Understanding Flags, Refs, Use, Expire in Routing Table

Robert Jesacher jessy at sicha.net
Fri Mar 28 08:56:06 PDT 2008

Hi Daniel,

you find mostl of you questions answered in "man netstat" (the  
relevant passage is posted below)
The missing part is the expiry, which IMHO are the seconds, the ARP  
entry is valid (after this time a new arp request would be issued)

I hope this is the information you needed.


The routing table display indicates the available routes and their sta-
      tus.  Each route consists of a destination host or network, and  
a gateway
      to use in forwarding packets.  The flags field shows a  
collection of
      information about the route stored as binary choices.  The  
      flags are discussed in more detail in the route(8) and route(4)  
      pages.  The mapping between letters and flags is:

      1    RTF_PROTO1       Protocol specific routing flag #1
      2    RTF_PROTO2       Protocol specific routing flag #2
      3    RTF_PROTO3       Protocol specific routing flag #3
      B    RTF_BLACKHOLE    Just discard pkts (during updates)
      b    RTF_BROADCAST    The route represents a broadcast address
      C    RTF_CLONING      Generate new routes on use
      c    RTF_PRCLONING    Protocol-specified generate new routes on  
      D    RTF_DYNAMIC      Created dynamically (by redirect)
      G    RTF_GATEWAY      Destination requires forwarding by  
      H    RTF_HOST         Host entry (net otherwise)
      L    RTF_LLINFO       Valid protocol to link address translation
      M    RTF_MODIFIED     Modified dynamically (by redirect)
      R    RTF_REJECT       Host or net unreachable
      S    RTF_STATIC       Manually added
      U    RTF_UP           Route usable
      W    RTF_WASCLONED    Route was generated as a result of cloning
      X    RTF_XRESOLVE     External daemon translates proto to link  

      Direct routes are created for each interface attached to the  
local host;
      the gateway field for such entries shows the address of the  
      interface.  The refcnt field gives the current number of active  
uses of
      the route.  Connection oriented protocols normally hold on to a  
      route for the duration of a connection while connectionless  
      obtain a route while sending to the same destination.  The use  
field pro-
      vides a count of the number of packets sent using that route.   
The inter-
      face entry indicates the network interface utilized for the route.

On 28.03.2008, at 00:39, Daniel Dias Gonçalves wrote:

> I would like an explanation on each field it command "netstat - rn",  
> example:
> Flags,Refs,Use,Expire
> In Flags: UGS, UC, UHLW, UH
> Somebody can explain me ?
> Thanks,
> Daniel
> _______________________________________________
> freebsd-questions at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to "freebsd-questions-unsubscribe at freebsd.org 
> "

More information about the freebsd-questions mailing list