/flags/wireguard/wg-show-dump
wg show wg0 dump: tab-separated WireGuard status for scripts and monitoring
- tool
- WireGuard
- command
- wg show
- flag
- dump
- default
- without a field argument, wg show prints a human-readable report meant for the terminal
sudo wg show wg0 dump prints the configuration and runtime state of a WireGuard interface in a tab-separated, script-friendly format instead of the indented report of plain wg show. According to wg(8), the first line contains the interface's private key, public key, listen port and fwmark, and each following line describes one peer: public key, preshared key, endpoint, allowed IPs, latest handshake, bytes received, bytes sent and persistent keepalive. That makes it the basis for monitoring scripts, Prometheus exporters and health checks.
Columns
| Line | Fields in order (tab-separated) |
|---|---|
| First line (interface) | private-key, public-key, listen-port, fwmark |
| Each peer line | public-key, preshared-key, endpoint, allowed-ips, latest-handshake, transfer-rx, transfer-tx, persistent-keepalive |
| With wg show all dump | Every line starts with the interface name as an extra first field |
latest-handshake is a Unix timestamp in seconds (0 if there was none), the transfer counters are bytes, and allowed-ips is a comma-separated list.
Useful one-liners
sudo wg show wg0 dump | tail -n +2 | cut -f1,3,5 # peer key, endpoint, last handshake
sudo wg show wg0 latest-handshakes # only key and timestamp per peer
now=$(date +%s); sudo wg show wg0 latest-handshakes | \
awk -v now="$now" '{ age = ($2 == 0) ? "never" : now - $2 "s ago"; print $1, age }'
sudo wg show all dump | awk -F'\t' 'NF == 9 { rx += $7; tx += $8 } END { print rx, tx }' # total bytesThe last command relies on the extra interface column of all dump: peer lines then have nine fields, interface lines five.
Other script-friendly fields
Instead of dump, wg show INTERFACE FIELD prints one kind of information per line:
| Field | Prints |
|---|---|
| public-key / private-key | The interface keys |
| listen-port / fwmark | Interface settings |
| peers | Public keys of all peers |
| endpoints | Peer key and current endpoint IP:port |
| allowed-ips | Peer key and its allowed IP ranges |
| latest-handshakes | Peer key and the last handshake timestamp |
| transfer | Peer key, bytes received, bytes sent |
| persistent-keepalive | Peer key and keepalive interval |
| preshared-keys | Peer key and preshared key |
wg show interfaces lists the names of all WireGuard interfaces, and wg showconf wg0 prints the running configuration in configuration-file format.
Reading the result
A handshake happens at least every two minutes while traffic flows, so an old latest-handshake with recent traffic expectations points to connectivity problems: wrong endpoint, a firewall, or NAT mappings that expire, which PersistentKeepalive addresses. A peer whose traffic does not arrive although handshakes are fresh usually has the wrong AllowedIPs. The human-readable view is described in check WireGuard status with wg show.
FAQ
How do I find peers that have not connected recently?
Use wg show wg0 latest-handshakes, which prints the public key and a Unix timestamp per peer (0 means never). Compare it with date +%s; a handshake older than a few minutes on an active peer means the tunnel is down.
Does wg show dump print the private key?
Yes, the first line contains the interface private key, and peer lines include preshared keys. Run it as root only and never send the raw output to logs or monitoring systems; select the columns you need instead.
Why does the dump show (none) or 0 in some fields?
Fields that are not set are printed as (none), such as a missing preshared key or endpoint, and numeric fields such as latest-handshake and persistent-keepalive are 0 or off when unused.