Troubleshooting problems with netstat

The netstat(TC) program is helpful in tracking down network malfunctions. In particular, use the following options:

• -a (active connections display), to view and remove phantom connections.

• -i (active interfaces display), to troubleshoot incoming and outgoing packet errors.

• -m (streams allocation), to check on streams failures.

• -r (routing tables), to verify the presence of needed routes.

Flushing phantom connections

Use the netstat -a command to display active connections and sockets. Look for phantom connections -- those that still appear as active in the display that were terminated abnormally. If many appear, your network may run slowly, and you may need to stop and restart TCP/IP to flush the connections.

Troubleshooting packet errors

The netstat -i command displays active interfaces (network card and serial interfaces) as well as statistics on:

Ipkts

input packets per interface

Ierrs

input errors per interface

Opkts

output packets per interface

Oerrs

output errors per interface

Coll

packet collisions detected

   Name  Mtu    Network       Address     Ipkts  Ierrs Opkts   Oerrs Coll
   net0  1500   10.0.118      don         1348   12    1854    23    65
   lo0   8232   loopback      localhost   4058   0     4058    0     0

If both Ipkts and Ierrs are zero, the connection to the network may be bad, the network card may be bad, or there may be an interrupt vector conflict. Verify network cabling, then check for interrupt conflicts by running hwconfig or vectorsinuse. If a conflict exists, use the Network Configuration Manager to reconfigure your card. If the cable and interrupt vectors check out, run any diagnostic tools supplied by the manufacturer of the networking card.

If Ipkts is zero, but Ierrs is nonzero, the network, cabling, or card may be bad, another host on the network may be generating bad packets, or the network may be incorrectly terminated.

If Opkts is zero and Oerrs is nonzero, there may be a conflict of I/O addresses on the system. If both are zero, the conflict may be in shared memory addresses. Verify the I/O and shared memory addresses of each card on your system, and reconfigure your networking card with other supported addresses if conflicts exist.

If Coll is high (greater than 1-2 percent of the Opkts total), your network is very busy. Consider breaking the network into multiple separate networks.

Monitoring streams usage

Use the netstat -m command to monitor streams usage. The display shows each type of buffer allocated; the number free, allocated, and configured; the number of failures per type; and other streams information.

Streams are dynamically allocated in this release of TCP/IP, so streams errors should be uncommon. However, if you notice streams failures and need to reconfigure streams allocation, do so by using configure(ADM).

Verifying correct routing behavior

The netstat -r command provides information about the usage of each route configured on your system. A route consists of a destination host or network and a network interface used to exchange packets. Direct routes are created for each interface attached to the local host.

At a minimum, your routing table should display entries for the loopback mechanism (localhost), the local network, the local hostname, and the IP Multicasting route, 224. The following is a typical display:

   Routing tables
   Destination     Gateway         Flags     Refs     Use   Interface
   localhost       localhost       UH        24       66    lo0
   10.0.118        nile            UC        1        0     net0
   nile            localhost       UGHS      3        36    lo0
   224             nile            UCS       0        0     net0

Destination

Network or host to which this route allows you to connect.

Gateway

Name of the gateway you configured for this route. If you are directly connected, this is a local address. Otherwise, it is the name of the host through which packets must be routed.

Flags

State of the route. For a complete list, refer to the manual page for route(ADMN). Common states are:

C

cloning -- new routes are derived from this route

G

a route to a gateway

H

a route to a host

N

a route to a network

S

static

U

up

Refs

Current number of active connections using the route. Connection-oriented protocols normally hold on to a single route for the duration of the connection, while connectionless protocols obtain a route, then discard it as needed.

Use

Current number of packets sent using this route.

Interface

Name of the physical network interface to begin the route.