net === :: NAME net - network command SYNOPSIS net [[-s | -S] [-xd] [-R ref] [pid | task]] [-a] [ -n [pid | task]] [-N addr] DESCRIPTION Displays various network related data. If no arguments are entered, the list of network devices, names and IP addresses are displayed. For kernels supporting namespaces, the -n option may be used to display the list of network devices with respect to the network namespace of a current context or a task specified by pid or task: -n the namespace of the current context. -n pid a process PID. -n task a hexadecimal task_struct pointer. The -s and -S options display data with respect to the current context, but may be appended with an argument to show the socket data with respect to a specified task: -s display open network socket/sock addresses, their family and type, and for INET and INET6 families, their source and destination addresses and ports. -s pid same as above, for task with process PID pid. -s task same as above, for task with hexadecimal task_struct pointer task. -S displays open network socket/sock addresses followed by a dump of both data structures. -S pid same as above, with respect to process PID. -S task same as above, with respect to hexadecimal task_struct pointer. The -R option, typically invoked from "foreach net", and in conjunction with the -s or -S options, searches for references to a socket address, sock address, or a file descriptor; if found, only the referenced fd, socket or sock data will be displayed: -R ref socket or sock address, or file descriptor. Other options: -a display the ARP cache. -N addr translates an IPv4 address expressed as a decimal or hexadecimal value into a standard numbers-and-dots notation. -x override default output format with hexadecimal format. -d override default output format with decimal format. EXAMPLES Display the system's network device list: crash> net NET_DEVICE NAME IP ADDRESS(ES) ffff8803741c0000 lo 127.0.0.1 fff88037059c0000 eth0 10.226.229.141 ffff8803705c0000 eth1 10.226.228.250 ffff880374ad6000 usb0 169.254.95.120 Display the network device list with respect to the network namespace of PID 2618: crash> net -n 2618 NET_DEVICE NAME IP ADDRESS(ES) ffff880456ee7020 lo 127.0.0.1 ffff8804516a1020 eth0 10.1.9.223 Dump the ARP cache: crash> net -a NEIGHBOUR IP ADDRESS HW TYPE HW ADDRESS DEVICE STATE f38d1b00 10.16.64.14 ETHER 00:16:3e:4b:a5:4a eth1 STALE f38d1080 0.0.0.0 UNKNOWN 00 00 00 00 00 00 lo NOARP f38d1bc0 10.16.71.254 ETHER 00:00:0c:07:ac:00 eth1 REACHABLE f38d1200 10.16.64.21 ETHER 00:16:3e:51:d8:09 eth1 REACHABLE Display the sockets for PID 2517, using both -s and -S output formats: crash> net -s 2517 PID: 2517 TASK: c1598000 CPU: 1 COMMAND: "rlogin" FD SOCKET SOCK FAMILY:TYPE SOURCE-PORT DESTINATION-PORT 3 c57375dc c1ff1850 INET:STREAM 10.1.8.20-1023 10.1.16.62-513 crash> net -S 2517 PID: 2517 TASK: c1598000 CPU: 1 COMMAND: "rlogin" FD SOCKET SOCK 3 c57375dc c1ff1850 struct socket { state = SS_CONNECTED, flags = 131072, ops = 0xc023f820, inode = 0xc5737540, fasync_list = 0x0, file = 0xc58892b0, sk = 0xc1ff1850, wait = 0xc14d9ed4, type = 1, passcred = 0 '\000', tli = 0 '\000' } struct sock { sklist_next = 0xc1ff12f0, sklist_prev = 0xc216bc00, bind_next = 0x0, bind_pprev = 0xc0918448, daddr = 1041236234, rcv_saddr = 336068874, dport = 258, num = 1023, bound_dev_if = 0, next = 0x0, pprev = 0xc0286dd4, state = 1 '\001', zapped = 0 '\000', sport = 65283, family = 2, reuse = 0 '\000', ... Translate the rcv_saddr from above into dotted-decimal notation: crash> net -N 1041236234 10.1.16.62 From "foreach", find all tasks with references to socket c08ea3cc: crash> foreach net -s -R c08ea3cc PID: 2184 TASK: c7026000 CPU: 1 COMMAND: "klines.kss" FD SOCKET SOCK FAMILY:TYPE SOURCE-PORT DESTINATION-PORT 5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0-1026 0.0.0.0-0 PID: 2200 TASK: c670a000 CPU: 1 COMMAND: "kpanel" FD SOCKET SOCK FAMILY:TYPE SOURCE-PORT DESTINATION-PORT 5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0-1026 0.0.0.0-0 PID: 2201 TASK: c648a000 CPU: 1 COMMAND: "kbgndwm" FD SOCKET SOCK FAMILY:TYPE SOURCE-PORT DESTINATION-PORT 5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0-1026 0.0.0.0-0 PID: 19294 TASK: c250a000 CPU: 0 COMMAND: "prefdm" FD SOCKET SOCK FAMILY:TYPE SOURCE-PORT DESTINATION-PORT 5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0-1026 0.0.0.0-0 PID: 2194 TASK: c62dc000 CPU: 1 COMMAND: "kaudioserver" FD SOCKET SOCK FAMILY:TYPE SOURCE-PORT DESTINATION-PORT 5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0-1026 0.0.0.0-0 PID: 2195 TASK: c6684000 CPU: 1 COMMAND: "maudio" FD SOCKET SOCK FAMILY:TYPE SOURCE-PORT DESTINATION-PORT 5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0-1026 0.0.0.0-0 PID: 2196 TASK: c6b58000 CPU: 1 COMMAND: "kwmsound" FD SOCKET SOCK FAMILY:TYPE SOURCE-PORT DESTINATION-PORT 5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0-1026 0.0.0.0-0 PID: 2197 TASK: c6696000 CPU: 0 COMMAND: "kfm" FD SOCKET SOCK FAMILY:TYPE SOURCE-PORT DESTINATION-PORT 5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0-1026 0.0.0.0-0 PID: 2199 TASK: c65ec000 CPU: 0 COMMAND: "krootwm" FD SOCKET SOCK FAMILY:TYPE SOURCE-PORT DESTINATION-PORT 5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0-1026 0.0.0.0-0 PID: 694 TASK: c1942000 CPU: 0 COMMAND: "prefdm" FD SOCKET SOCK FAMILY:TYPE SOURCE-PORT DESTINATION-PORT 5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0-1026 0.0.0.0-0 PID: 698 TASK: c6a2c000 CPU: 1 COMMAND: "X" FD SOCKET SOCK FAMILY:TYPE SOURCE-PORT DESTINATION-PORT 5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0-1026 0.0.0.0-0 PID: 2159 TASK: c4a5a000 CPU: 1 COMMAND: "kwm" FD SOCKET SOCK FAMILY:TYPE SOURCE-PORT DESTINATION-PORT 5 c08ea3cc c50d3c80 INET:STREAM 0.0.0.0-1026 0.0.0.0-0