The ip command - the sysadmin network toolkit

ip is the modern Linux network configuration tool. It supersedes ifconfig, route, and arp (which are still shipped for compatibility but should not be used on modern hosts). ip lives in the iproute2 package and reads and writes the same kernel state through netlink.

The ip subcommands

For sysadmin work, the first six subcommands are 95% of what you need.

ip link - interfaces

ip link show                    # all interfaces
ip -br link show                # brief (one line per interface)
ip link show eth0               # one interface
ip -s link show eth0            # with statistics
ip -d link show eth0            # with details
ip link set eth0 up             # bring up
ip link set eth0 down           # bring down
ip link set eth0 mtu 1400       # change MTU
ip link set eth0 address 02:00:00:00:00:01   # set MAC
ip link set eth0 master br0     # attach to bridge

-br (brief) is essential for scripts and quick checks. The output is one line per interface, with state, MAC, and MTU.

ip addr - addresses

ip addr show                    # all addresses
ip -br addr show                # brief
ip -4 addr show                 # only IPv4
ip -6 addr show                 # only IPv6
ip addr show eth0               # one interface
ip addr add 10.0.0.10/24 dev eth0     # add an address
ip addr del 10.0.0.10/24 dev eth0     # remove an address
ip addr flush dev eth0           # remove all addresses

ip addr add adds a secondary address; the primary stays. Use this for multi-homing or adding a VIP.

ip route - routing table

ip route show                   # all routes
ip -4 route show                # IPv4 only
ip -6 route show                # IPv6 only
ip route show default           # the default route
ip route get 1.1.1.1             # what route would be used
ip route add 10.0.0.0/24 via 10.0.0.1 dev eth0   # add a route
ip route add default via 10.0.0.1                # add default
ip route del 10.0.0.0/24                        # remove

ip route get is the most useful diagnostic command. It shows what route the kernel would use to reach a given destination, including the chosen interface and source address.

ip neigh - ARP and ND cache

ip neigh show                   # all entries
ip -4 neigh show                # IPv4 only
ip -6 neigh show                # IPv6 only
ip neigh add 10.0.0.5 lladdr aa:bb:cc:dd:ee:ff dev eth0 nud permanent
ip neigh del 10.0.0.5 dev eth0
ip neigh flush dev eth0

nud is “neighbour unreachability detection” state. Common values: permanent, reachable, stale.

ip rule - policy routing

ip rule show                    # all rules
ip rule add from 10.0.0.0/24 lookup 100  # source-based routing
ip rule del from 10.0.0.0/24 lookup 100

Policy routing (covered in Part XXI) lets you select different routing tables based on source IP, mark, or interface.

When to use legacy commands

The legacy commands (ifconfig, route, arp) are deprecated and read stale state in some configurations. Use ip for all new work. The only place you may still see them is in old init scripts or vendor documentation.

If you must read an ifconfig-style output, use ip -o addr or ip -br addr to get a similar single-line-per-interface view.

Knowledge check