kmail.at
contact
kmail.at
contact

elsewhere

EnglishEN
← learning

networking · difficulty ◆◆

ip — inspect and configure network interfaces

ifconfig is gone. ip is the one command that answers every 'what is my network doing' question.

ifconfig has been deprecated for over a decade, yet half the tutorials online still teach it. ip does everything it did — and everything it never could — in one command.

AI-generated draft · reviewed and editedThis text was generated with AI as a first draft, then reviewed and edited by the author, who holds editorial responsibility for it.

2026-09-07 · 6 min read

$ ip

What it does

ip is the iproute2 suite's front door. It manages network interfaces (ip link), IP addresses (ip addr), routing tables (ip route), and the neighbor/ARP cache (ip neigh). It replaced the old net-tools commands — ifconfig, route, arp — which went from version 1.60 in 2001 to 2.10 only in January 2021 and are not installed by default on many modern distros.

Why it matters

When a machine 'has no network', ip is the first thing you reach for. Is the interface up? What address did DHCP hand out? Is there a default route? Is the gateway reachable? Each is one ip subcommand. It is also scriptable and machine-readable, which is why every modern Linux admin, Docker, and Kubernetes tooling leans on it.

Machine-readable output

ip can print JSON instead of the human tables: `ip -j addr`, `-j link`, `-j route`, `-j neigh` each emit one JSON document, which is what you want inside a script rather than awk-ing columns. The flags combine with -br, so `ip -br -j addr` gives the one-line-per-interface shape as JSON. Pipe it into jq and you can ask questions directly — for example the addresses of one interface, with family and prefix length, without a single regex.

Example

$ ip -br addr
lo               UNKNOWN        127.0.0.1/8 ::1/128 
wlp0s20f3        UP             192.168.1.57/24 metric 600 fd5c:2d2b:cb4c:ef7:3e58:c2ff:fed8:5ef5/64 
docker0          DOWN           172.17.0.1/16 
br-703b0c8f3110  UP             172.23.0.1/16

-br (brief) gives one line per interface: state, IPv4, and IPv6. The fastest way to see what address each interface actually has.

$ ip route
default via 192.168.1.1 dev wlp0s20f3 proto dhcp src 192.168.1.57 metric 600 
192.168.1.0/24 dev wlp0s20f3 proto kernel scope link src 192.168.1.57 metric 600

The first line is the default route — where traffic with no more specific match goes. If this line is missing, you have no internet even with an address assigned.

$ ip -s link show wlp0s20f3
3: wlp0s20f3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DORMANT group default qlen 1000
    link/ether 3c:58:c2:d8:5e:f5 brd ff:ff:ff:ff:ff:ff
    RX:   bytes  packets errors dropped  missed   mcast           
    46162342698 63895377      0       0       0       0 
    TX:   bytes  packets errors dropped carrier collsns           
    48975281559 34278651      0       1       0       0

-s adds per-interface byte and packet counters. On a healthy link the errors column stays at zero; the single dropped TX packet here is ordinary background noise — a handful of drops across tens of millions of packets is not a fault. Sustained errors, or dropped counts that keep climbing, mean a cable, driver, or duplex problem.

$ ip neigh
192.168.1.1 dev wlp0s20f3 lladdr 00:11:32:81:da:a6 REACHABLE 
192.168.1.82 dev wlp0s20f3 FAILED 
192.168.1.21 dev wlp0s20f3 lladdr 00:11:32:80:a1:34 STALE 
192.168.1.13 dev wlp0s20f3 lladdr b8:27:eb:ac:0c:ef REACHABLE

ip neigh is the modern ARP table: which IPs on your subnet have been resolved to MAC addresses. REACHABLE means recently confirmed alive; STALE means seen before but not recently; FAILED means the neighbour never answered, so nothing currently holds that address. Entries come and go as devices join and leave the network, so your table will not match this one line for line.

$ ip link set wlp0s20f3 down && ip link set wlp0s20f3 up
$ ip link set wlp0s20f3 down
$ ip link set wlp0s20f3 up
$ ip -br link show wlp0s20f3
wlp0s20f3        UP             3c:58:c2:d8:5e:f5 <BROADCAST,MULTICAST,UP,LOWER_UP>

Bounce an interface to force it to renegotiate and re-run DHCP. The classic 'turn it off and on again' for a stuck NIC — no reboot needed.

$ ip -j addr show lo | jq -c '.[0].addr_info'
[{"family":"inet","local":"127.0.0.1","prefixlen":8,"scope":"host","label":"lo","valid_life_time":4294967295,"preferred_life_time":4294967295},{"family":"inet6","local":"::1","prefixlen":128,"scope":"host","noprefixroute":true,"valid_life_time":4294967295,"preferred_life_time":4294967295}]

-j makes ip emit JSON and jq picks one field out of it. Here you get the loopback interface's addresses as one compact document: family, address, prefix length and scope for each. This is the version of ip that belongs in scripts — no column counting, no locale-dependent labels.

Common flags

addr
show or configure IP addresses on interfaces
link
show or configure network interfaces (up/down, MTU, MAC)
route
show or manipulate the routing table
neigh
show or manipulate the neighbor (ARP) cache
-br
brief output — one compact line per interface
-s
statistics — add byte/packet counters to link output
-4 / -6
restrict output to IPv4 or IPv6 only

History

Origin

ip comes from iproute2, written by Alexey Kuznetsov and released in 1999 as part of Linux 2.2's new networking stack. The old net-tools (ifconfig, route, arp) were built for the 2.0 era and never kept up. iproute2 was designed to be extensible — which is why ip has subcommands for things like policy routing and traffic control that ifconfig could never touch.

Fun fact

The 'ip' binary is actually a single program that dispatches on its first argument — ip addr, ip link, ip route are all the same executable. That is why the syntax is consistent across every subcommand, unlike the grab-bag of separate tools it replaced.

Fun facts

Pros & cons

pros

  • + One command for interfaces, addresses, routes, and neighbors — no more ifconfig + route + arp
  • + Machine-readable and scriptable output, with -br and -j (JSON) modes
  • + Actively maintained and installed by default on every modern distro

cons

  • − Syntax is verbose and takes getting used to after ifconfig
  • − Requires root for any change (ip link set, ip addr add) — read-only queries are fine as a normal user
  • − The subcommand sprawl (addr, link, route, neigh, rule, tunnel...) can feel overwhelming at first

Takeaways

  1. 1`ip -br addr` is the fastest way to see every interface's IP and state
  2. 2No default route in `ip route` means no internet, even with an address assigned
  3. 3`ip -s link` shows byte counters — errors/dropped at zero means a healthy link
  4. 4`ip neigh` is the modern ARP table; REACHABLE means the neighbor is alive
  5. 5Bounce a stuck NIC with `ip link set <iface> down && ip link set <iface> up`

Related commands

← all learning