significant only for token-ring links.

SR bridging capability

This field is significant only for token-ring links.

Multicast specific

This field is significant only for multicast capable devices.

If a link is being used to receive multicast data, then all the multicast groups, and the counts of receivers for each multicast group, are displayed. There is no limit to the number of

multicast groups for which a link can receive data.

- Multicast capability

This field is always Yes for the following devices: CDLC, CLAW, CTC, and MPCPTP.

For LCS and MPCIPA devices, the multicast capability is only known after the device is in the Ready state. If the device is not yet Ready, the multicast capability will be Unknown.

Broadcast capability

This field is significant only for links on LCS devices.

Broadcast type

This field is significant only for token-ring links.

Number of bytes received

Number of bytes transmitted

BSD parameters

Packet trace settings

ATM specific information

This field is significant only for ATM devices and links.

Notes:

1. No link-related information, packet trace settings, or BSD parameters are displayed for a device that has no link defined.

2. The packet trace setting is displayed only when it is defined and set to ON.

3. ATM specific information is displayed only for ATM devices that have links defined.

4. The LOOPBACK device and link are displayed.

Gate

Provides the following information about each gateway:

Address of the network

First hop address

Link name used by the first hop

Note: Only the first 8 characters of the link name are displayed by this command. Issue the NETSTAT ROUTE command to see more than 8 characters of the link name.

Packet size used by the first hop

Subnet mask and subnet value

DETAIL Displays the preceding information plus the metric associated with the cost of the use for the link, and displays the following MVS specific configured parameters for each

gateway:

Maximum retransmit time

Minimum retransmit time

Round trip gain

Variance gain

Variance multiplier

Note: The static routes associated with deleted interfaces in the routing table no longer appear in the reports generated with the NETSTAT Gate command. For details, refer to

OS/390 SecureWay Communications Server: IP Diagnosis.

HElp or ?

Provides help information for the NETSTAT parameters.

HOme

Displays the HOME list. The IP address, link name, and primary interface flag are displayed for each entry in the list.

For more information about the home list, refer to OS/390 SecureWay Communications Server: IP Configuration.

PORTList

Displays the port reservation list:

Port number

Protocol

Username

Flags

A Autolog

D DelayAcks

O Optimize MSS

R Port is reserved by range

S Share port

Range

This field is significant only for port entry reserved by range (flag R in the Flags field).

ROUTe

Displays routing information, such as:

Destination The address of a destination host or network

Gateway The gateway used in forwarding packets

Flags The state of the route:

U The route is up.

H The route is to a host rather than to a network.

G The route is a gateway.

D The route was created dynamically by a redirect.

Reference count The current number of active users for the route

Interface The link name for the route

Note: The static routes associated with deleted interfaces in the routing table no longer appear in the reports generated with the NETSTAT ROUTe command. For details, refer to

OS/390 SecureWay Communications Server: IP Diagnosis.

SLAP

Displays all of the service policy definitions (policy rules, policy profiles, and service classes) and policy statistics data.

SOCKets

Displays information about each client using the socket interface. When you specify the NETSTAT SOCKets command, information about the client using the socket interface is

displayed along with information about the sockets and associated connections owned by the client.

The following is the information displayed after invoking the SOCKets parameter:

Name

The client address space name.

Subtask

The subtask identifier.

The subtask identifier is combined with the address space name to produce a unique identifier for the client.

For socket programs written in the C language, the EBCDIC hexadecimal representation of an address within the program is used as the subtask identifier.

Type

Displays one of the following socket types:

Stream for stream (TCP) sockets

Dgram for the stream (UDP) sockets

Bound to

Indicates the address and port to which the socket is bound. The output is in the format internet address..bound port where internet address is the address to which the

socket is bound and bound port is the port number to which the socket is bound. Unbound TCP and UDP sockets are not displayed by NETSTAT CONN.

Connected to

Displays the address and port to which the socket is connected.

State

Displays the TCP connection state for TCP sockets or UDP for UDP sockets.

Conn

Displays the client identifier, which is a unique number assigned by TCP/UDP stack to uniquely identify a socket entity.

TELnet

Displays the status of the internal Telnet server.

DETAIL Displays the logmode and Telnet protocol in use by each connection. If an application user ID was entered on the solicitor panel, it is displayed in the TnUserId field.

Otherwise, the TnUserId field is blank.

Provides the date and time that TCP/IP was started.

VIPADyn

Displays the current dynamic VIPA information for a local host.

TCp tcpname

Displays detailed information about the specified TCP/IP address space. You can use TCp tcpname with any other NETSTAT parameter to get information about the specified TCP/IP

address space; however, this parameter works only for TCP/IP address spaces having the same version as NETSTAT.

The tcpname is an 8-byte procedure name that is used to start the TCP/IP. When the 'S member.identifier' method of starting TCP/IP is used, the value specified for identifier must

be used as tcpname.

REPort

Causes the output to be stored in a MVS data set. If there is no additional parameter specified, the output is stored in a data set named tsoprefix.NETSTAT.option. If NOPREFIX is

set in the TSO user profile, then the data set name is NETSTAT.option. The data set is created and cataloged if it does not already exist. If the data set already exists, the output from

the requested option replaces any existing data. The name of the data set depends on whether either of the following additional parameters were specified:

. DSN dsnname

Specifies the data set name in which the output will be stored. The dsnname can be either a fully qualified name surrounded by single quotation marks (for example, 'abc.xyz') or

an unqualified name (for example, abc). If an unqualified name is specified, then the unqualified name will be prefixed with the TSO prefix value.

. HLQ hlqname

Specifies the high level qualifier for the data set in which the output will be stored. The resulting data set name will be hlqname.NETSTAT.option.

┌───────────────────┬────────────────────────┬───────────────────────────┐

│ │ tsoprefix unavailable │ tsoprefix available │

├───────────────────┼────────────────────────┼───────────────────────────┤

│ Nothing specified │ NETSTAT.option │ tsoprefix.NETSTAT.option │

│ HLQ specified │ hlq.NETSTAT.option │ hlq.NETSTAT.option │

│ Unqualified DSN │ dsnname │ tsoprefix.dsnname │

│ Fully-qualified │ dsnname │ dsnname │

│ DSN │ │ │

└───────────────────┴────────────────────────┴───────────────────────────┘

STACk

Causes the response to be placed in the program stack when NETSTAT is

issued from a CLIST or a REXX EXEC. Title lines are not placed in the

stack.

select_string

Specifies a character string used to limit option responses

CLIent clientname

Provides the response of ALL, ALLConn, BYTEinfo, COnn, CLient,

and TELnet on the specified client name.

IPAddr ipaddr

IPAddr ipaddr/subnetmask

Provides the response of ALLConn, COnn, Gate, and TELnet on the

specified IP address ipaddr or ipaddr/subnetmask. If subnetmask

is not specified, the default of 255.255.255.255 is used.

Notes:

1. For the Gate option, ipaddr is the destination IP address,

not the destination network address.

2. When filtering Gate responses on a specified ipaddr, the

DEFAULT and DEFAULTNET routes are always displayed, as they

apply to all IP addresses.

3. For ALLConn, CONN, and TELnet options, ipaddr can be either

the local or remote IP address.

POrt portnum

Provides the response of ALLConn, COnn and TELnet on the

specified port number.

Note: The port number can be either a local or remote port.

APPLname applname

Provides the response of TELnet on the specified VTAM application

name.

LUName luname

Provides the response of TELnet on the specified LU name.

The select_string can be a complete string or a partial string using

wildcard characters. A wildcard character can be an asterisk (*),

which matches a null string or any character or character string, at

the same position. A wildcard character can be a ?, which matches any

single character at the same position. For example, a string

"searchee" matches with "*ar?he*", but the string "searhee" does not

match with "*ar?he*".

You can enter up to six select_string values. For IPAddr, each

selected value can be up to 15 characters long, and for CLIents,

APPLname and LUName, each selected value can be up to eight

characters long.

If you want to use the wildcard character on the IPADDR

select_string, you must specify the select value in the ipaddr

format. The wildcard character is not accepted for the

ipaddr/subnetmask format of IPAddr values.

If you specified select_string, it must be the last parameter on the

NETSTAT command line.

DRop n

Drops the TCP/IP connection specified by n. You can determine the

connection number from the CONN column in the NETSTAT COnn or NETSTAT

TELnet display. If you drop the server's passive open connection, the

server immediately reissues the open request.

You can use this parameter only if your RACF profile contains the

MVS.VARY.TCPIP.DROP definition.

Usage

The time displayed in the header for each option is local time. The

time field displayed in options ALL, BYTEinfo, CLients, and UP is

Greenwich mean time (GMT).

Examples

This section contains examples of the response that is displayed as a

result of issuing the NETSTAT command with each parameter. To help you

find the examples, following is a list of the NETSTAT parameters and the

page number where you will find the example:

NETSTAT ALL: The NETSTAT ALL command displays information about TCP/IP

connections. The client TCPCLIE1 in the following example shows

information about a TCP connection, and the client UDPCLIE1 shows

information about a UDP connection.

┌──────────────────────────────────────────────────────────────────────────────────┐

│ │

│ READY │

│ netstat all │

│ │

│ MVS TCP/IP NETSTAT CS V2R8 TCPIP Name: TCPCS 08:59:29 │

│ Client Name: TCPCS Client Id: 00000008 │

│ Local Socket: 127.0.0.1..1025 Foreign Socket: 127.0.0.1..1026 │

│ Last Touched: 11:53:11 State: Establsh │

│ BytesIn: 0000000644 BytesOut: 0000000840 │

│ SegmentsIn: 0000000044 SegmentsOut: 0000000040 │

│ RcvNxt: 1111472027 SndNxt: 1111472543 │

│ ClientRcvNxt: 1111472027 ClientSndNxt: 1111472543 │

│ InitRcvSeqNum: 1111471382 InitSndSeqNum: 1111471702 │

│ CongestionWindow: 0000410006 SlowStartThreshold: 0000016384 │

│ IncomingWindowNum: 1111504755 OutgoingWindowNum: 1111505275 │

│ SndWl1: 1111471987 SndWl2: 1111472543 │

│ SndWnd: 0000032732 MaxSndWnd: 0000032768 │

│ SndUna: 1111472543 rtt_seq: 1111472507 │

│ MaximumSegmentSize: 0000065483 OptMaxSegmentSize: 0000065483 │

│ BackoffCount: Precedence: Routine │

│ Round-trip information: │

│ Smooth trip time: 69.000 SmoothTripVariance: 113.000 │

│ ReXmt: 0000000000 ReXmtCount: 0000000000 │

│ DupACKs: 0000000000 │

│ SockOpt: 00 TcpTimer: 00 │

│ TcpSig: 04 TcpSel: 20 │

│ TcpDet: 30 TcpPol: 00 │

│ TcpClusterConnFlag: 82 │

│ ReceiveBufferSize: 0 │

│ ---- │

│ Client name: 00010003 Client id : 10003 │

│ Local Socket: 0.0.0.0..2025 Foreign Socket: *..* │

│ Last Touched: 3:35:05 │

│ Precedence: Routine │

│ BytesIn: 0000400000 BytesOut: 0000400000 │

│ DgramIn: 0000000100 DgramOut: 0000000100 │

│ MaxSendLim: 0000065000 MaxRecvLim: 0000065000 │

│ SockOpt: 00 │

The time-to-live value