ip — Show and change network cards, addresses, routes and neighbours (the live kernel settings).

What it does

ip talks directly to the Linux kernel. It shows the network exactly as it works right now: every address, every route and the state of every card. Everybody can read; you need root to change.

Changes made with ip are temporary. They are gone after a reboot or when NetworkManager sets the card again. Use ip to look and to test; use nmcli to make settings that stay.

ip replaces the old tools ifconfig, route and arp. Each part of the network is an object: address, link, route, neigh and more. Objects and commands can be shortened: ip a = ip address show, ip r = ip route show.

How to write it

ip [OPTIONS] OBJECT { COMMAND | help }
ip address { show | add | del | flush } [ dev IFNAME ] ...
ip link { show | set | add | del } [ dev IFNAME ] ...
ip route { show | get | add | del | replace | flush } ...
ip neigh { show | add | del | flush } ...

Main parts

address (a, addr): IPv4 and IPv6 addresses on the cards. show, add, del, flush.
link (l): The network cards themselves: state up or down, MAC address, MTU, type.
route (r): The routing table: the default gateway and the other routes. show, get, add, del.
neigh (n, neighbour): Neighbours: the IP to MAC table (ARP for IPv4, NDP for IPv6).
rule (ru): Policy routing rules: which routing table to use for which traffic.
netns: Network namespaces, used by containers. list, add, exec, del.
monitor: Watch changes of addresses, links and routes live.
maddress: Multicast addresses.
tunnel, tuntap: Tunnels (GRE, IPIP) and TUN/TAP devices for VPNs.
xfrm: IPsec settings.

Options 34

Most used

Output

-br, -brief: Short output: one line per card with only the state and the addresses.
-c, -color[=always|auto|never]: Colors for names, addresses and states.
-4: Only IPv4. Short for -family inet.
-6: Only IPv6. Short for -family inet6.
-f, -family family: Choose the protocol family: inet, inet6, link, bridge, mpls.
-0: Only the link layer (MAC addresses). Short for -family link.
-o, -oneline: Every record on one line. Easy to use with grep and awk.
-s, -stats, -statistics: Add counters: packets, errors, dropped. Use it twice for more.
-d, -details: Show more details, like the type of a link (vlan, bond, bridge).
-h, -human, -human-readable: Show counters in human units (K, M, G).
-iec: Human units with powers of 1024 (Ki, Mi).
-j, -json: Output in JSON, for scripts and tools like jq.
-p, -pretty: With -json: indented JSON that is easy to read.
-r, -resolve: Show DNS names instead of addresses.
-N, -Numeric: Show numbers for protocols and scopes, not names.
-t, -timestamp: With ip monitor: add the time to every event.
-ts, -tshort: Like -timestamp, but shorter.

Work

-n, -netns name: Run the command inside a network namespace.
-a, -all: Run the command on all objects, for example in all namespaces.
-b, -batch file: Read many ip commands from a file (or - for stdin).
-force: In batch mode, go on after errors.
-l, -loops count: How many times ip address flush tries (default 10, 0 = until all are gone).
-rc, -rcvbuf size: Size of the netlink receive buffer.
-echo: Ask the kernel to send back the change that was made.
-V, -Version: Show the version.

Words used with address, link and route

dev IFNAME: The network card, like enp1s0.
via ADDR: The next router (gateway) of a route.
default: The default route (0.0.0.0/0 or ::/0).
metric n: The cost of a route. The lowest metric wins.
up, down: With ip link set: switch a card on or off.
mtu bytes: With ip link set: the maximum packet size.
address MAC: With ip link set: change the MAC address.
scope {global|link|host}: Where an address is valid. host = only this computer.
label name: A name for an extra IPv4 address, like enp1s0:1.

Examples 15

$ run as a normal user# run as root (or with sudo)

1Show all addresses on all cards

$ip a
$ip -br -c a
lo               UNKNOWN        127.0.0.1/8 ::1/128
enp1s0           UP             192.168.122.10/24 fe80::5054:ff:fe3a:7c01/64

-br shows one line per card. This is the fastest health check on a new server.

2Show only the IPv4 address of one card
```
$ip -4 -o addr show dev enp1s0 | awk '{print $4}'
192.168.122.10/24
```
-o puts each address on one line, so awk can take the 4th field. Good in scripts.
3Find the default gateway
```
$ip route show default
default via 192.168.122.1 dev enp1s0 proto static metric 100
```
No default line means the server cannot reach other networks.
4See which route and source address one destination uses
```
$ip route get 10.20.5.7
10.20.5.7 via 192.168.122.254 dev enp1s0 src 192.168.122.10 uid 1000
```
Very useful when a server has two cards or a VPN: you see which card and which address the traffic leaves with.
5Check a card for errors and dropped packets
```
$ip -s -h link show enp1s0
```
Growing errors or drops point to a bad cable, a bad driver, or a full buffer. Compare two runs a minute apart.

6Show the MAC addresses of all cards

$ip -br link
lo               UNKNOWN        00:00:00:00:00:00 <LOOPBACK,UP,LOWER_UP>
enp1s0           UP             52:54:00:3a:7c:01 <BROADCAST,MULTICAST,UP,LOWER_UP>

The MAC address is needed for DHCP reservations and for some software licenses.

7Add a test address for a few minutes (temporary)
```
#ip addr add 192.168.122.50/24 dev enp1s0
#ip addr del 192.168.122.50/24 dev enp1s0
```
Good for a quick test. NetworkManager or a reboot removes it anyway. For a fixed address use nmcli.
8Add a route for a test (temporary)
```
#ip route add 10.30.0.0/16 via 192.168.122.254 dev enp1s0
#ip route del 10.30.0.0/16
```
Test first with ip. When it works, save it with nmcli con mod enp1s0 +ipv4.routes "10.30.0.0/16 192.168.122.254".
9See the neighbours (ARP table)
```
$ip neigh show
192.168.122.1 dev enp1s0 lladdr 52:54:00:aa:bb:cc REACHABLE
```
Two IP addresses with the same MAC, or a gateway MAC that changes, can be a sign of ARP spoofing.
10Clear a wrong neighbour entry
```
#ip neigh flush dev enp1s0
```
After you replace a router or move an IP address to another server, old entries can block traffic for a while.
11Switch a card off and on
```
#ip link set enp1s0 down
#ip link set enp1s0 up
```
Do not do this over SSH on the card you are using: you lose the connection.
12Change the MTU for a test
```
#ip link set dev enp2s0 mtu 9000
$ip link show enp2s0 | grep -o 'mtu [0-9]*'
mtu 9000
```
Jumbo frames help for storage networks. All switches and servers on the path must use the same MTU.

13Get addresses as JSON for a script

$ip -j addr show dev enp1s0 | jq -r '.[0].addr_info[] | select(.family=="inet") | .local'
192.168.122.10

JSON output does not change between versions, so scripts do not break.

14Look inside a container network namespace
```
#ip netns list
#ip netns exec blue ip -br a
```
Containers and some VPN tools use namespaces. Each one has its own cards and routes.
15Watch network changes live
```
$ip -t monitor address route
```
Shows every address and route change with the time. Press Ctrl+C to stop. Good when a DHCP lease or a VPN changes routes.

Watch out

All changes with ip are lost at reboot. NetworkManager can also overwrite them earlier.
ip link set DEV down over SSH on the same card cuts your connection.
ip addr flush dev DEV removes all addresses of the card.
Read the mask: 192.168.122.10/24 and 192.168.122.10/32 are very different.

Files

/etc/iproute2/rt_tables: Names of the routing tables (used by policy routing).
/proc/net/dev: Raw counters of all cards (what ip -s link shows).
/sys/class/net/: One folder per network card with its settings.

Tips to remember

Read the objects as questions: a = which addresses? r = which way? l = which cards? n = who is next to me?
ip -br a and ip r are the two first commands on any broken network.
Look with ip, change with nmcli.

`ip`

What it does

How to write it

Main parts

Options 34

Output

Work

Words used with address, link and route

Examples 15

1Show all addresses on all cards

2Show only the IPv4 address of one card

3Find the default gateway

4See which route and source address one destination uses

5Check a card for errors and dropped packets

6Show the MAC addresses of all cards

7Add a test address for a few minutes (temporary)

8Add a route for a test (temporary)

9See the neighbours (ARP table)

10Clear a wrong neighbour entry

11Switch a card off and on

12Change the MTU for a test

13Get addresses as JSON for a script

14Look inside a container network namespace

15Watch network changes live

Watch out

Files

Tips to remember

Full manual

ip

What it does

How to write it

Main parts

Options 34

Output

Work

Words used with address, link and route

Examples 15

1Show all addresses on all cards

2Show only the IPv4 address of one card

3Find the default gateway

4See which route and source address one destination uses

5Check a card for errors and dropped packets

6Show the MAC addresses of all cards

7Add a test address for a few minutes (temporary)

8Add a route for a test (temporary)

9See the neighbours (ARP table)

10Clear a wrong neighbour entry

11Switch a card off and on

12Change the MTU for a test

13Get addresses as JSON for a script

14Look inside a container network namespace

15Watch network changes live

Watch out

Files

Tips to remember

Related commands

Used in these lessons

Used in these labs

Full manual

`ip`