.Dd 03/18/14
.Dt netlog 1
.Os Darwin
.\"---------
.Sh NAME
.\"---------
.Nm netlog
.Nd Log summary of every UDP and TCP socket when the socket is closed.
.\"---------
.Sh SYNOPSIS
.\"---------
.Nm
.Op Fl v
.Op Fl h
.Op Fl i Ar interval
.Op Fl I Ar iterations
.Op Fl t Ar type
.Op Fl m Ar mode
.Op Fl p Ar process-name|pid
.Op Fl c
.Op Fl N
.Op Fl Z
.\"---------
.Sh DESCRIPTION
.\"---------
The
.Nm
program logs a summary for each TCP, UDP and QUIC flow when the flow is
closed. A header is printed once. The row items are separated by spaces.
.br
Address to hostname lookups are not performed. The -Z option allows
flows that do not send or receive any data to not be listed.
.br
An experimental nettop style display may be requested via use of the -N option
as the first option on the command line.
.\"---------
.Sh OPTIONS
.\"---------
A list of flags and their descriptions:
.Bl -tag -width -indent
.It Fl v
Verbose output
.It Fl h
Print command line usage information and exit.
.It Fl i Ar interval
Report socket statistics periodically.
.It Fl I Ar iterations
Used in combination with
.Fl i ,
will make
.Nm
exit after the specified number of iterations.
.It Fl t Ar type
Specify the type of interface. By default, all interfaces will be monitored.
Multiple interface types may be specified.  The
following types are supported:
.Bl -tag -width -indent
.It Cm wifi
WiFi interfaces.
.It Cm wired
Wired interfaces.
.It Cm loopback
Loopback interfaces.
.It Cm awdl
Apple Wireless Direct Link interfaces.
.It Cm expensive
Interfaces marked as "expensive", for example via hotspot.
.It Cm undefined
Cases where the underlying socket or flow is not associated with an interface.
.It Cm external
The combination of all defined non-loopback interfaces.
.El
.It Fl m Ar mode
Specify the mode.  By default, all TCP, UDP and QUIC flows will be monitored.
.Bl -tag -width -indent
.It Cm tcp
Only TCP flows will be monitored.
.It Cm udp
Only UDP flows will be monitored.
.It Cm quic
Only QUIC flows will be monitored.
.It Cm conn
Instead of flows, NECP connections will be monitored.
.It Cm subflows
Only UDP sub-flows will be monitored.
.It Cm all
Instead of the default of all full flows, all flows plus sub-flows plus NECP connections will be monitored.
.El
.It Fl p Ar process-name|pid
Select a process for display.  A numeric argument identifies a process by its pid.
Alternatively a process name may be given, in which case all processes with that name will be displayed.
The name must be an exact match for the name displayed by netlog, which may require that the name be truncated,
for example launchd.develop instead of launchd.development.
This option may be repeated to select multiple processes.
.It Fl c
Print details in comma-separated values (CSV) form.
.It Fl N
Use the experimental curses output, in the general style of the nettop program.  This must be the first option.
Subsequent options are per nettop precedent rather than the ones defined here.  Use -N -h for online help.
.It Fl Z
Avoid printing details if there was no data transfer on the flow.
.El
.\"---------
.\" .Sh BUGS              \" Document known, unremedied bugs 
.\"---------
.\"---------
.\" .Sh HISTORY           \" Document history if command behaves in a unique manner
.\"---------