Networking and remote

`ip`

Show and change network interfaces, addresses, routes and neighbors on Linux (iproute2).

ip [OPTION...] OBJECT {COMMAND | help}

9 of 10 examples run in Debian 13.7 on 2026-10-31 · iproute2 6.15.0-1 · manual: ip(8)

ip is the Linux tool for network configuration, replacing the older ifconfig, route and arp. Its first argument is an object (address, link, route, neigh, ...) and the second a command (show, add, del, set); show is the default, and every word can be abbreviated, so ip a means ip address show and ip r means ip route show.

Reading is open to everyone; changing anything needs root (and is lost at reboot unless your distribution's network configuration repeats it). -br gives a one-line-per-interface summary that is much easier to scan than the full listing, -4/-6 filter by address family, and -j prints JSON for scripts.

The sandbox the examples run in has only the loopback interface lo and no routes to other networks, so the listings are short. On a real machine the same commands also show eth0, wlan0 or enp3s0 style interfaces, their addresses and a default route. ip is Linux-only.

Examples

Show all addresses

$ ip addr

explain

output

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host proto kernel_lo 
       valid_lft forever preferred_lft forever

For each interface: its index and name, flags (UP, LOWER_UP means a carrier), the MTU, the state, then the link-layer address and every IPv4 (inet) and IPv6 (inet6) address with its prefix length. Here only loopback exists, with 127.0.0.1/8 and ::1/128.

A one-line summary per interface

$ ip -br addr

explain

output

lo               UNKNOWN        127.0.0.1/8 ::1/128

-br (brief) prints name, state and addresses in columns, the quickest answer to "what is my IP address". Loopback's state is UNKNOWN because it has no carrier to detect.

IPv4 addresses of one interface

$ ip -4 addr show dev lo

explain

output

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever

-4 hides IPv6 entries and show dev lo limits the output to one interface.

List interfaces without addresses

$ ip -br link

explain

output

lo               UNKNOWN        00:00:00:00:00:00 <LOOPBACK,UP,LOWER_UP>

link deals with the interfaces themselves: name, state, MAC address (all zeros for loopback) and flags.

Packet and error counters

$ ip -s link show lo

explain

output

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    RX:  bytes packets errors dropped  missed   mcast           
         23118     277      0       0       0       0 
    TX:  bytes packets errors dropped carrier collsns           
         23118     277      0       0       0       0

-s adds byte and packet counters for receive (RX) and transmit (TX), plus errors and drops. Rising error counts on a real interface point to cabling or driver trouble. On loopback, everything sent is also received, so the two rows match.

Which route a packet would take

$ ip route get 127.0.0.1

explain

output

local 127.0.0.1 dev lo src 127.0.0.1 uid 1000 
    cache <local>

route get asks the kernel how it would send a packet to that address: here as a local delivery on lo with source 127.0.0.1. On a real host, ip route get 1.1.1.1 shows the gateway and interface used for the internet.

The routing tables

$ ip route
> echo "--- local table:"
> ip route show table local

output

--- local table:
local 127.0.0.0/8 dev lo proto kernel scope host src 127.0.0.1 
local 127.0.0.1 dev lo proto kernel scope host src 127.0.0.1 
broadcast 127.255.255.255 dev lo proto kernel scope link src 127.0.0.1

ip route shows the main table, which is empty here: no default route, because the sandbox has no network. On a normal machine its first line is default via <gateway> dev <iface>. The local table holds the kernel's routes for the machine's own addresses.

JSON output for scripts

$ ip -j addr show lo | jq -r '.[0].addr_info[] | "\(.family) \(.local)/\(.prefixlen)"'

explain

output

inet 127.0.0.1/8
inet6 ::1/128

-j prints JSON, so jq can pick fields reliably instead of parsing columns that change between versions.

Changing settings needs root

$ ip addr add 192.0.2.50/24 dev lo

explain

outputexit 2

RTNETLINK answers: Operation not permitted

An ordinary user can read but not change the configuration, so the kernel refuses with Operation not permitted and ip exits with 2.

Add an address, bring a link up, add a default route

$ sudo ip addr add 192.0.2.10/24 dev eth0
> sudo ip link set eth0 up
> sudo ip route add default via 192.0.2.1

Not run in the sandbox: needs root and a real network interface; the sandbox has neither. No output is shown because none was captured.

The typical manual configuration: give the interface an address with its prefix, bring it up, and send everything else to a gateway on that subnet. Changes are immediate and do not survive a reboot; permanent settings belong in your distribution's network configuration (netplan, NetworkManager, systemd-networkd or /etc/network/interfaces).

Common pitfalls

ip addr add adds an address; it does not replace the existing one. Remove the old one with ip addr del ADDR/PREFIX dev IFACE.
Forgetting the prefix (ip addr add 192.0.2.10 dev eth0) assigns a /32, so the subnet is not reachable directly.
Everything done with ip is temporary. Over SSH, a wrong ip route or ip link set ... down can cut off your own session; have console access or a scheduled rollback.

GNU vs BSD and macOS

The examples above ran the GNU/Linux version. These are the differences that matter on macOS and the BSDs (written from their documentation, not run here).

ip exists only on Linux. macOS and the BSDs use ifconfig for interfaces and addresses, route or netstat -rn for routes, and arp -a for neighbors.

Options worth knowing

A selection, described in our own words. For the full list, see ip(8) or ip --help.

Option	What it does
`-4`	Show or use IPv4 only.
`-6`	Show or use IPv6 only.
`-br`	Brief output: one line per object.
`-brief`	Same as -br.
`-s`	Include statistics; repeat for more.
`-stats`	Same as -s.
`-d`	Show details (link types, tunnel parameters and so on).
`-details`	Same as -d.
`-j`	Print JSON.
`-json`	Same as -j.
`-p`	Pretty-print JSON.
`-o`	One line per record, for grep.
`-oneline`	Same as -o.
`-c`	Color the output.
`-color`	Same as -c.
`-r`	Resolve addresses to names via DNS.
`-n NETNS`	Run the command in network namespace NETNS.
`-f FAMILY`	Address family: inet, inet6, link and others.

Subcommands

`address`	Show or change IP addresses on interfaces (ip a, ip addr add/del).
`link`	Show or change interfaces themselves (ip link set eth0 up/down, mtu).
`route`	Show or change the routing tables (ip route add default via ...).
`neigh`	Show or change the ARP / neighbor cache.
`rule`	Show or change policy routing rules.
`netns`	Manage network namespaces.
`monitor`	Watch for address, link and route changes as they happen.

Examples

Common pitfalls

GNU vs BSD and macOS

Options worth knowing

Subcommands

Related