🌐 ip Command — Network Configuration

Purpose: The ip command is the modern, unified tool for managing network interfaces, addresses, routes, neighbors (ARP), and tunnels on Linux. It replaces the deprecated ifconfig, route, netstat, and arp commands. Part of the iproute2 package, installed by default on all modern Linux distributions.

Basic Syntax: ip [ OPTIONS ] OBJECT { COMMAND | help }

Objects: address (addr) | link | route | neighbor (neigh) | rule | tunnel | maddress | monitor

🕰️ Legacy vs Modern: If you learned ifconfig and route, you are not alone — they were the standard for decades. But they are absent from minimal installs and officially deprecated. The ip command gives you more information, more control, and a consistent syntax. The mapping is covered at the end of this page.

📦 Major Subcommands at a Glance

ip link

Network interfaces — up/down, rename, MTU

ip addr

IP addresses — show, add, delete

ip route

Routing table — show, add, del, flush

ip neigh

ARP/NDP neighbor cache

ip rule

Policy-based routing rules

ip tunnel

IP tunnels (GRE, IPIP)

ip monitor

Watch live network events

ip netns

Network namespaces

📋 Examples

Example 1: Show All Network Interfaces and Addresses

The most common first command — get the lay of the land:

ip addr show

# Abbreviated form — all are equivalent:
ip addr
ip a

Typical output:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever

2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP
    link/ether 52:54:00:ab:cd:ef brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic ens3
       valid_lft 86398sec preferred_lft 86398sec
    inet6 fe80::5054:ff:feab:cdef/64 scope link
       valid_lft forever preferred_lft forever

💡 Reading the output: The flags in angle brackets tell you a lot: UP = interface is administratively up, LOWER_UP = physical link detected (cable connected or WiFi associated), BROADCAST = supports broadcast, MULTICAST = supports multicast. The /24 after the IP is CIDR notation (equivalent to 255.255.255.0).

Example 2: Show a Single Interface

Focus on one interface by name:

ip addr show ens3
ip addr show lo
ip addr show dev ens3   # 'dev' keyword is optional

Show only IPv4 or IPv6:

ip -4 addr show ens3    # IPv4 only
ip -6 addr show ens3    # IPv6 only

Interface naming: Modern systems use predictable names like ens3, enp2s0, eth0, or wlan0 depending on the driver and system configuration. Use ip link to see all interface names on your system.

Example 3: Show Network Links (Layer 2 View)

ip link shows interface state and MAC addresses — no IP addresses:

ip link show
ip link          # same thing
ip l             # abbreviated

Output:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT
    link/ether 52:54:00:ab:cd:ef brd ff:ff:ff:ff:ff:ff

Show statistics (packet/error counts):

ip -s link show ens3

Example 4: Bring an Interface Up or Down

Administratively enable or disable an interface:

# Bring interface down
sudo ip link set ens3 down

# Bring interface back up
sudo ip link set ens3 up

# Verify state
ip link show ens3

⚠️ Remote sessions: Bringing down the interface you are connected through will immediately drop your SSH session. Always have a console/IPMI fallback before taking down a remote system's network interface.

Example 5: Add a Temporary IP Address to an Interface

Assign an additional IP address — useful for testing or VIP configuration:

# Add an IP address with CIDR notation
sudo ip addr add 192.168.1.200/24 dev ens3

# Verify
ip addr show ens3

To add a secondary address on the same interface:

sudo ip addr add 10.10.10.5/24 dev ens3

⚠️ Not persistent: IP addresses added with ip addr add are lost on reboot or NetworkManager restart. For persistence, configure via nmcli, nmtui, or the appropriate config files for your distribution.

Example 6: Remove an IP Address from an Interface

# Remove a specific IP address
sudo ip addr del 192.168.1.200/24 dev ens3

# Verify it is gone
ip addr show ens3

💡 Flush all addresses: To remove all IP addresses from an interface at once:

sudo ip addr flush dev ens3

Use with caution — this removes everything including the primary address.

Example 7: Show the Routing Table

View the system routing table — where traffic goes for each destination:

ip route show
ip route        # same
ip r            # abbreviated

Typical output:

default via 192.168.1.1 dev ens3 proto dhcp src 192.168.1.100 metric 100
192.168.1.0/24 dev ens3 proto kernel scope link src 192.168.1.100

The default line is your default gateway. proto kernel means the kernel added this route automatically when the address was assigned.

Show routes for a specific destination:

ip route get 8.8.8.8    # which interface/gateway would be used to reach this IP?

Output:

8.8.8.8 via 192.168.1.1 dev ens3 src 192.168.1.100 uid 1000

Example 8: Add and Delete Static Routes

Add a static route — useful for multi-homed systems or VPN routing:

# Add route to 10.50.0.0/16 via gateway 192.168.1.254
sudo ip route add 10.50.0.0/16 via 192.168.1.254

# Add route specifying the outbound interface
sudo ip route add 10.50.0.0/16 via 192.168.1.254 dev ens3

# Add or replace the default gateway
sudo ip route replace default via 192.168.1.1 dev ens3

Delete a static route:

sudo ip route del 10.50.0.0/16 via 192.168.1.254

Not persistent: Like address changes, route changes made with ip route are lost on reboot. Add static routes via your network manager or distribution config files for permanent effect.

Example 9: View and Manage the ARP/Neighbor Table

The neighbor table is the ARP cache for IPv4, and NDP cache for IPv6:

# Show all neighbors (ARP cache)
ip neigh show
ip neigh         # same
ip n             # abbreviated

Output:

192.168.1.1 dev ens3 lladdr 00:11:22:33:44:55 REACHABLE
192.168.1.50 dev ens3 lladdr aa:bb:cc:dd:ee:ff STALE

States: REACHABLE = recently confirmed, STALE = entry aged out but not yet purged, FAILED = ARP resolution failed.

# Flush the ARP cache for an interface
sudo ip neigh flush dev ens3

# Add a static ARP entry
sudo ip neigh add 192.168.1.99 lladdr aa:bb:cc:11:22:33 dev ens3 nud permanent

Example 10: Change MTU and Interface Settings

Set the MTU (Maximum Transmission Unit) — important for jumbo frames or VPN tuning:

# Set MTU to 9000 (jumbo frames for 10GbE)
sudo ip link set ens3 mtu 9000

# Set back to standard Ethernet MTU
sudo ip link set ens3 mtu 1500

# Change the MAC address (interface must be down first)
sudo ip link set ens3 down
sudo ip link set ens3 address 02:00:00:00:00:01
sudo ip link set ens3 up

💡 VPN MTU tuning: If you run an OpenVPN or WireGuard tunnel and experience packet fragmentation, reducing the tunnel interface MTU (e.g., to 1420) often resolves it.

Example 11: Monitor Live Network Events

ip monitor watches for real-time changes — interfaces, addresses, routes:

# Monitor all events (Ctrl+C to stop)
ip monitor

# Monitor only address changes
ip monitor address

# Monitor only route changes
ip monitor route

# Monitor link state changes
ip monitor link

This is invaluable for watching what NetworkManager or a DHCP client is doing when a connection comes up.

Example 12: Useful Output Formatting Options

The ip command has several global flags for output control:

# Brief output — one line per object
ip -br addr show
ip -br link show

# Output in JSON format (great for scripting)
ip -j addr show
ip -j -p route show    # -p = pretty-print JSON

# Show human-readable sizes (KB, MB)
ip -h -s link show ens3

Brief addr output looks like this:

lo               UNKNOWN        127.0.0.1/8 ::1/128
ens3             UP             192.168.1.100/24 fe80::5054:ff:feab:cdef/64

💡 Scripting: The -j flag outputs JSON which can be piped directly into jq for powerful filtering:

ip -j addr show | jq '.[].addr_info[] | select(.family=="inet") | .local'

This extracts just the IPv4 addresses from all interfaces.

⚙️ Common Global Options

Option	Meaning	Example
`-4`	IPv4 only	`ip -4 addr`
`-6`	IPv6 only	`ip -6 route`
`-br`	Brief one-line output	`ip -br link`
`-s`	Statistics (packet counts, errors)	`ip -s link show ens3`
`-j`	JSON output	`ip -j addr \| jq .`
`-p`	Pretty-print (use with -j)	`ip -j -p route`
`-h`	Human-readable (KB, MB)	`ip -h -s link`
`-n <netns>`	Operate in a named network namespace	`ip -n myns addr`

🕰️ Legacy Command Mapping

Coming from ifconfig/route/arp? Here is the translation table:

Old Command	Modern ip Equivalent	Notes
`ifconfig`	`ip addr` + `ip link`	`ip` separates Layer 2 (link) from Layer 3 (addr)
`ifconfig eth0 up`	`ip link set eth0 up`
`ifconfig eth0 192.168.1.5 netmask 255.255.255.0`	`ip addr add 192.168.1.5/24 dev eth0`	CIDR notation replaces dotted netmask
`route -n`	`ip route show`
`route add default gw 192.168.1.1`	`ip route add default via 192.168.1.1`
`arp -n`	`ip neigh show`
`arp -d 192.168.1.50`	`ip neigh del 192.168.1.50 dev eth0`
`netstat -r`	`ip route`	`ss` replaces `netstat` for socket info

🚀 Quick Reference Card

Task	Command
Show all IPs	`ip addr` or `ip a`
Show one interface	`ip addr show ens3`
Show links (MAC, state)	`ip link` or `ip l`
Brief one-liner view	`ip -br addr`
Bring interface up/down	`sudo ip link set ens3 up/down`
Add IP address	`sudo ip addr add 10.0.0.5/24 dev ens3`
Remove IP address	`sudo ip addr del 10.0.0.5/24 dev ens3`
Show routing table	`ip route` or `ip r`
Which route to a host?	`ip route get 8.8.8.8`
Add static route	`sudo ip route add 10.50.0.0/16 via 192.168.1.1`
Delete static route	`sudo ip route del 10.50.0.0/16`
Show ARP cache	`ip neigh` or `ip n`
Flush ARP cache	`sudo ip neigh flush dev ens3`
Watch live events	`ip monitor`
JSON output for scripting	`ip -j addr \| jq .`

💡 Getting help: Every object and subcommand supports help:

ip help
ip addr help
ip route help
ip link help