Show all addresses

All show commands can be used with -4 or -6 options to show only IPv4 or IPv6 addresses.

Show addresses for a single interface

Examples:

Show addresses only for running interfaces

Show only static or dynamic IPv6 addresses

Show only statically configured addresses:

Show only addresses learnt via autoconfiguration:

Add an address to an interface

Examples:

You can add as many addresses as you want.

If you add more than one address, your machine will accept packets for
all of them. The first address you added will be used as source address for
outgoing traffic by default, it’s referred to as primary address.

All additional addresses you set will become secondary addresses.

Add an address with human-readable description

Examples:

A label must start with the interface name followed by a colon due to some backwards compatibility issues,
otherwise you’ll get an error.
Keep the label shorter than sixteen characters, or else you’ll get this error:

Notes

For IPv6 addresses this command has no effect (address will be added, but without a label).

Delete an address

Examples:

Interface name is required. Linux does allow the same address to be configured on multiple interfaces
and it has valid use cases.

Remove all addresses from an interface

Examples:

By default this command removes both IPv4 and IPv6 addresses. If you want to remove only
IPv4 or IPv6 addresses, use “ip -4 address flush” or “ip -6 address flush”.

Notes

There is no way to swap primary and secondary addresses or explicitly set the new primary address. Try to always set the primary address first.

However, if the sysctl variable net.ipv4.conf.${interface}.promote_secondaries is set to 1, when you delete the primary address,
the first secondary address will become the new primary.

Note that net.ipv4.conf.default.promote_secondaries=1 is not the universal default setting in all Linux distributions,
so check yours before trying it. If it’s set to 0, then when you delete the primary address, all addresses will be removed
from the interface.

Secondary IPv6 addresses are always promoted to primary if the primary address is deleted so you don’t need to worry about sysctl settings.

View neighbor tables

All “show” commands support -4 and -6 options to view only IPv4 (ARP) or IPv6 (NDP) neighbors. By default
all neighbors are displayed.

View neighbors for single interface

Examples:

Flush table for an interface

Examples:

Add a neighbor table entry

Examples:

One of the use cases for it is to add static entry for an interface with disabled ARP to
restrict interface usage only by hosts with specific MAC addresses.

Delete a neighbor table entry

Examples:

Allows to delete a static entry, or get rid of an automatically learnt entry without flushing the table.

Show information about all links

These commands are equivalent and can be used with the same arguments.

Show information about specific link

Examples:

The word “dev” may be omitted.

Bring a link up or down

Examples:

Note: virtual links described below, like VLANs and bridges
are in down state immediately after creation. You need to bring them up to start using them.

Set human-readable link description

Examples:

Link aliases show up in “ip link show” output, like:

Rename an interface

Examples:

Note that you can’t rename an active interface. You need to bring it down
before doing it.

Change link layer address (usually MAC address)

Link layer address is a pretty broad concept. The most known
example is MAC address for ethernet devices. To change MAC
address you would need something like:

Change link MTU

Examples:

MTU stands for “Maximum Transmission Unit”, the maximum size
of a frame an interface can transmit at once.

Apart from reducing fragmentation in tunnels like
in example above, this is also used to increase performance of
gigabit ethernet links that support so called “jumbo frames”
(frames up to 9000 bytes large). If all your equipment
supports gigabit ethernet, you may want to do something like

Note that you may need to configure it on your L2 switches too,
some of them have it disabled by default.

Delete a link

Obviously, only virtual links like VLANs or bridges can be deleted.

Enable or disable multicast on an interface

Unless you really understand what you are doing, better not to touch this.

Enable or disable ARP on an interface

One may want to disable ARP to enforce a security policy and allow only specific MACs
to communicate with the interface. In this case neighbor table entries for whitelisted MACs
should be created manually (see neighbor table management
section), or nothing will be able to communicate with that interface.

In most cases it’s better to configure MAC policy on an access layer switch though.
Do not change this flag unless you are sure what you are going to do and why.

Create a VLAN interface

Examples:

The only type of VLAN supported in Linux is IEEE 802.1q VLAN, legacy implementations like ISL
are not supported.

Once you create a VLAN interface, all frames tagged with ${tag} you specified in id option
received by ${parent interface} will be processed by that VLAN interface.

eth0.100 name format is traditional, but not required, you can name the interface as you want,
just like with other interface types.

VLANs can be created over bridge, bonding and other interfaces capable of processing ethernet frames too.

Create a QinQ interface (VLAN stacking)

Example:

VLAN stacking (aka 802.1ad QinQ) is a way to transmit VLAN tagged traffic over another VLAN. The common use case
for it is like this: suppose you are a service provider and you have a customer who wants to use your network
infrastructure to connect parts of their network to each other. They use multiple VLANs in their network, so
an ordinary rented VLAN is not an option. With QinQ you can add a second tag to the customer traffic when it enters your network
and remove that tag when it exits, so there are no conflicts and you don’t need to waste VLAN numbers.

The service tag is the VLAN tag the provider uses to carry client traffic through their network. The client tag
is the tag set by the customer.

Note that link MTU for the client VLAN interface is not adjusted automatically, you need to take care
of it yourself and either decrease the client interface MTU by at least 4 bytes, or increase the parent MTU accordingly.

Standards-compliant QinQ is available since Linux 3.10.

Create pseudo-ethernet (aka macvlan) interface

Examples:

You can think of macvlan interfaces as additional virtual MAC addresses on the parent interface.
They look like normal ethernet interfaces from user point of view, and handle all traffic for
MAC address they are assigned with received by their parent interface.

This is commonly used for testing, or for using several instances of a service identified by
MAC when only one physical interface is available.

They also can be used just for IP address separation instead of assigning multiple addresses
to the same physical interface, especially if some service can’t operate on a secondary address properly.

Create a dummy interface

Examples:

Dummy interfaces work pretty much like loopback interfaces, just there can be as many
of them as you want.

The first purpose of them is for communication of programs inside the host.

The second purpose exploits the fact they are always up (unless administratively taken down).
This is often used to assign service addresses to them on routers with more than one physical
interface. As long as the traffic to the address assigned to a loopback or dummy interface
is routed to the machine that owns it, you can access it through any of its interfaces.

Create a bridge interface

Examples:

Bridge interfaces are virtual ethernet switches. They can be used to relay traffic
transparently between ethernet interfaces, and, increasingly common, as ethernet switches
for virtual machines running inside hypervisors.

You can assign an IP address to a bridge and it will be visible from all bridge ports.

If this command fails, check if “bridge” module is loaded.

Add an interface to bridge

Examples:

Interface you added to a bridge becomes a virtual switch port. It operates only on datalink
layer and ceases all network layer operation.

Remove interface from bridge

Examples:

Create a bonding interface

Examples:

Note: This is not enough to configure bonding (link aggregation)
in any meaningful way. You need to set up bonding parameters according to your situation.
This is far beyond the cheat sheet scope, so consult the documentation.

Interfaces are added to the bond group the same way to bridge group, just note that you can’t
add it until you take it down.

Create an intermediate functional block interface

Example:

Intermediate functional block devices are used for traffic redirection and mirroring
in conjunction with tc. This is also far beyond the scope of this document, consult tc
documentation.

Create a pair of virtual ethernet devices

Virtual ethernet (veth) devices always come in pairs and work as a bidirectional pipe,
whatever comes into one of them, comes out of another. They are used in conjunction with
system partitioning features such as network namespaces and containers (OpenVZ and LXC)
for connecting one partition to another.

Examples:

Note: virtual ethernet devices are created in UP state, no need to
bring them up manually after creation.

Add an interface to a group

Examples:

Remove an interface from a group

This can be done by assigning it to the default group.

Examples:

Assign a symbolic name to a group

Group names are stored in /etc/iproute2/group file. Symbolic name “default”
for group 0 comes exactly from there. You can add your own, one per line,
following the same “${number} ${name}” format. You can have up to 255 named groups.

Once you configured a group name, number and name can be used interchangeably
in ip commands.

Example:

After that you can use that name in all operations, like in

Perform an operation on a group

Examples:

View information about links from specific group

Use usual information viewing command with “group ${group}” modifier.

Examples:

View tun/tap devices

Note: this command can be abbreviated to “ip tuntap”.

This command is the only way to find out if some device is in tun or tap mode.

Add an tun/tap device useable by the root user

Examples:

Add an tun/tap device usable by an ordinary user

Example:

Add an tun/tap device using an alternate packet format

Add meta information to each packet received over the file
descriptor. Very few programs expect this information, and
including it when it isn’t expected will break things.

Example:

Add an tun/tap ignoring flow control

Normally packets sent to a tun/tap device travel in the same way
as packets sent to any other device: they are put on a queue handled by the
traffic control engine (which is configured by the tc command).
This can be bypassed, thus disabling the traffic control engine
for this tun/tap device.

Example:

Delete tun/tap device

Examples:

Note: you must specify the mode. The mode is not displayed in “ip link show”, so
if you don’t know if it’s TUN or TAP, consult the output of “ip tuntap show”.

Create an IPIP tunnel

Examples:

Create a SIT tunnel

Examples:

This type of tunnels is commonly used to provide an IPv4-connected network with
IPv6 connectivity. There are so called “tunnel brokers” that provide it to everyone interested,
e.g. Hurricane Electric tunnelbroker.net.

Create an IPIP6 tunnel

Examples:

This type of tunnels will be widely used when transit operators phase IPv4 out (i.e. not any soon).

Create an IP6IP6 tunnel

Examples:

Just like IPIP6 these ones aren’t going to be generally useful any soon.

Create a gretap (ethernet over GRE) device

Examples:

This type of tunnels encapsulates ethernet frames into IPv4 packets.

Recent kernel and iproute2 versions also support gretap over IPv6, you need to replace the mode with “ip6gretap”
to create an IPv6-based link.

This probably should have been in “Links management” section, but as it involves encapsulation, it’s here.
Tunnel interface created this way looks like an L2 link, and it can be added to a bridge group. This is used
to connect L2 segments via a routed network.

Create a GRE tunnel

Examples:

GRE can encapsulate both IPv4 and IPv6 at the same time. However, by default it uses IPv4 for transport,
for GRE over IPv6 there is a separate tunnel mode, “ip6gre”.

Create multiple GRE tunnels to the same endpoint

Examples:

Keyed tunnels can be used at the same time to unkeyed too. Key may be in dotted decimal IPv4-like format.

Note that key does not add any security to the tunnel. It’s just an identifier used to distinguish one tunnel from another.

Create a point-to-multipoint GRE tunnel

Examples:

Note the absence of ${remote endpoint address}. This is the same to what is called “mode gre multipoint” in Cisco IOS.

In the absence of remote endpoint address the key is the only way to identify the tunnel traffic, so ${key value} is required.

This type of tunnels allows you to communicate with multiple endpoints by using the same tunnel interface. It’s commonly used in
complex VPN setups with multiple endpoints communicating to one another (in Cisco terminology, “dynamic multipoint VPN”).

As there is no explicit remote endpoint address, obviously it is not enough to just create a tunnel. Your system needs to know
where the other endpoints are.

In real life NHRP (Next Hop Resolution Protocol) is used for it. For testing you can add peers manually (given remote endpoint
uses 203.0.113.6 address on its physical interface and 10.0.0.2 on the tunnel):

You will have to do it on the remote endpoint too, like:

Note that link-layer address and neighbor address are both IP addresses, so they are on the same OSI layer.
This one of the cases where link-layer address concept gets interesting.

Create a GRE tunnel over IPv6

Recent kernel and iproute2 versions support GRE over IPv6. Point-to-point with no key:

It should support all options and features supported by the IPv4 GRE described above.

Delete a tunnel

Examples:

Note that in older iproute2 versions this command did not support the full “delete” word, only “del”.
Recent versions allow both full and abbreviated forms (tested in iproute2-ss131122).

Modify a tunnel

Examples:

Note: Apparently you can’t add a key to previously unkeyed tunnel.
Not sure if it’s a bug or a feature. Also, you can’t change tunnel mode on the fly,
for obvious reasons.

View tunnel information

Examples:

Create an L2TPv3 tunnel over UDP

Examples:

Note: Tunnel identifiers and other settings on both endpoints must match.

Create an L2TPv3 tunnel over IP

L2TPv3 encapsulated directly into IP offers less overhead,
bug generally is unable to pass through NAT.

Create an L2TPv3 session

Examples:

Notes: tunnel_id value must match a value of previously created tunnel.
Session identifiers on both endpoints must match.

Once you create a tunnel and a session, l2tpethX interface will appear, in down state. Change the state
to up and bridge it with another interface or assign an address.

Delete an L2TPv3 session

Examples

Delete an L2TPv3 tunnel

Examples

Note: You need to delete all sessions associated
with a tunnel before deleting it.

View L2TPv3 tunnel information

Examples:

View L2TPv3 session information

Examples:

Create unicast VXLAN link