ip

@amitmund September 11, 2026

Linux ip — Complete Learning Notes & Output Guide

ip is the foundational networking utility from the iproute2 suite that configures, inspects, and manages network interfaces, IP addresses, routing tables, policy routing rules, ARP/neighbor tables, and network namespaces. It operates directly over the Linux kernel's high-speed Netlink (rtnetlink) socket interface, fully replacing the legacy net-tools utilities (ifconfig, route, arp, vconfig).

1. What is ip?

ip is an object-oriented command-line manager for the Linux kernel network stack.

Unlike legacy tools that make slow, synchronous ioctl() system calls to query interface states, ip communicates via AF_NETLINK sockets. This allows user space to send asynchronous, atomic batch requests and receive structured kernel netlink messages (RTM_*) without kernel string conversions.

It answers critical operational questions:

  • What is the administrative and physical link state of an adapter (UP, DOWN, LOWER_UP)?
  • What IPv4 and IPv6 addresses are bound to an interface, and what are their valid/preferred lifetimes?
  • Which routing table and next-hop gateway will handle traffic destined for an arbitrary IP?
  • Is an IP unreachable due to an unresolved ARP or IPv6 Neighbor Discovery state (FAILED, INCOMPLETE)?
  • How are container network namespaces (netns) and virtual Ethernet pairs (veth) wired together?

2. Installation & Availability

ip is part of the core iproute2 package and is installed by default on virtually all modern Linux distributions.

# Check version
ip -V

If missing on minimal container base images:

# Debian / Ubuntu
sudo apt update && sudo apt install iproute2

# RHEL / Rocky / AlmaLinux / CentOS
sudo dnf install iproute2

# Arch Linux
sudo pacman -S iproute2

3. Object-Verb Architecture & Global Flags

ip commands are structured symmetrically as:

ip [options] <OBJECT> <COMMAND> [arguments]

Core Objects

Object Shortcut Operational Purpose Legacy Equivalent
link l Manages Layer 2 network devices, MACs, MTUs, and flags. ifconfig eth0 up/down, vconfig
address a Manages Layer 3 IPv4 and IPv6 addresses. ifconfig eth0 <ip>
route r Manages the IP routing table and gateway routes. route -n, netstat -r
neighbor n Manages Layer 2 ARP (IPv4) and NDP (IPv6) neighbor caches. arp -n
rule ru Manages the Policy Routing Database (RPDB / source-based routing). (No legacy equivalent)
netns netns Manages network namespaces for containers and isolation. (No legacy equivalent)

Global Options

  • **-c / -color**: Enables syntax highlighting (green for UP, red for DOWN).
  • **-br / -brief**: Formats output as a compact, one-line summary table.
  • **-s / -stats**: Displays packet throughput, errors, and drop statistics.
  • **-j / -json**: Emits raw machine-readable JSON output.
  • **-p / -pretty**: Pretty-prints formatted JSON output.
  • **-4 / -6**: Restricts queries strictly to IPv4 or IPv6.

4. Deep-Dive: ip link (Layer 2 Interfaces)

ip link inspects and modifies physical and virtual network adapters without assigning IP addresses.

ip -s link show eth0

Raw Output Example

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
    link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
    RX:  bytes packets errors dropped missed mcast   
    4512045210 3210452      0       0      0  1420 
    TX:  bytes packets errors dropped carrier collsns 
    1845120410 1845120      0       0       0       0

Breakdown of Fields

+---+------+----------------------------------+----------+----------+----------+-----------+
| # | Name | Link Flags                       | MTU      | Qdisc    | State    | Qlen      |
+---+------+----------------------------------+----------+----------+----------+-----------+
| 2 | eth0 | <BROADCAST,MULTICAST,UP,LOWER_UP>| mtu 1500 | qdisc mq | state UP | qlen 1000 |
+---+------+----------------------------------+----------+----------+----------+-----------+
  • 2:: The ifindex (Kernel interface index). An integer identifier assigned to this interface by the kernel.
  • eth0: The interface name.
  • Link Flags (<BROADCAST,MULTICAST,UP,LOWER_UP>):
  • UP: Administrative state. The interface has been brought up administratively (ip link set eth0 up).
  • LOWER_UP: Physical link / carrier state. The physical transceiver has locked onto a carrier signal (the cable is plugged into a live switch port).
  • BROADCAST: The interface supports L2 broadcast frames.
  • MULTICAST: The interface supports L2 multicast frames.
  • PROMISC: Promiscuous mode enabled (e.g., during packet capture with tcpdump).

  • NO-CARRIER: Administrative state is up, but no physical signal is detected.

  • mtu 1500: Maximum Transmission Unit in bytes (standard Ethernet = 1500, Jumbo frames = 9000).

  • qdisc mq: Active queuing discipline managing egress buffers (mq, fq_codel, pfifo_fast, noqueue).
  • state UP: Operational link state:
  • UP: Interface is active and ready to transmit data.
  • DOWN: Interface is administratively offline or unlinked.

  • UNKNOWN: Typical for loopback (lo) or virtual devices that do not report physical carrier state.

  • qlen 1000: Length of the transmit packet queue (in packets).

  • link/ether 52:54:00:12:34:56: Physical hardware MAC address of the device.
  • brd ff:ff:ff:ff:ff:ff: Broadcast MAC address.

Statistical Counters (-s)

  • RX/TX bytes & packets: Total payload data and frames processed since boot.
  • RX errors / TX errors: Corrupted frames, CRC errors, or frame alignment faults.
  • RX dropped: Packets dropped because system kernel ring buffers or netdev_max_backlog queues were full.
  • carrier: Cable disconnects or physical link flaps detected by the physical layer.
  • collsns: Ethernet collisions (should be strictly 0 on modern full-duplex links).

5. Deep-Dive: ip address (Layer 3 Addressing)

ip address manages protocol addresses assigned to interfaces. Modern Linux supports multiple IPv4 and IPv6 addresses per interface natively without legacy aliasing tricks (eth0:1).

ip addr show eth0

Raw Output Example

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.50/24 brd 192.168.1.255 scope global dynamic eth0
       valid_lft 86120sec preferred_lft 86120sec
    inet 10.0.0.50/16 scope global secondary eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::5054:ff:fe12:3456/64 scope link 
       valid_lft forever preferred_lft forever

Breakdown of Fields

Field Example Value Meaning & Diagnostic Role
Protocol inet, inet6 inet denotes IPv4; inet6 denotes IPv6.
IP / Mask 192.168.1.50/24 Configured IP address and CIDR prefix length (/24 = 255.255.255.0).
brd 192.168.1.255 The calculated IPv4 subnet broadcast address.
scope global, link, host Routing visibility scope of this address:


• global: Valid anywhere on external/routed networks.


• link: Valid only within the directly attached L2 subnet (e.g., IPv6 link-local fe80::).


• host: Valid only within this local machine (e.g., 127.0.0.1). | | Type | dynamic, secondary | • dynamic: Allocated dynamically via DHCP or SLAAC.


• secondary: Additional IP assigned to the same subnet/interface.


• mngtmpaddr: IPv6 privacy extension address managed by the kernel. | | valid_lft | 86120sec | Remaining duration the IP is valid before DHCP expiration or address invalidation. | | preferred_lft | 86120sec | Remaining duration the IP is preferred for establishing new outbound connections. |

6. Deep-Dive: ip route (IP Routing Table)

ip route manages kernel routing decisions.

ip route show

Raw Output Example

default via 192.168.1.1 dev eth0 proto dhcp src 192.168.1.50 metric 100 
10.0.0.0/16 dev eth0 proto kernel scope link src 10.0.0.50 
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.50 metric 100 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown

Breakdown of Route Fields

+---------+------------------+----------+------------+------------+-------------------+------------+
| Target  | via (Gateway)    | dev      | proto      | scope      | src               | metric     |
+---------+------------------+----------+------------+------------+-------------------+------------+
| default | via 192.168.1.1  | dev eth0 | proto dhcp |            | src 192.168.1.50  | metric 100 |
| 10.0.0/16|                 | dev eth0 | proto kernel| scope link| src 10.0.0.50     |            |
+---------+------------------+----------+------------+------------+-------------------+------------+
  • Target (default / 10.0.0.0/16): Destination IP network. default represents 0.0.0.0/0.
  • via 192.168.1.1: The upstream next-hop gateway IP address. If absent, the network is directly attached on the local link.
  • dev eth0: The egress network interface through which matching packets will exit.
  • proto (Routing Protocol): How this route was installed into the kernel:
  • kernel: Installed automatically by the kernel when an interface IP is configured.
  • dhcp: Injected dynamically by a DHCP client daemon.
  • boot: Installed during system initialization.
  • static: Added manually by an administrator.

  • **zebra / bgp / ospf**: Injected by dynamic routing daemons (FRR, Bird).

  • scope link: The destination addresses are directly reachable on the local layer-2 segment (no gateway required).

  • src 192.168.1.50: The default source IP address selected by the kernel when local applications originate connections matching this route.
  • metric 100: Administrative cost/distance. When multiple routes match the same prefix, the kernel selects the route with the lowest metric.

Testing Route Selection: ip route get

Determine the exact path, interface, and source IP the kernel will select for a target IP without sending any packets:

ip route get 8.8.8.8

Output:

8.8.8.8 via 192.168.1.1 dev eth0 src 192.168.1.50 uid 1000 
    cache

7. Deep-Dive: ip neighbor (ARP & NDP Tables)

ip neighbor tracks the Layer 3 to Layer 2 address mappings (IPv4 ARP and IPv6 Neighbor Discovery).

ip neigh show

Raw Output Example

192.168.1.1 dev eth0 lladdr 00:1c:73:a1:b2:00 REACHABLE
192.168.1.25 dev eth0 lladdr 52:54:00:aa:bb:cc STALE
192.168.1.150 dev eth0  FAILED
fe80::1 dev eth0 lladdr 00:1c:73:a1:b2:00 router REACHABLE

Breakdown of Fields & Neighbor States

  • 192.168.1.1: Target IPv4 address.
  • dev eth0: Interface through which this neighbor is reached.
  • lladdr 00:1c:73:a1:b2:00: Link-Layer Address (the peer's physical MAC address).
  • router: Flag indicating the neighbor is a default router for IPv6.

Neighbor Finite State Machine

State Technical Meaning Diagnostic Significance
REACHABLE Valid entry. Verified by bidirectional communication within reachability timeout. Normal healthy communication.
STALE Valid entry, but verification timer has expired. The entry will be used until new traffic triggers re-verification. Normal state for idle nodes; transitions to DELAY upon packet dispatch.
DELAY A packet was sent to a stale neighbor; waiting for client confirmation before sending an ARP probe. Brief transitional state.
PROBE Actively sending unicast ARP/NDP probe packets to verify the MAC address. High counts indicate intermittent connectivity.
INCOMPLETE Address resolution is in progress; broadcast ARP request sent, no reply received yet. Target node is down, unreachable, or firewall is blocking ARP.
FAILED Address resolution failed; no ARP reply received before timeout. Target IP does not exist on the subnet.
PERMANENT Statically configured neighbor entry. Never expires or probes. Static ARP entry configured by admin.

8. Advanced Subsystems: Policy Routing & Network Namespaces

8.1 Policy-Based Routing (RPDB): ip rule

Standard routing decisions depend solely on the destination IP. Linux Policy Routing allows routing based on source IP, ingress interface, TOS, or firewall fwmarks.

ip rule show

Raw Output Example

0:      from all lookup local
100:    from 10.200.1.0/24 lookup custom_isp2
32766:  from all lookup main
32767:  from all lookup default
  • 0: from all lookup local: Highest priority (0). Reserved table containing local loopback and broadcast addresses.
  • 100: from 10.200.1.0/24 lookup custom_isp2: Any packet originating from the 10.200.1.0/24 subnet is evaluated against a custom routing table (custom_isp2), ignoring the default gateway in main.
  • 32766: from all lookup main: Standard routing table containing normal routes.
  • 32767: from all lookup default: Final fallback table (rarely used).

8.2 Network Namespaces: ip netns

Network namespaces provide isolated copies of the network stack (interfaces, routing tables, iptables rules, sockets). They form the network foundation of Linux containers (Docker, Podman, Kubernetes).

# 1. Create two isolated network namespaces
sudo ip netns add red
sudo ip netns add blue

# 2. Create a Virtual Ethernet pair (veth cable)
sudo ip link add veth-red type veth peer name veth-blue

# 3. Move endpoints into their respective namespaces
sudo ip link set veth-red netns red
sudo ip link set veth-blue netns blue

# 4. Configure IP addresses inside the namespaces
sudo ip netns exec red ip addr add 10.1.1.1/24 dev veth-red
sudo ip netns exec red ip link set veth-red up
sudo ip netns exec blue ip addr add 10.1.1.2/24 dev veth-blue
sudo ip netns exec blue ip link set veth-blue up

# 5. Test isolated connectivity across namespaces
sudo ip netns exec red ping 10.1.1.2

9. Essential Command Reference Cheat Sheet

Task Command
List interfaces briefly ip -br link show
Bring an interface UP / DOWN sudo ip link set eth0 up / down
Change interface MTU sudo ip link set eth0 mtu 9000
Change MAC address sudo ip link set dev eth0 address 00:11:22:33:44:55
Add an IP address sudo ip addr add 192.168.1.100/24 dev eth0
Delete an IP address sudo ip addr del 192.168.1.100/24 dev eth0
Add default gateway sudo ip route add default via 192.168.1.1 dev eth0
Add static route sudo ip route add 10.50.0.0/16 via 192.168.1.254 dev eth0
Delete a route sudo ip route del 10.50.0.0/16
Flush all IP addresses from interface sudo ip addr flush dev eth0
Flush entire ARP cache sudo ip neigh flush all
Add static ARP entry sudo ip neigh add 192.168.1.10 lladdr 00:aa:bb:cc:dd:ee dev eth0 nud permanent

10. iproute2 vs. net-tools (The Legacy Transition)

Task Legacy net-tools Modern iproute2 Why iproute2 is Superior
Display Interfaces ifconfig -a ip link show Separates L2 link state from L3 IP configuration.
Assign IP Address ifconfig eth0 10.0.0.1 ip addr add 10.0.0.1/24 dev eth0 Enforces explicit CIDR notation; supports secondary IPs without pseudo-aliases.
Secondary IP ifconfig eth0:1 10.0.0.2 ip addr add 10.0.0.2/24 dev eth0 True secondary addresses; avoids brittle alias devices (eth0:1).
Display Routes route -n or netstat -r ip route show Scales efficiently; supports policy routing and multiple routing tables.
Display ARP Cache arp -an ip neigh show Exposes IPv6 NDP states, neighbor finite state machine, and fast flushing.
Kernel Interface ioctl() string translation Netlink (rtnetlink) sockets Atomic operations, zero lockup on thousands of virtual interfaces, structured JSON.

11. Real-World Troubleshooting Scenarios

Scenario A: Resolving the "NO-CARRIER" Administrative Paradox

You assign an IP and bring an interface up, but packets cannot be sent:

ip link show eth1

Output:

3: eth1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN mode DEFAULT qlen 1000

Diagnosis:

  • UP is in the flags: The interface was administratively enabled by the operator.
  • NO-CARRIER and state DOWN: The physical transceiver cannot establish a link.
  • Cause: Disconnected cable, faulty SFP transceiver, unpatched switch port, or switch port administratively disabled (shutdown).

Scenario B: Diagnosing Source IP Mismatch on Multi-Homed Servers

A server has two interfaces (eth0: 192.168.1.50, eth1: 10.0.0.50). When connecting to 10.0.0.200, the connection fails due to firewall drops.

Check the kernel route selection:

ip route get 10.0.0.200

Output:

10.0.0.200 via 192.168.1.1 dev eth0 src 192.168.1.50 uid 0

Diagnosis: The kernel is routing traffic destined for 10.0.0.200 out of eth0 via the default gateway using source IP 192.168.1.50, instead of using the directly attached eth1 interface. Fix: Add a specific subnet route:

sudo ip route add 10.0.0.0/16 dev eth1 src 10.0.0.50

Scenario C: Clearing Stale/Poisoned ARP Entries

A gateway router was replaced with new hardware. The server cannot reach external networks because it continues targeting the old router's MAC address.

Inspect the neighbor entry:

ip neigh show 192.168.1.1

Output shows old MAC in STALE or FAILED state.

Flush and re-probe immediately:

sudo ip neigh flush dev eth0
ping -c 1 192.168.1.1
ip neigh show 192.168.1.1

The entry refreshes with the new MAC address in REACHABLE state.

12. Important Interview Questions & Answers

Answer:

  • UP: Represents the administrative state of the network interface. It indicates that an administrator or daemon has invoked ip link set <dev> up and the kernel driver has allocated memory and initialized queues.
  • LOWER_UP: Represents the physical operational carrier state (Layer 1). It indicates that the physical Ethernet PHY or fiber optic transceiver has successfully locked onto a signal from the remote link partner (switch port). An interface with <BROADCAST,MULTICAST,UP> without LOWER_UP is administratively enabled but physically disconnected (NO-CARRIER).

Q: What is the difference between valid_lft and preferred_lft in ip addr show?

Answer: These lifetimes govern dynamic address deprecation (standardized in RFC 4862 for IPv6 and DHCPv4 options):

  • valid_lft (Valid Lifetime): The total amount of time the address remains assigned to the interface. Once it hits zero, the kernel strips the IP from the interface, and all active connections bound to it are severed.
  • preferred_lft (Preferred Lifetime): The amount of time the address is preferred for establishing new outbound connections. If preferred_lft expires while valid_lft is still positive, the address enters a deprecated state: existing connections remain alive, but new socket connections will select a different source address.

Q: Why does Linux prefer Policy Routing (ip rule) over multiple default gateways in standard routing tables?

Answer: A standard routing table (ip route) can only have one active default gateway per metric; destination-based routing cannot distinguish between packets based on where they came from. In multi-homed servers (servers with connections to multiple ISPs or networks), inbound requests arriving on eth1 would inadvertently send response packets out of eth0 via the primary default gateway, causing asymmetric routing drops due to upstream Reverse Path Filtering (rp_filter). Policy Routing (ip rule) allows creating rules like ip rule add from <eth1_ip> table isp2, ensuring responses exit the exact interface they arrived on.

0 Likes
2 Views
0 Comments

Filters

No filters available for this view.

Reset All