TCP/IP Configuration Commands for UNIX/Linux, MacOS X, Windows, and Cisco IOS

The following commands will report the TCP/IP configuration on Unix, MacOS X, Windows, and Cisco operating systems. By "Unix" I mean anything vaguely Unix-like — Solaris, Linux, BSD, Tru64, AIX, IRIX, HP-UX, etc., plus MacOS X.

Note that the Cisco IOS allows for command abbreviation. That is, instead of:
router> show interfaces
you could simply type:
router> sh in
However, I prefer to use the entire command, using the tab key for command completion. You type just sh and then press <tab>:
router> sh<tab>
and the system finishes the command itself:
router> show
At that point you could press ? to see what alternatives are available (in the case of the show command, quite a few!), and then type enough of the parameter to be unambiguous:
router> show in<tab>
and it finishes the parameter for you:
router> show interfaces
Only two more key presses and you get a clear explanation of what it's doing. More importantly, your typing errors become much more obvious!


LAN Information (OSI Layer 1 and 2)


Display the interface statistics (packets received and sent, errors, collisions, maybe the rate of packets or bytes per second, maybe the MAC addresses)

Unix and MacOS X netstat -i
Linux% netstat -i
Kernel Interface table
Iface  MTU Met    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0  1500   0 46249635      0      0      0 46076591      0      0      3 BMRU
eth1  1500   0   780201      2      2      2   774526      0      0      8 BMRU
lo   16436   0   755482      0      0      0   755482      0      0      0 LRU

BSD and MacOS X, adding -n to leave addresses numeric. Following example from an OpenBSD laptop:
lo0 = Loopback pseudo-device
sis0 = Ethernet
enc0 = Encapsulation pseudo-device
BSD/MacOS% netstat -i -n
Name    Mtu   Network     Address              Ipkts Ierrs    Opkts Oerrs Colls
lo0     33208 <Link>                              12     0       12     0     0
lo0     33208 127/8       127.0.0.1               12     0       12     0     0
lo0     33208 ::1/128     ::1                     12     0       12     0     0
lo0     33208 fe80::%lo0/ fe80::1%lo0             12     0       12     0     0
sis0    1500  <Link>      00:11:43:44:8a:9b     1522     0      899     0     0
sis0    1500  fe80::%sis0 fe80::211:43ff:fe     1522     0      899     0     0
sis0    1500  10.1.1/24   10.1.1.230            1522     0      899     0     0
enc0*   1536  <Link>                               0     0        0     0     0
Windows netstat -e
C:\>netstat -e
Interface Statistics
                      Received        Sent
Bytes                  1160647      105766
Unicast packets            858         200
Non-unicast packets         70          45
Discards                     0           0
Errors                       0           0
Unknown protocols            0 
Cisco show interfaces
router> show interfaces ethernet 0
Ethernet0 is up, line protocol is up
  Hardware is Lance, address is 0000.0c8e.b534 (bia 0000.0c8e.b534)
  Internet address is 10.1.1.254/24
  MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec, rely 255/255, load 2/255
  Encapsulation ARPA, loopback not set, keepalive set (10 sec)
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:00, output 00:00:00, output hang never
  Last clearing of "show interface" counters never
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 1/75, 0 drops
  5 minute input rate 108000 bits/sec, 18 packets/sec
  5 minute output rate 107000 bits/sec, 18 packets/sec
     6080 packets input, 4156592 bytes, 0 no buffer
     Received 869 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     0 input packets with dribble condition detected
     5858 packets output, 4036087 bytes, 0 underruns
     0 output errors, 0 collisions, 10 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out

Display the interface media settings and options (RJ-45 vs AUI interface, media speed and duplex settings, MTU, etc)

Linux ethtool interface-name-here
Linux# ethtool eth0
Settings for eth0:
        Supported ports: [ TP MII ]
        Supported link modes:   10baseT/Half 10baseT/Full
                                100baseT/Half 100baseT/Full
        Supports auto-negotiation: Yes
        Advertised link modes:  10baseT/Half 10baseT/Full
                                100baseT/Half 100baseT/Full
        Advertised auto-negotiation: Yes
        Speed: 100Mb/s
        Duplex: Full
        Port: MII
        PHYAD: 32
        Transceiver: internal
        Auto-negotiation: on
        Supports Wake-on: pumbg
        Wake-on: d
        Current message level: 0x00000007 (7)
	Link detected: yes 
BSD and MacOS X ifconfig -m
BSD/MacOS% ifconfig -m sis0
sis0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        lladdr 00:11:43:44:8a:9b
        groups: egress
        media: Ethernet autoselect (100baseTX full-duplex)
        status: active
        supported media:
                media 10baseT
                media 10baseT mediaopt full-duplex
                media 100baseTX
                media 100baseTX mediaopt full-duplex
                media autoselect
        inet6 fe80::211:43ff:fe44:8a9b%sis0 prefixlen 64 scopeid 0x1
	inet 10.1.1.230 netmask 0xffffff00 broadcast 10.1.1.255 
Cisco show interfaces See above...

Display the ARP cache

Unix and MacOS X arp -a
% arp -a
somehost.example.com (192.168.12.230) at 00:11:43:44:8A:9B [ether] on eth0
otherhost.example.com (192.168.12.230) at 00:11:43:37:C2:21 [ether] on eth0
router.example.com (192.168.12.1) at 00:01:5C:24:85:02 [ether] on eth0
Windows arp -a
Cisco show arp

IP Information (OSI Layer 3)


Display the current IP configuration (IP address, netmask) for the interfaces

Unix and MacOS X ifconfig -a An example from a Linux system with two Ethernet interfaces, eth0 and eth1, the second of which has two virtual interface configurations:
% ifconfig -a
eth0      Link encap:Ethernet  HWaddr 00:11:95:1E:8E:B6
          inet addr:98.228.31.224  Bcast:255.255.255.255  Mask:255.255.248.0
          inet6 addr: fe80::211:95ff:fe1e:8eb6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:46932082 errors:0 dropped:0 overruns:0 frame:0
          TX packets:46814984 errors:0 dropped:0 overruns:8 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:809855308 (772.3 MiB)  TX bytes:2776351401 (2.5 GiB)
          Interrupt:21 Base address:0xa000

eth1      Link encap:Ethernet  HWaddr 00:0D:61:B1:86:53
          inet addr:10.1.1.100  Bcast:10.1.1.255  Mask:255.255.255.0
          inet6 addr: fe80::20d:61ff:feb1:8653/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:789491 errors:3 dropped:3 overruns:3 frame:0
          TX packets:785514 errors:0 dropped:0 overruns:15 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:234930278 (224.0 MiB)  TX bytes:342684110 (326.8 MiB)
          Interrupt:19 Base address:0x8000

eth1:0    Link encap:Ethernet  HWaddr 00:0D:61:B1:86:53
          inet addr:10.0.0.100  Bcast:10.0.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:19 Base address:0x8000

eth1:1    Link encap:Ethernet  HWaddr 00:0D:61:B1:86:53
          inet addr:10.1.0.254  Bcast:10.1.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:19 Base address:0x8000

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:760670 errors:0 dropped:0 overruns:0 frame:0
          TX packets:760670 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:676142037 (644.8 MiB)  TX bytes:676142037 (644.8 MiB)

sit0      Link encap:IPv6-in-IPv4
          NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
	  RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)
Windows ipconfig /all
C:\>ipconfig /all
Windows IP Configuration

        Host Name . . . . . . . . . . . . : WINXP
        Primary Dns Suffix  . . . . . . . :
        Node Type . . . . . . . . . . . . : Unknown
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : example.com

Ethernet adapter Local Area Connection:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : VMware Accelerated AMD PCNet Adapter
        Physical Address. . . . . . . . . : 00-0C-29-A4-AE-C9
        Dhcp Enabled. . . . . . . . . . . : No
        IP Address. . . . . . . . . . . . : 10.1.1.222
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 10.1.1.100
	DNS Servers . . . . . . . . . . . : 10.1.1.100 
Cisco show ip config
or
show running-config
or
show protocols
or
show interfaces
router> show protocols
Global values:
  Internet Protocol routing is enabled
Ethernet0 is up, line protocol is up
  Internet address is 10.1.1.254/24
Ethernet1 is up, line protocol is up
  Internet address is 192.168.1.254/24
Serial0 is administratively down, line protocol is down
Serial1 is administratively down, line protocol is down 

Display the current routing table

Unix and MacOS X netstat -nr Output from the same Linux machine with following IP addresses:
eth0    98.228.31.224/21
eth1    10.1.1.100/24
eth1:0  10.1.0.100/24
eth1:1  10.1.0.254/24

Linux% netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
10.0.0.0        0.0.0.0         255.255.255.0   U         0 0          0 eth1
10.1.1.0        0.0.0.0         255.255.255.0   U         0 0          0 eth1
98.228.24.0     0.0.0.0         255.255.248.0   U         0 0          0 eth0
10.1.0.0        0.0.0.0         255.255.0.0     U         0 0          0 eth1
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth1
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth0
0.0.0.0         98.228.24.1     0.0.0.0         UG        0 0          0 eth0
Flags:
U = Up
G = Gateway

Add -f inet to see IPv4 only on BSD and MacOS X, otherwise you see voluminous IPv6 routing information:
BSD/MacOS% netstat -nr
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use    Mtu  Interface
default            10.1.1.100         UGS         4      688      -   sis0
10.1.1/24          link#1             UC          1        0      -   sis0
10.1.1.100         00:0d:61:b1:86:53  UHLc        2      346      -   sis0
10.1.1.230         127.0.0.1          UGHS        0        0  33208   lo0
127/8              127.0.0.1          UGRS        0        0  33208   lo0
127.0.0.1          127.0.0.1          UH          2       12  33208   lo0
224/4              127.0.0.1          URS         0        0  33208   lo0 
Flags:
U = Up
G = Gateway
S = Static, e.g., default route added at boot time
H = Host-specific
C = Generate new (host-specific) routes on use
L = Valid link-layer (MAC) address
c = Cloned route
R = Reject route, known but unreachable route
Windows netstat -nr
C:\>netstat -nr
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x10003 ...00 0c 29 a4 ae c9 ...... AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       10.1.1.100      10.1.1.222	  10
         10.1.1.0    255.255.255.0       10.1.1.222      10.1.1.222	  10
       10.1.1.222  255.255.255.255        127.0.0.1       127.0.0.1	  10
   10.255.255.255  255.255.255.255       10.1.1.222      10.1.1.222	  10
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1	  1
        224.0.0.0        240.0.0.0       10.1.1.222      10.1.1.222	  10
  255.255.255.255  255.255.255.255       10.1.1.222      10.1.1.222	  1
Default Gateway:        10.1.1.100
===========================================================================
Persistent Routes:
  None

Route Table
Cisco show ip route
router> show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, * - candidate default
       U - per-user static route, o - ODR

Gateway of last resort is 10.1.1.100 to network 0.0.0.0

     10.0.0.0/24 is subnetted, 1 subnets
C       10.1.1.0 is directly connected, Ethernet0
C    192.168.1.0/24 is directly connected, Ethernet1
S*   0.0.0.0/0 [1/0] via 10.1.1.100

See the page "How Routing Works" for an explanation of IP routing and example output.


Use traceroute to trace the hop-by-hop route to a destination

Unix and MacOS X traceroute 195.242.3.1
Windows tracert 195.242.3.1
Cisco trace
You will then be asked to enter the target IP address.

The output will resemble something like the following, with one line per router along the way, and three probes to each router:

traceroute to www.private.peterlink.ru (195.242.3.1)
 1  cisco1-144                             (128.46.144.1)      3 ms   13 ms   12 ms
 2  cisco-tel-252.tcom.purdue.edu          (128.210.252.22)   30 ms   61 ms    2 ms
 3  Serial3-1-0.GW1.IND1.ALTER.NET         (157.130.101.105)   7 ms    9 ms    9 ms
 4  121.ATM2-0.XR1.CHI4.ALTER.NET          (146.188.208.170)  15 ms   14 ms   12 ms
 5  195.ATM1-0.TR1.CHI4.ALTER.NET          (146.188.208.210)  12 ms   22 ms   18 ms
 6  106.ATM7-0.TR1.NYC1.ALTER.NET          (146.188.136.150)  32 ms   34 ms   28 ms
 7  199.ATM7-0.XR1.NYC4.ALTER.NET          (146.188.179.21)   39 ms   36 ms   31 ms
 8  189.ATM3-0.GW8.NYC4.ALTER.NET          (146.188.180.49)   38 ms   31 ms   34 ms
 9  Telia-gw.customer.ALTER.NET            (157.130.5.74)     31 ms   34 ms   35 ms
10  ny-b1-atm3-0-101.usa.telia.net         (209.95.129.69)    38 ms   45 ms   57 ms
11  ov-i17-pos4-0-0-ix.stockholm.telia.net (194.17.0.189)    150 ms  121 ms  124 ms
12  ov-i8-atm1-0-1.telia.net               (194.17.1.106)    131 ms  137 ms  144 ms
13  194.17.1.14                            (194.17.1.14)     142 ms    *     157 ms
14  194.17.1.6                             (194.17.1.6)        *     148 ms  169 ms
15  www.private.peterlink.ru               (195.242.3.1)     167 ms  149 ms  149 ms
^   ^                                       ^                 ^       ^       ^
|   |                                       |                 |       |       |
|   |                                       |               round-trip times for
|   |                                       |               1st, 2nd, 3rd probes
|   |                                       |               ("*" means the probe
|   |                                       |                did not return)
|   |                                       |
|   |                           IP address of router N hops away
|   |
|  Hostname of router N hops away (or just IP address
|  if they don't have PTR records set up correctly)
|
This line is reporting the router N hops away
		

UDP/TCP Information (OSI Layer 4)


Display all TCP connections and listening ports

Unix and MacOS X netstat -a
Note — check the manual page for your version of netstat to find the option to only show TCP/IP and leave out the possibly voluminous UNIX domain socket information. It's probably -f inet or -A inet, and -f inet6 or -A inet6 if you're running IPv6.
Windows netstat -a
Cisco show tcp

General Information


Display TCP/IP statistics (or counters)

Unix and MacOS X netstat -s
Windows netstat -s
Cisco show interfaces
show ip traffic

Home Page Unix/Linux TCP/IP Infosec Travel Radio Site Map Contact
Use /bin/vi! Manipulate images with ImageMagick! Hosted on OpenBSD
Hosted on Apache Valid XHTML 1.1! Valid CSS!
© Bob Cromwell Nov 2008. Created with /bin/vi and ImageMagick, hosted on OpenBSD with Apache.    Root password available here