---
name: "rwhod"
section: "8"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["linux", "freebsd"]
url: "https://new.carta.tech/rwhod"
---

# rwhod(8)

system status server

## NAME

**rwhod** – system status server

## SYNOPSIS

**rwhod** \[**-i**\] \[**-p**\] \[**-l**\] \[**-m** \[*ttl*\]\]

## DESCRIPTION

The **rwhod** utility is the server which maintains the database used by the [rwho(1)](/rwho/1.md) and [ruptime(1)](/ruptime/1.md) programs. Its operation is predicated on the ability to *broadcast* or *multicast* messages on a network.

The **rwhod** utility operates as both a producer and consumer of status information, unless the **-l** (listen mode) option is specified, in which case it acts as a consumer only. As a producer of information it periodically queries the state of the system and constructs status messages which are broadcasted or multicasted on a network. As a consumer of information, it listens for other **rwhod** servers' status messages, validating them, then recording them in a collection of files located in the directory */var/rwho*.

The following options are available:

- **-i**

  Enable insecure mode, which causes **rwhod** to ignore the source port on incoming packets.

- **-p**

  Ignore all POINTOPOINT interfaces. This is useful if you do not wish to keep dial on demand interfaces permanently active.

- **-l**

  Enable listen mode, which causes **rwhod** to not broadcast any information. This allows you to monitor other machines' **rwhod** information, without broadcasting your own.

- **-m** \[*ttl*\]

  Cause **rwhod** to use IP multicast (instead of broadcast) on all interfaces that have the IFF\_MULTICAST flag set in their "ifnet" structs (excluding the loopback interface). The multicast reports are sent with a time-to-live of 1, to prevent forwarding beyond the directly-connected subnet(s).

  If the optional *ttl* argument is supplied with the **-m** flag, **rwhod** will send IP multicast datagrams with a time-to-live of *ttl*, via a SINGLE interface rather than all interfaces. *ttl* must be between 0 and 32 (or MAX\_MULTICAST\_SCOPE). Note that **-m** *1* is different from **-m**, in that **-m** *1* specifies transmission on one interface only.

  When **-m** is used without a *ttl* argument, the program accepts multicast **rwhod** reports from all multicast-capable interfaces. If a *ttl* argument is given, it accepts multicast reports from only one interface, the one on which reports are sent (which may be controlled via the host's routing table). Regardless of the **-m** option, the program accepts broadcast or unicast reports from all interfaces. Thus, this program will hear the reports of old, non-multicasting **rwhod**s, but, if multicasting is used, those old **rwhod**s will not hear the reports generated by this program.

The server transmits and receives messages at the port indicated in the \`\`who'' service specification; see [services(5)](/services/5.md). The messages sent and received, are of the form:

```
struct	outmp {
	char	out_line[8];		/* tty name */
	char	out_name[8];		/* user id */
	long	out_time;		/* time on */
};
struct	whod {
	char	wd_vers;
	char	wd_type;
	char	wd_fill[2];
	int	wd_sendtime;
	int	wd_recvtime;
	char	wd_hostname[32];
	int	wd_loadav[3];
	int	wd_boottime;
	struct	whoent {
		struct	outmp we_utmp;
		int	we_idle;
	} wd_we[1024 / sizeof (struct whoent)];
};
```

All fields are converted to network byte order prior to transmission. The load averages are as calculated by the [w(1)](/w/1.md) program, and represent load averages over the 5, 10, and 15 minute intervals prior to a server's transmission; they are multiplied by 100 for representation in an integer. The host name included is that returned by the [gethostname(3)](/gethostname/3.md) system call, with any trailing domain name omitted. The array at the end of the message contains information about the users logged in to the sending machine. This information includes the contents of the entry from the user accounting database for each non-idle terminal line and a value indicating the time in seconds since a character was last received on the terminal line.

Messages received by the **rwho** server are discarded unless they originated at an **rwho** server's port or the **-i** option was specified. In addition, if the host's name, as specified in the message, contains any unprintable ASCII characters, the message is discarded. Valid messages received by **rwhod** are placed in files named *whod.hostname* in the directory */var/rwho*. These files contain only the most recent message, in the format described above.

Status messages are generated approximately once every 3 minutes.

## SEE ALSO

[ruptime(1)](/ruptime/1.md), [rwho(1)](/rwho/1.md)

## HISTORY

The **rwhod** utility appeared in 4.2BSD.

## BUGS

Status information should be sent only upon request rather than continuously. People often interpret the server dying or network communication failures as a machine going down.