Netstat BYTEinfo/-b report

Displays byte-count information for each active TCP connection and UDP socket.

TSO syntax


>>-NETSTAT  BYTEinfo--| Modifier |--| Target |--| Output |--| (Filter |-><

Modifier


>>-IDLETIME----------------------------------------------------><

IDLETIME

Displays byte-count information plus the idle time for each TCP connection and UDP socket.

Idle time is displayed in the following format:

hours:minutes:seconds.

Target

Provide the report for a specific TCP/IP address space by using TCp tcpname. See The Netstat command target for more information about the TCp parameter.

Output

The default output option displays the output on the user's terminal. For other options, see The TSO NETSTAT command syntax or Netstat command output.

Filter


             .----------------.            
             V                |            
>>-+-CLIent------clientname---+--------+-----------------------><
   +-HOSTName--hostname----------------+   
   |         .-----------------------. |   
   |         V                       | |   
   +-IPAddr----+-ipaddr------------+-+-+   
   |           +-ipaddr/prefixLen--+   |   
   |           '-ipaddr/subnetmask-'   |   
   '-NOTN3270--------------------------'

z/OS UNIX syntax


>>-netstat  -b--| Modifier |--| Target |--| Output |--| Filter |-><

Modifier


>>-IDLETIME----------------------------------------------------><

IDLETIME

Displays the byte-count information plus the idle time for each TCP connection and UDP socket.

The idle time is displayed in the following format:

hours:minutes:seconds

Target

Provide the report for a specific TCP/IP address space by using -p tcpname. See The Netstat command target for more information about the TCp parameter.

Output

The default output option displays the output to z/OS UNIX shell stdout. For other options, see The z/OS UNIX netstat command syntax or Netstat command output.

Filter


          .----------------.            
          V                |            
>>-+- -E------clientname---+--------+--------------------------><
   +- -H--hostname------------------+   
   |      .-----------------------. |   
   |      V                       | |   
   +- -I----+-ipaddr------------+-+-+   
   |        +-ipaddr/subnetmask-+   |   
   |        '-ipaddr/prefixLen--'   |   
   '- -T----------------------------'

Filter description

CLIent/-E clientname: Filter the output of the BYTEinfo/-b report using the specified client name clientname. You can enter up to six filter values and each specified value can be up to eight characters in length.

HOSTName/-H hostname

Filter the output of the BYTEinfo/-b report using the specified host name hostname. You can enter one filter value at a time and the specified value can be up to 255 characters in length.

Result: At the end of the report, Netstat displays the host name that the resolver used for the resolution and the list of IP addresses returned from the resolver that it used as filters.

Restrictions:

The HOSTName/-H filter does not support wildcard characters.
Using HOSTName/-H filter might cause delays in the output due to resolution of the hostname value, depending upon resolver and DNS configuration.

IPAddr/-I ipaddrIPAddr/-I ipaddr/prefixlengthIPAddr/-I ipaddr/subnetmask

Filter the report output using the specified IP address ipaddr, ipaddr/prefixlength, or ipaddr/subnetmask. You can enter up to six filter values. Each specified IPv4 ipaddr value can be up to 15 characters in length and each selected IPv6 ipaddr value can be up to 45 characters in length.

ipaddr: Filter the output of the BYTEinfo/-b report using the specified IP address ipaddr. For IPv4 addresses, the default subnet mask of 255.255.255.255 is used. For IPv6 addresses, the default prefixlength of 128 is used.

ipaddr/prefixlength: Filter the output of the BYTEinfo/-b report using the specified IP address and prefix length ipaddr/prefixlength. For an IPv4 address, the prefix length range is 1 – 32. For an IPv6 address, the prefix length range is 1 – 128.

ipaddr/subnetmask

Filter the output of the BYTEinfo/-b report using the specified IP address and subnet mask ipaddr/subnetmask. The IP address ipaddr in this format must be an IPv4 IP address.

Guidelines:

The filter value ipaddr can be either the local or remote IP address.
For an IPv6-enabled stack:
- Both IPv4 and IPv6 ipaddr values are accepted and can be mixed on the IPAddr/-I option.
- An IPv4-mapped IPv6 address is accepted as a valid ipaddr value and will usually provide the same result as its IPv4 address.

Restrictions:

The filter value for an IPv6 address does not support wildcard characters.
For an IPv4-only stack, only IPv4 ipaddr values are accepted.
For a UDP endpoint socket, the filter value applies only to the local or source IP address.

NOTN3270/-T: Filter the output of the BYTEinfo/-b report, excluding TN3270 server connections.

The filter value for CLIent/-E and IPAddr/-I can be a complete string or a partial string using wildcard characters. A wildcard character can be an asterisk (*), which matches a null string or any character or character string, at the same position. A wildcard character can be a question mark (?), which matches any single character at the same position. For example, a string "searchee" matches with "*ar?he*", but the string "searhee" does not match with "*ar?he*". If you want to use the wildcard character on the IPAddr/-I filter, specify the value in the ipaddr format. The wildcard character is not accepted for the ipaddr/subnetmask or ipaddr/prefixlen format of IPAddr/-I values.

When using the z/OS UNIX netstat/onetstat command in a z/OS UNIX shell environment, take care if you use a z/OS UNIX MVS™ special character in a character string. It might cause an unpredictable result. To be safe, if you want to use a z/OS UNIX MVS special character in a character string, surround the character string with single (') or double (") quotation marks. For example, to use an asterisk (*) in the IP address, 10.*.0.0 for the -I filter, issue the command as: netstat -b -I '10.*.0.0' or netstat -b -I "10.*.0.0".

Command syntax examples

From TSO environment

NETSTAT BYTEINFO
   Displays the byte-count information about each TCP connection and UDP socket in the 
   default TCP/IP stack. 
NETSTAT BYTEINFO TCP TCPCS6
   Displays the byte-count information about each TCP connection and UDP socket in 
   TCPCS6 stack.
NETSTAT BYTEINFO TCP TCPCS8 (IPADDR 9.43.1.1 9.43.2.2
   Displays the byte-count information about each TCP connection and UDP socket in 
   TCPCS8 stack whose foreign IP addresses match the specified filter IP address values.

From UNIX shell environment

   netstat -b
   netstat -b -p tcpcs6 
   netstat -b -p tcpcs6 -I 9.43.1.1 9.43.2.2

Report examples

The following examples are generated by using TSO NETSTAT command. Using the z/OS UNIX netstat command displays the data in the same format as the TSO NETSTAT command.

Not IPv6 enabled (SHORT format)

NETSTAT BYTEINFO
MVS TCP/IP NETSTAT CS V2R1       TCPIP Name: TCPCS           17:19:18   
06/06/2003          MVS TCP/IP Real Time Network Monitor                
User Id  B Out      B In       L Port  Foreign Socket          State    
-------  -----      ----       ------  --------------          -----    
FTPD1    0000000000 0000000000 00021   0.0.0.0..0              Listen   
FTPD1    0000001062 0000000480 00021   9.67.115.5..1026        Establsh 
FTPD1    0000000200 0000000028 00021   9.27.13.21..3711        Establsh 
TCPCS    0000000000 0000000000 00023   0.0.0.0..0              Listen   
TCPCS    0000000480 0000001062 00023   9.27.11.182..4886       Establsh 
APPV4    0000000200 0000000100 02049   9.42.103.99..1234       UDP      
SYSLOGD1 0000000000 0000000000 00514   *..*                    UDP      
Connections displayed: 6

NETSTAT BYTEINFO IDLETIME
MVS TCP/IP NETSTAT CS V2R1       TCPIP NAME: TCPCS            17:40:44   
06/06/2003          MVS TCP/IP Real Time Network Monitor                 
User Id  B Out   B In    LPort Foreign Socket         State    IdleTime  
-------- ------- ------- ----- ---------------------- -------- --------  
FTPD1    0000000 0000000 00021 0.0.0.0..0             Listen   00:03:31  
FTPD1    0001062 0000480 00021 9.67.115.5..1026       Establsh 00:03:45  
FTPD1    0000200 0000028 00021 9.27.13.21..3711       Establsh 00:03:57  
TCPCS    0000000 0000000 00023 0.0.0.0..0             Listen   00:01:02  
TCPCS    0000480 0001062 00023 9.27.11.182..4886      Establsh 00:04:00  
APPV4    0000200 0000100 02049 9.42.103.99..1234      UDP      00:03:01  
SYSLOGD1 0000000 0000000 00514 *..*                   UDP      00:02:13  
Connections displayed: 6

Guideline: For the NETSTAT BYTEINFO IDLETIME display, the byte outbound (B Out) and byte inbound (B In) counts are in three forms:

nnnnnnn: Number range 0 – 9 999 999

nnnnnnK: Number range 10 000 000 – 999 999 499 (K = nnnnnn x 1000)

nnnnnnM: Number range 999 999 500 – 4 294 967 287 (M = nnnnnn x 1 000 000)

IPv6 enabled or request for LONG format

NETSTAT BYTEINFO
MVS TCP/IP NETSTAT CS V2R1       TCPIP Name: TCPCS           16:49:32   
06/06/2003          MVS TCP/IP Real Time Network Monitor                
User Id  BytesOut             BytesIn              LPort State          
-------  --------             -------              ----- -----          
FTPD1    00000000000000000000 00000000000000000000 00021 Listen         
  Foreign Socket: ::..0                                                 
FTPD1    00000000000000000217 00000000000000000025 00021 Establsh       
  Foreign Socket: ::ffff:9.67.115.65..1026                              
FTPD1    00000000000000000438 00000000000000000061 00021 Establsh       
  Foreign Socket: 2001:0db8::9:67:115:65..1027                          
TCPCS    00000000000000000000 00000000000000000000 00023 Listen         
  Foreign Socket: 0.0.0.0..0                                            
TCPCS    00000000000000000480 00000000000000001062 00023 Establsh       
  Foreign Socket: 9.27.11.182..4665                                     
USER3    00000000000000000000 00000000000000097865 01079 Establsh        
  Foreign Socket: 2001:0db8::9:67:115:65..21                             
USER6    00000000000000000061 00000000000000000438 01027 Establsh        
  Foreign Socket: 9.37.65.146..21                                        
APPV4    00000000000000000200 00000000000000000100 02049 UDP             
  Foreign Socket: 9.42.103.99..1234
APPV6    00000000000000000200 00000000000000000100 02050 UDP
  Foreign Socket: 12ab::1..1235    

SYSLOGD1 00000000000000000000 00000000000000000000 00529 UDP             
  Foreign Socket: *..*                                                   
Connections displayed: 8

NETSTAT BYTEINFO IDLETIME
MVS TCP/IP NETSTAT CS V2R1       TCPIP Name: TCPCS           16:49:32   
06/06/2003          MVS TCP/IP Real Time Network Monitor                
User Id  BytesOut             BytesIn              LPort State          
-------  --------             -------              ----- -----          
FTPD1    00000000000000000000 00000000000000000000 00021 Listen         
  Foreign Socket: ::..0                                                 
FTPD1    00000000000000000217 00000000000000000025 00021 Establsh       
  Foreign Socket: ::ffff:9.67.115.65..1026                              
FTPD1    00000000000000000438 00000000000000000061 00021 Establsh       
  Foreign Socket: 2001:0db8::9:67:115:65..1027                          
TCPCS    00000000000000000000 00000000000000000000 00023 Listen         
  Foreign Socket: 0.0.0.0..0                                            
TCPCS    00000000000000000480 00000000000000001062 00023 Establsh       
  Foreign Socket: 9.27.11.182..4665                                     
USER3    00000000000000000000 00000000000000097865 01079 Establsh        
  Foreign Socket: 2001:0db8::9:67:115:65..21                             
USER6    00000000000000000061 00000000000000000438 01027 Establsh        
  Foreign Socket: 9.37.65.146..21                                        
APPV4    000000000000000200 000000000000000100 02049 UDP	00:03:01   
  Foreign Socket: 9.42.103.99..1234
APPV6    000000000000000200 000000000000000100 02050 UDP	00:20:02
  Foreign Socket: 12ab::1..1235

SYSLOGD1 00000000000000000000 00000000000000000000 00529 UDP             
  Foreign Socket: *..*                                                   
Connections displayed: 8

Guideline: For the NETSTAT BYTEINFO IDLETIME display, the BytesOut and BytesIn counts are in two forms:

nnnnnnnnnnnnnnnnnn: Number range 0 – 999 999 999 999 999 999

nnnnnnnnnnnnnnnnnK: Number range 1 000 000 000 000 000 000 – 999 999 999 999 999 999 499 (K = nnnnnnnnnnnnnnnnnn x 1000)

Report field descriptions

User Id: See the Client name or User ID information in Netstat report general concept for a detailed description.

BytesIn / B In: For a TCP entry, the number of bytes of data the stack has received for this TCP connection. This includes both the total number of bytes that the application has received and the total number of bytes in the receive buffer that have not yet been read by the application. For a UDP entry, it is the number of bytes of data the stack has received for this UDP socket. This includes both the total number of bytes that all applications have received for this socket and the total number of bytes in stack buffers that have not yet been read by any application.
Restriction: The TCP/IP stack maintains 64-bit counters for TCP connections and UDP endpoints. However, if you are running an IPv4-only stack, and the Netstat output is in the SHORT format, only the lower 32-bit counter value is displayed. If a large amount of data has been received, the number of bytes can exceed a 32-bit counter so the value displayed will appear to have been reset. Use the FORMAT/-M LONG output option on the Netstat command to cause Netstat to use the LONG format for the output. The LONG format displays the full 64-bit counter value. You can also specify the FORMAT parameter on the IPCONFIG profile statement to set FORMAT LONG as the default value for all Netstat commands.

BytesOut / B Out: For a TCP entry, it is the number of bytes of data the application has sent. This includes all of the data that has been sent to the remote connection and all of the data that has not been sent but is buffered and waiting to be sent by the local stack. For a UDP entry, it is the number of outbound bytes of user data sent from this socket.
Restriction: The TCP/IP stack maintains 64-bit counters for TCP connections and UDP endpoints. However, if you are running an IPv4-only stack, and the Netstat output is in the SHORT format, only the lower 32-bit counter value is displayed. If a large amount of data has been sent, the number of bytes can exceed a 32-bit counter so the value displayed will appear to have been reset. Use the FORMAT/-M LONG output option on the Netstat command to cause Netstat to use the LONG format for the output. The LONG format displays the full 64-bit counter value. You can also specify the FORMAT parameter on the IPCONFIG profile statement to set FORMAT LONG as the default value for all Netstat commands.

LPort: See the Local port description in Netstat report general concept for a detailed description.

Foreign Socket: See the Foreign socket information in Netstat report general concept for a detailed description.

State: See the TCP connection status and UDP socket status information in Netstat report general concept for a detailed description.

IdleTime: The time interval between the current time and the last time the connection was touched. See Last touched time in Netstat report general concept for a detailed description of the last touched time.