netlog(1) General Commands Manual netlog(1)

netlogLog summary of every UDP and TCP socket when the socket is closed.

netlog [-v] [-h] [-i interval] [-I iterations] [-t type] [-m mode] [-p process-name|pid] [-c] [-N] [-Z]

The netlog program logs a summary for each TCP, UDP and QUIC flow when the flow is closed. A header is printed once. The row items are separated by spaces.
Address to hostname lookups are not performed. The -Z option allows flows that do not send or receive any data to not be listed.
An experimental nettop style display may be requested via use of the -N option as the first option on the command line.

A list of flags and their descriptions:

Verbose output
Print command line usage information and exit.
interval
Report socket statistics periodically.
iterations
Used in combination with -i, will make netlog exit after the specified number of iterations.
type
Specify the type of interface. By default, all interfaces will be monitored. Multiple interface types may be specified. The following types are supported:
WiFi interfaces.
Wired interfaces.
Loopback interfaces.
Apple Wireless Direct Link interfaces.
Interfaces marked as "expensive", for example via hotspot.
Cases where the underlying socket or flow is not associated with an interface.
The combination of all defined non-loopback interfaces.
mode
Specify the mode. By default, all TCP, UDP and QUIC flows will be monitored.
Only TCP flows will be monitored.
Only UDP flows will be monitored.
Only QUIC flows will be monitored.
Instead of flows, NECP connections will be monitored.
Only UDP sub-flows will be monitored.
Instead of the default of all full flows, all flows plus sub-flows plus NECP connections will be monitored.
process-name|pid
Select a process for display. A numeric argument identifies a process by its pid. Alternatively a process name may be given, in which case all processes with that name will be displayed. The name must be an exact match for the name displayed by netlog, which may require that the name be truncated, for example launchd.develop instead of launchd.development. This option may be repeated to select multiple processes.
Print details in comma-separated values (CSV) form.
Use the experimental curses output, in the general style of the nettop program. This must be the first option. Subsequent options are per nettop precedent rather than the ones defined here. Use -N -h for online help.
Avoid printing details if there was no data transfer on the flow.
03/18/14 Darwin