I use netstat to check the routing tables:

$ netstat -rn
Routing tables

Destination        Gateway            Flags        Refs      Use   Netif Expire
default           UGSc           20       16     en0
10.10.10/24        link#4             UCS             1        0     en0      link#4             UCS             1        0     en0         bc:67:1c:40:3:f6   UHLWIir        21       14     en0   1193    link#4             UCS             0        0     en0       a8:6b:ad:6b:c4:a5  UHLWI           0        0     en0    820
127                UCS             0        0     lo0          UH             54  2734893     lo0
169.254            link#4             UCS             0        0     en0
172.16.111/24      link#11            UC              1        0  vmnet1
192.168.220        link#12            UC              1        0  vmnet8
224.0.0/4          link#4             UmCS            2        0     en0        1:0:5e:0:0:fb      UHmLWI          0        0     en0    1:0:5e:7f:ff:fa    UHmLWI          0      784     en0 link#4             UCS             0        0     en0

But I have several questions about this:

  1. I do not understand the Flags, Refs, Use and Expire's meaning.
  2. You see the bc:67:1c:40:3:f6, so does this mean the IPv4 can divert to IPv6 address directly?
  3. Whats the link#4 and link#12 meaning in the Gateway field?
  4. What's the Expire field meaning?

1 Answer 1


This answer is a quick summary of what the fields mean in the routing table display of netstat. You can find all this information directly from the netstat man page (man netstat) or for an excellent primer, see FreeBSD's Handbook Chapter 31.2 - Gateways and Routes. (Apple's netstat is derived from the BSD version).


The flags field shows a collection of information about the route stored as binary choices. Following is extracted directly from the man page.

 1       RTF_PROTO1       Protocol specific routing flag #1
 2       RTF_PROTO2       Protocol specific routing flag #2
 3       RTF_PROTO3       Protocol specific routing flag #3
 B       RTF_BLACKHOLE    Just discard packets (during updates)
 b       RTF_BROADCAST    The route represents a broadcast address
 C       RTF_CLONING      Generate new routes on use
 c       RTF_PRCLONING    Protocol-specified generate new routes on use
 D       RTF_DYNAMIC      Created dynamically (by redirect)
 G       RTF_GATEWAY      Destination requires forwarding by intermediary
 H       RTF_HOST         Host entry (net otherwise)
 I       RTF_IFSCOPE      Route is associated with an interface scope
 i       RTF_IFREF        Route is holding a reference to the interface
 L       RTF_LLINFO       Valid protocol to link address translation
 M       RTF_MODIFIED     Modified dynamically (by redirect)
 m       RTF_MULTICAST    The route represents a multicast address
 R       RTF_REJECT       Host or net unreachable
 r       RTF_ROUTER       Host is a default router
 S       RTF_STATIC       Manually added
 U       RTF_UP           Route usable
 W       RTF_WASCLONED    Route was generated as a result of cloning
 X       RTF_XRESOLVE     External daemon translates proto to link address
 Y       RTF_PROXY        Proxying; cloned routes will not be scoped

So, looking at the first entry, the flags are UGSc meaning

  • U: RTF_UP - Route usable
  • G: RTF_GATEWAY - Destination requires forwarding by intermediary
  • S: RTF_STATIC - Route added manually
  • c: RTF_PRCLONING - Protocol-specified generate new routes on use

Refs, Use, & Expire

The refcnt field gives the current number of active uses of the route. Connection oriented protocols normally hold on to a single route for the duration of a connection while connectionless protocols obtain a route while sending to the same destination. The use field provides a count of the number of packets sent using that route.

Expire is a timeout - a period in which the host doesn't respond to that route.

MAC Address and Hardware Devices

The HEX address that you're seeing for the network (bc:67:1c:40:3:f6) is a MAC address, not a IPV6 address.

  • A MAC address is a 48-bit identifier specific to the hardware written in MM:MM:MM:SS:SS:SS The first three bytes (MM:MM:MM) identifies (assigned to) the hardware manufacturer and the second three bytes (SS:SS:SS) is assigned to the device by the manufacturer.

  • An IPV6 address is a 106-bit hexadecimal identifier written as 8 hexidecimal numbers separated by colons: Example: 2001:0000:3238:DFE1:0063:0000:0000:FEFB

The link#4 and link#12 refer to the network device (i.e. Ethernet Adapter, WiFi Adapter, VPN adapter, etc.).

  • so. the gateway can use MAC address to presentation?
    – aircraft
    Sep 19, 2018 at 13:50
  • I don't know what you mean by that.
    – Allan
    Sep 19, 2018 at 13:53
  • The Gateway has IP. MAC. and link
    – aircraft
    Sep 19, 2018 at 13:57
  • It needs ALL that information to route packets. For instance, if the destination subnet is on the LAN it needs the MAC address to forward that info to the switch. It also needs to know what interface it goes through/to. This is a good primer written in lay terms. You should review that.
    – Allan
    Sep 19, 2018 at 14:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .