Netstat COnn/-c report
Displays the information about each active TCP connection and UDP socket. COnn/-c is the default parameter.
TSO syntax
Modifier
Target
Provide the report for a specific TCP/IP address space by using TCp tcpname. See The Netstat command target for more information about the TCp parameter.
Output
The default output option displays the output on the user's terminal. For other options, see The TSO NETSTAT command syntax or Netstat command output.
Filter
>>-+-APPLD--appldata------------------------------+------------>< | .----------------. | | V | | +-CLIent------clientname---+-------------------+ +-HOSTName--hostname---------------------------+ | .-----------------------. | | V | | +-IPAddr----+-ipaddr------------+-+------------+ | +-ipaddr/prefixLen--+ | | '-ipaddr/subnetmask-' | | .----------------. | | V | | +-IPPort----ipaddr+portnum-+-------------------+ +-NOTN3270-------------------------------------+ | .-------------. | | V | | +-POrt------portnum---+------------------------+ +-SMCID--+-smcid-+-----------------------------+ | '-*-----' | '-CONNType--+-NOTTLSPolicy-------------------+-' '-TTLSPolicy--+----------------+-' +-CURRent--------+ +-GRoup--groupid-+ '-STALE----------'
z/OS UNIX syntax
Modifier
Target
Provide the report for a specific TCP/IP address space by using -p tcpname. See The Netstat command target for more information about the TCp parameter.
Output
The default output option displays the output to z/OS UNIX shell stdout. For other options, see The z/OS UNIX netstat command syntax or Netstat command output.
Filter
Filter description
- APPLD/-G appldata
- Filter the output of the COnn/-c report using the specified application data appldata. You can enter one filter value at a time; the specified value can be up to 40 characters in length.
- CLIent/-E clientname
- Filter the output of the COnn/-c report using the specified client name clientname. You can enter up to six filter values; each specified value can be up to eight characters in length.
- HOSTName/-H hostname
- Filter the output of the COnn/-c report using the specified host name hostname. You can enter one filter value at a time; the specified value can be up to 255 characters in length.
Result: At the end of the report, Netstat displays the host name that the resolver used for the resolution and the list of IP addresses returned from the resolver which it used as filters.
Restrictions:
- The HOSTName/-H filter does not support wildcard characters.
- Using HOSTName/-H filter might cause delays in the output due to resolution of the hostname value depending on the resolver and DNS configuration.
- IPAddr/-I ipaddripaddr/prefixlengthipaddr/subnetmask
- Filter the report output using the specified IP address ipaddr, ipaddr/prefixlength,
or ipaddr/subnetmask. You can enter up to
six filter values; each specified IPv4 ipaddr value
can be up to 15 characters in length.
- ipaddr
- Filter the output of the COnn/-c report using the specified IP address ipaddr. For IPv4 addresses, the default subnet mask of 255.255.255.255 is used. For IPv6 addresses, the default prefixlength value of 128 is used.
- ipaddr/prefixlength
- Filter the output of the COnn/-c report using the specified IP address and prefix length ipaddr/prefixlength. For a IPv4 address, the prefix length range is 1 – 32. For an IPv6 address, the prefix length range is 1 – 128.
- ipaddr/subnetmask
- Filter the output of the COnn/-c report
using the specified IP address and subnet mask ipaddr/subnetmask.
The IP address ipaddr in this format must
be IPv4 IP address. Guidelines:
- The filter value ipaddr can be either the local or remote IP address.
- For an IPv6 enabled stack:
- Both IPv4 and IPv6 ipaddr values are accepted and can be mixed on the IPAddr/-I option.
- An IPv4-mapped IPv6 address is accepted as a valid ipaddr value and usually provides the same result as its IPv4 address does.
Restrictions:- The filter value for an IPv6 address does not support wildcard characters.
- For an IPv4-only stack, only IPv4 ipaddr values are accepted.
- For a UDP endpoint socket, the filter value applies only to the local or source IP address.
- IPPort/-B ipaddr+portnum
- Filter the report output of the COnn/-c report
using the specified IP address and port number. You can enter up to
six filter values. Each specified IPv4 ipaddr value
can be up to 15 characters in length, denoting a single IPv4 IP address;
each specified IPv6 ipaddr value can be
up to 45 characters in length, denoting a single IPv6 IP address.
Valid portnum values are in the range 0 –
65535. The filter values ipaddr and portnum will
match any combination of the local and remote IP address and local
and remote port. Guidelines:
- The filter value ipaddr can be either the local or remote IP address.
- For an IPv6-enabled stack, the following apply:
- Both IPv4 and IPv6 ipaddr values are accepted and can be mixed on the IPPort/-B option.
- An IPv4-mapped IPv6 address is accepted as a valid ipaddr value and usually provides the same result as the IPv4 address.
Restrictions:- The ipaddr value in the IPPort/-B filter does not support wildcard characters.
- For an IPv4-only stack, only IPv4 ipaddr values are accepted.
- An entry is returned only when both the ipaddr and portnum values match.
- For a UDP endpoint socket, the filter value applies only to the local or source IP address and port.
- NOTN3270/-T
- Filter the output of the COnn/-c report excluding TN3270 server connections.
- POrt/-P portnum
- Filter the output of the COnn/-c report
using the specified port number portnum.
You can enter up to six filter values.Guideline: The port number can be either a local or remote port.Restriction: For a UDP endpoint socket, the filter value applies only to the local or source port.
- SMCID/-U smcid
- Filter the output of the COnn/-c report by using the specified Shared Memory Communications over Remote Direct Memory Access (SMC-R) link or link group identifier smcid. If an asterisk (*) is specified for the filter value, Netstat provides output only for entries that are associated with SMC-R links, and link groups. You can enter one filter value at a time.
- CONNType/-X
- Filter the report using the specified connection type. You can
enter one filter value at a time.
- NOTTLSPolicy
- Filter the output of the COnn/-c report,
displaying only connections that have not been matched to an Application
Transparent Transport Layer Security (AT-TLS) rule. This includes
connections that were established while the AT-TLS function was disabled
(NOTTLS was specified on the TCPCONFIG statement or in effect by default)
and all connections that do not use the TCP protocol. For TCP connections
that were established while the AT-TLS function was enabled, this
includes:
- Connections for which AT-TLS policy lookup has not yet occurred (typically the first send or receive has not been issued yet)
- Connections for which AT-TLS policy lookup has occurred but no matching rule was found
- TTLSPolicy
- Filter the output of the COnn/-c report,
displaying only connections that match an Application Transparent
Transport Layer Security (AT-TLS) rule. This includes only connections
that were established while the AT-TLS function was enabled, for which
an AT-TLS policy rule was found with either TTLSEnabled ON or TTLSEnabled
OFF specified in the TTLSGroupAction. Responses can be further
limited on AT-TLS connection type. AT-TLS connection type has the
following values:
- CURRent
- Display only connections that are using AT-TLS where the rule and all actions are still available to be used for new connections.
- GRoup groupid
- Display only connections that are using the AT-TLS group that is specified by the groupid value. The specified groupid value is a number that is assigned by the TCP/IP stack that uniquely identifies an AT-TLS group. You can determine the groupid value from the GroupID field value that is displayed in the Netstat TTLS/-x GROUP report.
- STALE
- Display only connections that are using AT-TLS where the rule or at least one action is no longer available to be used for new connections.
The filter value for CLIent/-E, IPAddr/-I, and APPLD/-G can be a complete string or a partial string using wildcard characters. A wildcard character can be an asterisk (*), which matches a null string or any character or character string, at the same position. A wildcard character can be a question mark (?), which matches any single character at the same position. For example, a string "searchee" matches with "*ar?he*", but the string "searhee" does not match with "*ar?he*". If you want to use the wildcard character on the IPAddr/-I filter, you must specify the value in the ipaddr format. The wildcard character is not accepted for the ipaddr/prefixlen or ipaddr/subnetmask format of IPAddr/-I values.
When you use z/OS UNIX netstat/onetstat command in a z/OS UNIX shell environment, take care if you use a z/OS UNIX MVS™ special character in a character string. It might cause an unpredictable result. To be safe, if you want to use a z/OS UNIX MVS special character in a character string, surround the character string with single (') or double (") quotation marks. For example, to use an asterisk (*) in the IP address, 10.*.0.0 for the -I filter, issue the command as: netstat -c -I '10.*.0.0' or netstat -c -I "10.*.0.0".
Command syntax examples
From TSO environment
NETSTAT CONN
Display information for all active TCP connections and UDP sockets in the default TCP/IP
stack.
NETSTAT CONN TCP TCPCS6
Display information for all active TCP connections and UDP sockets in TCPCS6 stack.
NETSTAT CONN TCP TCPCS8 (IPADDR 9.43.1.1 9.43.2.2
Display information for these active TCP connections and UDP sockets in TCPCS8 stack
whose local or remote IP addresses match the specified filter IP address values.
NETSTAT CONN (PORT 2222 6666 88
Display information for those active TCP connections and UDP sockets in the default
TCP/IP stack whose local or remote ports match the specified filter port numbers.From UNIX shell environment
netstat -c
netstat -c -p tcpcs6
netstat -c -p tcpcs6 -I 9.43.1.1 9.43.2.2
netstat -c -P 2222 6666 88Report examples
The following examples are generated by using TSO NETSTAT command. Using the z/OS UNIX netstat command displays the data in the same format as the TSO NETSTAT command.
Not IPv6 enabled (SHORT format)
NETSTAT CONN
MVS TCP/IP NETSTAT CS V2R1 TCPIP NAME: TCPCS 17:40:36
User Id Conn Local Socket Foreign Socket State
------- ---- ------------ -------------- -----
FTPD1 0000003B 0.0.0.0..21 0.0.0.0..0 Listen
FTPD1 0000003D 9.37.65.146..21 9.67.115.5..1026 Establsh
FTPD1 0000003F 9.37.65.146..21 9.27.13.21..3711 Establsh
TCPCS 0000000F 0.0.0.0..23 0.0.0.0..0 Listen
TCPCS 0000000C 9.67.115.5..23 9.27.11.182..4886 Establsh
APPV4 00000015 0.0.0.0..2049 9.42.103.99..1234 UDP
SYSLOGD1 00000010 0.0.0.0..514 *..* UDP IPv6 enabled or request for LONG format
NETSTAT CONN
MVS TCP/IP NETSTAT CS V2R1 TCPIP NAME: TCPCS 17:40:36
User Id Conn State
------- ---- -----
FTPD1 0000004A Listen
Local Socket: ::..21
Foreign Socket: ::..0
FTPD1 00000052 Establsh
Local Socket: ::ffff:9.67.115.5..21
Foreign Socket: ::ffff:9.67.115.65..1026
FTPD1 00000058 Establsh
Local Socket: 2001:0db8::9:67:115:66..21
Foreign Socket: 2001:0db8::9:67:115:65..1027
TCPCS 0000001A Listen
Local Socket: 0.0.0.0..23
Foreign Socket: 0.0.0.0..0
TCPCS 0000001E Establsh
Local Socket: 9.67.115.5..23
Foreign Socket: 9.27.11.182..4665
USER3 0000005F Establsh
Local Socket: 2001:0db8::9:67:115:5..1079
Foreign Socket: 2001:0db8::9:67:115:65..21
USER6 000000C7 Establsh
Local Socket: 9.67.115.5..1027
Foreign Socket: 9.37.65.146..21
APPM 00000017 UDP
Local Socket: ::ffff.0.0.0.0..2051
Foreign Socket: ::ffff.9.42.103.99..1234
APPV4 00000015 UDP
Local Socket: 0.0.0.0..2049
Foreign Socket: 9.42.103.99..1234
SYSLOGD1 0000002C UDP
Local Socket: 0.0.0.0..529
Foreign Socket: *..* Report field descriptions
- User Id
- See the Client name or User ID information in Netstat report general concept for a detailed description.
- Conn
- See the Client ID or Connection Number information in Netstat report general concept for a detailed description.
- Local Socket
- See the Local Socket information in Netstat report general concept for a detailed description.
- Foreign Socket
- See the Foreign Socket information in Netstat report general concept for a detailed description.
- State
- See the TCP connection status and UDP socket status information in Netstat report general concept for a detailed description.
- Application Data
- The application data that makes it easy for you to locate and display the connections that are used by the application. The beginning of the application data identifies the format of the application data area. For z/OS® Communications Server applications, see application data in the z/OS Communications Server: IP Programmer's Guide and Reference for a description of the format, content, and meaning of the data that is supplied by the application. For other applications, see the documentation that is supplied by the application. The data is displayed in character format if application data is present. Non-printable characters, if any, are displayed as dots.