LFCA 42 🐧 Viewing Network Interfaces — ip addr, ip link - KandZ

A network interface is the device’s connection to a network. It can be a physical card, a wireless adapter, a virtual interface, a bridge, a tunnel, or a loopback. Each has an address, a state, a set of statistics, and a set of properties. The tools for viewing them are the ip addr and the ip link commands, which are the modern replacements for the ifconfig and the netstat of the old net-tools package. The two commands cover different layers: ip link shows the link layer — the interface’s state, the MAC address, the MTU — and ip addr shows the network layer — the IP addresses, the prefixes, the scopes. Together they are the first step in any network diagnosis, and the ip -s link adds the statistics that reveal the errors and the drops. This chapter covers the interface types, the ip link output, the ip addr output, the state flags, the statistics, the multiple addresses, and the patterns that make the interface inspection systematic. It is the practical companion to LFCA 39 through 41 and prepares the ground for the network diagnostics.

Key point: The ip link command shows the link-layer information: the interface name, the state (UP, DOWN, UNKNOWN), the MTU, the MAC address, and the flags. The ip addr command shows the network-layer information: the IP addresses, the prefixes, the broadcast addresses, the scopes, and the interface’s state. The two commands together are the complete picture of an interface. The ip -s link adds the statistics: the received and transmitted bytes, packets, errors, and drops. The interface names follow the predictable pattern: the eth0 for the Ethernet, the wlan0 for the wireless, the lo for the loopback, the docker0 for the Docker bridge, the tun0 for the tunnel. The ip link set and the ip addr add are the configuration, but the inspection is the focus here.

The interface types

A network interface is a device that connects to a network. The types are the physical, the virtual, and the special.

The physical interfaces. The Ethernet card is the eth0 or the enp3s0, the wireless adapter is the wlan0 or the wlp2s0. The names are the physical, and the kernel assigns them at the boot. The modern systemd’s predictable names — the enp3s0 and the wlp2s0 — are based on the PCI slot, and the legacy names — the eth0 and the wlan0 — are the sequential.

The loopback. The lo is the loopback, and it is always present. The address is the 127.0.0.1/8 (the IPv4) and the ::1/128 (the IPv6). The loopback is for the local communication, and the traffic does not leave the device.

The virtual interfaces. The docker0 is the Docker bridge, the virbr0 is the libvirt bridge, the tun0 is the OpenVPN tunnel, the wg0 is the WireGuard, the br0 is the custom bridge. The virtual interfaces are the software, and the kernel creates them.

The VLAN interfaces. The eth0.100 is the VLAN 100 on the eth0, and the naming is the parent and the VLAN ID. The VLAN is the tag, and the kernel handles the tagging.

The bond interfaces. The bond0 is the bond of the two or more interfaces, and the pattern is the redundancy or the aggregation. The bond is the virtual, and the members are the physical.

Why the interface types matter. Each type has the specific behavior and the specific configuration. The physical interface is the hardware, the virtual is the software, and the loopback is the special. The diagnosis is the type-specific, and the knowledge of the types is the fluency.

Why the names are the predictable. The modern names are the predictable, and the legacy are the sequential. The predictable names are the stable across the reboots, and the legacy can change. The stable names are the better, and the systemd’s naming is the modern.

Why the interface can be the multiple. A device can have the multiple interfaces — the Ethernet and the wireless, the physical and the virtual, the VLAN and the bridge. Each has its own address, and the routing table decides which is the outgoing.

Why the ip link and the ip addr are the pair. The ip link is the link layer, and the ip addr is the network layer. The two are the different layers, and the two together are the complete picture. The ip link is the state and the MAC, and the ip addr is the IP and the prefix. The diagnosis uses both.

The `ip link` command

The ip link command shows the link-layer information for every interface. The output includes the interface name, the state, the MTU, and the MAC address.

ip link
# 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
#     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
# 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
#     link/ether aa:bb:cc:dd:ee:ff brd ff:ff:ff:ff:ff:ff
# 3: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
#     link/ether 11:22:33:44:55:66 brd ff:ff:ff:ff:ff:ff

The three interfaces: the loopback, the Ethernet, and the wireless. The Ethernet is UP, and the wireless is DOWN.

The interface index. The 1:, the 2:, the 3: are the interface indexes. The index is the kernel’s number, and the lo is always the 1.

The interface name. The lo, the eth0, the wlan0 are the names. The name is the identifier, and the ip commands use it.

The flags. The <LOOPBACK,UP,LOWER_UP> is the flags. The LOOPBACK is the loopback, the UP is the administratively up, the LOWER_UP is the carrier present, the BROADCAST is the broadcast capable, the MULTICAST is the multicast capable.

Why the UP and the LOWER_UP are different. The UP is the administrative state — the interface is enabled. The LOWER_UP is the physical state — the cable is connected, the carrier is present. The UP without the LOWER_UP means the interface is enabled but the cable is unplugged.

The MTU. The mtu 1500 is the Maximum Transmission Unit, the largest packet the interface can send. The Ethernet’s default is the 1500, and the loopback’s is the 65536.

Why the MTU matters. A packet larger than the MTU must be fragmented, and the fragmentation is the overhead. The wrong MTU causes the performance problems, and the mtu 1500 is the standard.

The qdisc. The qdisc fq_codel is the queueing discipline, which is the kernel’s packet scheduling. The fq_codel is the modern default, and the noqueue is the loopback’s.

The state. The state UP, the state DOWN, the state UNKNOWN are the interface’s state. The UP is the running, the DOWN is the disabled, and the UNKNOWN is the loopback’s (which has no carrier).

The mode and the group. The mode DEFAULT and the group default are the mode and the group. The mode is the interface’s mode, and the group is the grouping.

The qlen. The qlen 1000 is the transmit queue length, which is the number of the packets the queue can hold. The 1000 is the default.

The link line. The link/ether aa:bb:cc:dd:ee:ff brd ff:ff:ff:ff:ff:ff is the link layer. The link/ether is the Ethernet, the aa:bb:cc:dd:ee:ff is the MAC address, and the brd ff:ff:ff:ff:ff:ff is the broadcast address.

Why the MAC matters. The MAC is the hardware address, and it is the unique on the local network. The ARP maps the IP to the MAC, and the packet is sent to the MAC. The MAC is the link layer’s identity.

The ip link show <interface>. The command with the interface shows only that interface.

ip link show eth0

Why the single interface is the focus. The command with the interface is the focused, and the output is the specific. The pattern is the diagnosis, and the use is the common.

The `ip addr` command

The ip addr command shows the network-layer information for every interface. The output includes the IP addresses, the prefixes, the scopes, and the states.

ip addr
# 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
#     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
#     inet 127.0.0.1/8 scope host lo
#        valid_lft forever preferred_lft forever
#     inet6 ::1/128 scope host
#        valid_lft forever preferred_lft forever
# 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
#     link/ether aa:bb:cc:dd:ee:ff brd ff:ff:ff:ff:ff:ff
#     inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic eth0
#        valid_lft 86350sec preferred_lft 86350sec
#     inet6 fe80::a00:27ff:fe4e:66a1/64 scope link
#        valid_lft forever preferred_lft forever
# 3: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
#     link/ether 11:22:33:44:55:66 brd ff:ff:ff:ff:ff:ff

The output shows the link layer and the network layer. The inet lines are the IPv4 addresses, and the inet6 lines are the IPv6 addresses.

The inet line. The inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic eth0 is the IPv4 address. The 192.168.1.100 is the address, the /24 is the prefix, the brd 192.168.1.255 is the broadcast, the scope global is the scope, the dynamic is the DHCP-assigned, and the eth0 is the interface.

Why the scope matters. The scope global is the globally routable, the scope link is the link-local (the 169.254.x.x or the fe80::), the scope host is the loopback. The scope is the address’s reach, and the diagnosis uses the scope.

The dynamic flag. The dynamic means the address was assigned by the DHCP, and the valid_lft and the preferred_lft are the lease’s timers. The valid_lft 86350sec is the lease’s remaining time, and the preferred_lft is the preferred time.

Why the lease’s timers matter. The DHCP’s lease is the time-limited, and the address is the renewed before the valid_lft expires. The 86350sec is the ~24 hours, and the client renews at the half.

The inet6 line. The inet6 fe80::a00:27ff:fe4e:66a1/64 scope link is the IPv6 link-local. The fe80:: is the link-local prefix, and the /64 is the prefix length.

Why the link-local is present. The IPv6 interface always has the link-local address, and it is the fe80::/10. The address is the automatic, and the pattern is the neighbor discovery.

The ip -4 addr. The -4 shows only the IPv4.

ip -4 addr

The ip -6 addr. The -6 shows only the IPv6.

ip -6 addr

Why the family filter matters. The -4 and the -6 are the family filters, and the focused output is the diagnosis. The pattern is the common, and the use is the specific.

The ip addr show <interface>. The command with the interface shows only that interface.

ip addr show eth0

The ip addr show dev <interface>. The dev is the explicit, and the two are the same.

ip addr show dev eth0

Why the interface filter matters. The single interface’s output is the focused, and the diagnosis is the specific. The pattern is the common, and the use is the interface.

The state flags

The flags in the <> describe the interface’s capabilities and the state. The common flags are the UP, the LOWER_UP, the BROADCAST, the MULTICAST, the LOOPBACK, the NOARP, the PROMISC, the ALLMULTI.

The UP. The UP is the administratively up, which means the interface is enabled.

The LOWER_UP. The LOWER_UP is the carrier present, which means the cable is connected (or the wireless is associated).

Why the UP without the LOWER_UP is the problem. The interface is enabled but the carrier is absent, which means the cable is unplugged or the switch’s port is down. The pattern is the physical, and the diagnosis is the cable.

The DOWN. The state DOWN is the interface disabled. The ip link set eth0 down is the disable, and the ip link set eth0 up is the enable.

The BROADCAST. The BROADCAST is the broadcast capable. The Ethernet is the broadcast, and the loopback is not.

The MULTICAST. The MULTICAST is the multicast capable. The Ethernet is the multicast, and the loopback is not.

The LOOPBACK. The LOOPBACK is the loopback interface. The lo has the flag, and the others do not.

The NOARP. The NOARP is the ARP disabled. The pattern is the tunnel, and the use is the specific.

The PROMISC. The PROMISC is the promiscuous mode, which means the interface receives every packet on the segment, not just the ones addressed to it. The tcpdump uses the promiscuous, and the pattern is the capture.

Why the promiscuous matters. The promiscuous mode is the packet capture, and the tcpdump and the wireshark use it. The flag is the diagnostic, and the use is the specific.

The ALLMULTI. The ALLMULTI is the all-multicast, which means the interface receives every multicast packet. The pattern is the specific, and the use is the rare.

The SLAVE. The SLAVE is the bond’s member, and the pattern is the bond. The bond’s members have the flag, and the bond has the MASTER.

The MASTER. The MASTER is the bond’s master, and the pattern is the bond. The bond has the flag, and the members have the SLAVE.

Why the flags are the diagnosis. The flags describe the interface’s state and the capabilities. The UP and the LOWER_UP are the state, the BROADCAST and the MULTICAST are the capabilities, and the PROMISC and the SLAVE are the specific. The flags are the first thing to check.

The statistics

The ip -s link shows the statistics for every interface. The statistics include the received and transmitted bytes, packets, errors, and drops.

ip -s link
# 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
#     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
#     RX:  bytes packets errors dropped  missed   mcast
#       12345     100      0       0       0       0
#     TX:  bytes packets errors dropped carrier collsns
#       12345     100      0       0       0       0
# 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
#     link/ether aa:bb:cc:dd:ee:ff brd ff:ff:ff:ff:ff:ff
#     RX:  bytes packets errors dropped  missed   mcast
#       1234567   12345      0       0       0     100
#     TX:  bytes packets errors dropped carrier collsns
#       7654321   12345      0       0       0       0

The RX is the received, and the TX is the transmitted. The errors, the dropped, the missed, and the carrier are the specific.

The RX errors. The errors is the number of the receive errors, which is the hardware or the driver’s. The pattern is the cable or the card, and the diagnosis is the physical.

The RX dropped. The dropped is the number of the dropped packets, which is the kernel’s (the buffer full, the no memory). The pattern is the load, and the diagnosis is the resource.

The RX missed. The missed is the number of the missed packets, which is the ring buffer’s. The pattern is the interrupt, and the diagnosis is the kernel.

The RX mcast. The mcast is the number of the multicast packets.

The TX errors. The errors is the number of the transmit errors.

The TX dropped. The dropped is the number of the dropped packets.

The TX carrier. The carrier is the number of the carrier losses.

The TX collsns. The collsns is the number of the collisions, which is the half-duplex or the duplex mismatch.

Why the collisions matter. The collisions are the half-duplex or the duplex mismatch, and the modern Ethernet is the full-duplex. The collisions indicate the duplex mismatch, and the diagnosis is the switch’s port.

The ip -s -s link. The -s -s shows the more detailed statistics, which is the errors’ breakdown.

ip -s -s link show eth0

Why the statistics matter. The statistics reveal the errors and the drops, which the state alone does not. The interface can be UP and still have the errors, and the statistics are the diagnosis.

Why the statistics should be the baseline. The statistics are the cumulative since the boot, and the baseline is the comparison. The increase over the time is the rate, and the rate is the diagnosis.

Why the statistics should be the periodic. The periodic check is the monitoring, and the increase is the alert. The pattern is the proactive, and the use is the production.

The multiple addresses

An interface can have the multiple addresses — the multiple IPv4, the multiple IPv6, the mixed. The pattern is the secondary, and the use is the specific.

ip addr show eth0
# 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
#     link/ether aa:bb:cc:dd:ee:ff brd ff:ff:ff:ff:ff:ff
#     inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic eth0
#     inet 192.168.1.101/24 brd 192.168.1.255 scope global secondary eth0
#     inet6 fe80::a00:27ff:fe4e:66a1/64 scope link

The 192.168.1.100 is the primary, and the 192.168.1.101 is the secondary. The secondary flag marks the additional.

Why the multiple addresses exist. The multiple addresses are the multiple networks, the migration, the virtual hosting. The pattern is the specific, and the use is the advanced.

Why the primary and the secondary. The primary is the first, and the secondary is the additional. The kernel picks the primary for the outgoing, and the secondary is the alias.

Why the multiple IPv6 are common. The IPv6 interface has the link-local and the global, and the two are the common. The pattern is the standard, and the use is the IPv6.

Why the address can be the temporary. The IPv6 privacy extensions add the temporary address, which is the rotated for the privacy. The pattern is the privacy, and the use is the modern.

Why the address’s valid_lft matters. The valid_lft is the address’s lifetime, and the forever is the static. The dynamic is the DHCP’s, and the deprecated is the IPv6’s.

Why the address can be the deprecated. The IPv6’s deprecated address is the valid but not the preferred, and the new connections use the new address. The pattern is the transition, and the use is the IPv6.

Why the multiple addresses are the diagnosis. The multiple addresses mean the interface has the multiple networks, and the routing table has the multiple routes. The diagnosis is the address-specific, and the ip addr is the source.

Why the ip addr add and the ip addr del. The ip addr add 192.168.1.101/24 dev eth0 adds the address, and the ip addr del removes it. The pattern is the temporary, and the persistence is the configuration’s.

Complete Example Session

# ============================================
# PART 1: THE IP LINK
# ============================================

ip link
# 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
#     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
# 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP
#     link/ether aa:bb:cc:dd:ee:ff brd ff:ff:ff:ff:ff:ff
# 3: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN
#     link/ether 11:22:33:44:55:66 brd ff:ff:ff:ff:ff:ff

# ============================================
# PART 2: THE IP ADDR
# ============================================

ip addr
# 1: lo: <LOOPBACK,UP,LOWER_UP>
#     inet 127.0.0.1/8 scope host lo
#     inet6 ::1/128 scope host
# 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP>
#     inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic eth0
#     inet6 fe80::a00:27ff:fe4e:66a1/64 scope link
# 3: wlan0: <BROADCAST,MULTICAST>
#     (no addresses, the interface is down)

# ============================================
# PART 3: THE SPECIFIC INTERFACE
# ============================================

ip link show eth0
ip addr show eth0

# ============================================
# PART 4: THE FAMILY FILTER
# ============================================

ip -4 addr
ip -6 addr

# ============================================
# PART 5: THE STATISTICS
# ============================================

ip -s link
# 2: eth0: ...
#     RX:  bytes packets errors dropped  missed   mcast
#       1234567   12345      0       0       0     100
#     TX:  bytes packets errors dropped carrier collsns
#       7654321   12345      0       0       0       0

ip -s -s link show eth0

# ============================================
# PART 6: THE FLAGS
# ============================================

# <LOOPBACK>     the loopback
# <UP>           the administrative up
# <LOWER_UP>     the carrier present
# <BROADCAST>    the broadcast capable
# <MULTICAST>    the multicast capable
# <PROMISC>      the promiscuous mode
# <SLAVE>        the bond member
# <MASTER>       the bond master

# ============================================
# PART 7: THE STATE
# ============================================

# state UP       the running
# state DOWN     the disabled
# state UNKNOWN  the loopback (no carrier)

# ============================================
# PART 8: THE MULTIPLE ADDRESSES
# ============================================

ip addr add 192.168.1.101/24 dev eth0
ip addr show eth0
#     inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic eth0
#     inet 192.168.1.101/24 brd 192.168.1.255 scope global secondary eth0

ip addr del 192.168.1.101/24 dev eth0

# ============================================
# PART 9: THE DIAGNOSIS
# ============================================

# 1. ip link         → the state and the MAC
# 2. ip addr         → the addresses and the prefixes
# 3. ip -s link      → the errors and the drops
# 4. ip route        → the routes
# 5. ping the gateway

# The UP without the LOWER_UP → the cable is unplugged.
# The DOWN → the interface is disabled.
# The errors → the hardware or the driver.
# The dropped → the buffer or the load.

# ============================================
# PART 10: WHAT NOT TO DO
# ============================================

# Don't use the ifconfig (the legacy)
# The ip is the modern.

# Don't assume the UP means the connected
# The LOWER_UP is the carrier.

# Don't ignore the errors and the drops
# The statistics reveal the problems.

# Don't forget the family filter
# The -4 and the -6 are the focused.

# Don't add the address without the prefix
# The ip addr add 192.168.1.101  # the prefix is required

# Don't forget the persistence
# The ip addr add is temporary.

The ten parts cover the ip link, the ip addr, the specific interface, the family filter, the statistics, the flags, the state, the multiple addresses, the diagnosis, and the anti-patterns.

Quick Reference

The Commands

Command	Purpose
`ip link`	The link layer
`ip addr`	The network layer
`ip -4 addr`	The IPv4 only
`ip -6 addr`	The IPv6 only
`ip link show <if>`	One interface’s link
`ip addr show <if>`	One interface’s addresses
`ip -s link`	The statistics
`ip -s -s link`	The detailed statistics

The `ip link` Fields

Field	Meaning
The index	The kernel’s number
The name	The identifier
The flags	The capabilities and the state
The MTU	The maximum transmission unit
The qdisc	The queueing discipline
The state	The `UP`, `DOWN`, `UNKNOWN`
The link	The MAC and the broadcast

The `ip addr` Fields

Field	Meaning
`inet`	The IPv4
`inet6`	The IPv6
The address	The IP
The prefix	The `/24`
`brd`	The broadcast
`scope`	The `global`, `link`, `host`
`dynamic`	The DHCP
`valid_lft`	The lease’s lifetime

The Flags

Flag	Meaning
`UP`	The administrative up
`LOWER_UP`	The carrier present
`DOWN`	The disabled
`BROADCAST`	The broadcast capable
`MULTICAST`	The multicast capable
`LOOPBACK`	The loopback
`PROMISC`	The promiscuous
`SLAVE`	The bond member
`MASTER`	The bond master

The Statistics

Counter	Meaning
The bytes	The total
The packets	The total
The errors	The hardware or the driver
The dropped	The buffer or the load
The missed	The ring buffer
The carrier	The carrier losses
The collsns	The collisions

The Common Scopes

Scope	Meaning
`global`	The globally routable
`link`	The link-local
`host`	The loopback

Best Practices

✅ Do This:

# Use the ip commands
ip link
ip addr                                                        # ✅

# Check the specific interface
ip addr show eth0                                              # ✅

# Use the family filter
ip -4 addr                                                     # ✅

# Check the statistics
ip -s link                                                     # ✅

# Check the carrier
# The UP without the LOWER_UP means the cable is unplugged.    # ✅

# Check the errors and the drops
ip -s link show eth0                                           # ✅

# Check the multiple addresses
ip addr show eth0                                              # ✅

❌ Don’t Do This:

# Don't use the ifconfig
ifconfig  # the legacy                                         # ⚠️

# Don't assume the UP means the connected
# The LOWER_UP is the carrier.                                # ⚠️

# Don't ignore the errors and the drops
# The statistics reveal the problems.                         # ⚠️

# Don't add the address without the prefix
ip addr add 192.168.1.101  # the prefix is required            # ⚠️

# Don't forget the persistence
# The ip addr add is temporary.                               # ⚠️

# Don't forget the family filter
# The -4 and the -6 are the focused.                          # ⚠️

Common Pitfalls

Pitfall	Problem	Solution
The `UP` without the `LOWER_UP`	The cable is unplugged	Check the cable
The `DOWN` state	The interface is disabled	`ip link set up`
The errors	The hardware	Check the cable and the card
The dropped	The buffer	Check the load
The collisions	The duplex mismatch	Check the switch
The missing prefix	The invalid	Add the `/24`
The temporary address	Lost at reboot	Persist it
The `ifconfig`	The legacy	Use `ip`

Real-World Examples

1. The interfaces

ip link

2. The addresses

ip addr

3. The specific interface

ip addr show eth0

4. The IPv4 only

ip -4 addr

5. The statistics

ip -s link

6. The carrier check

ip link show eth0
# Look for the LOWER_UP flag.

7. The multiple addresses

ip addr add 192.168.1.101/24 dev eth0

8. The errors

ip -s link show eth0

9. The state

ip link show eth0 | grep -o 'state [A-Z]*'

10. The MAC

ip link show eth0 | grep link/ether

Visual: The `ip link`

┌──────────────────────────────────────────────────────────┐
│  2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP>              │
│  │  │     │                    │  │                      │
│  │  │     │                    │  └── the carrier present│
│  │  │     │                    └── the administrative up │
│  │  │     └── the multicast capable                      │
│  │  └── the interface name                               │
│  └── the interface index                                 │
│                                                          │
│  mtu 1500 qdisc fq_codel state UP                        │
│  │         │              │                              │
│  │         │              └── the state                  │
│  │         └── the queueing discipline                   │
│  └── the maximum transmission unit                       │
│                                                          │
│  link/ether aa:bb:cc:dd:ee:ff brd ff:ff:ff:ff:ff:ff      │
│  │          │                  │                         │
│  │          │                  └── the broadcast         │
│  │          └── the MAC address                          │
│  └── the Ethernet                                        │
│                                                          │
└──────────────────────────────────────────────────────────┘

Visual: The `ip addr`

┌──────────────────────────────────────────────────────────┐
│  inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic eth0│
│  │    │              │   │                │      │       │
│  │    │              │   │                │      │       └── the interface│
│  │    │              │   │                │      └── the DHCP-assigned│
│  │    │              │   │                └── the scope  │
│  │    │              │   └── the broadcast               │
│  │    │              └── the prefix                      │
│  │    └── the IPv4 address                               │
│  └── the address family                                 │
│                                                          │
│  inet6 fe80::a00:27ff:fe4e:66a1/64 scope link           │
│  │     │                          │    │                │
│  │     │                          │    └── the link scope│
│  │     │                          └── the prefix         │
│  │     └── the IPv6 link-local                          │
│  └── the IPv6 family                                    │
│                                                          │
└──────────────────────────────────────────────────────────┘

Visual: The State Flags

┌──────────────────────────────────────────────────────────┐
│  <LOOPBACK,UP,LOWER_UP>                                  │
│       │    │    │                                        │
│       │    │    └── the carrier is present               │
│       │    └── the administrative up                     │
│       └── the loopback                                   │
│                                                          │
│  THE INTERPRETATION                                      │
│                                                          │
│  UP + LOWER_UP  → the interface is ready                 │
│  UP, no LOWER_UP → the cable is unplugged                │
│  DOWN           → the interface is disabled              │
│                                                          │
│  The two flags are the different:                        │
│    UP is the administrative (the ip link set up)         │
│    LOWER_UP is the physical (the cable)                  │
│                                                          │
└──────────────────────────────────────────────────────────┘

Visual: The Statistics

┌──────────────────────────────────────────────────────────┐
│  ip -s link                                              │
│                                                          │
│  RX:  bytes packets errors dropped  missed   mcast       │
│       │     │       │       │        │       │           │
│       │     │       │       │        │       └── the multicast│
│       │     │       │       │        └── the ring buffer │
│       │     │       │       └── the kernel (buffer)      │
│       │     │       └── the hardware or the driver       │
│       │     └── the total                                │
│       └── the total                                      │
│                                                          │
│  TX:  bytes packets errors dropped carrier collsns       │
│                                      │       │           │
│                                      │       └── the collisions│
│                                      └── the carrier losses│
│                                                          │
│  The errors and the drops are the diagnosis.             │
│                                                          │
└──────────────────────────────────────────────────────────┘

Visual: The Scope

┌──────────────────────────────────────────────────────────┐
│  scope global                                            │
│    The globally routable.                                │
│    The normal address.                                   │
│                                                          │
│  scope link                                              │
│    The link-local.                                       │
│    The 169.254.x.x (the IPv4) or the fe80::/10 (the IPv6).│
│    The valid only on the local link.                     │
│                                                          │
│  scope host                                              │
│    The loopback.                                         │
│    The 127.0.0.1 or the ::1.                             │
│    The valid only on the device.                         │
│                                                          │
│  The scope is the address's reach.                       │
│                                                          │
└──────────────────────────────────────────────────────────┘

Summary

Item	Value
`ip link`	The link layer
`ip addr`	The network layer
`ip -s link`	The statistics
The interface	The name, the state, the MTU, the MAC
The address	The IP, the prefix, the scope
The state	The `UP`, `DOWN`, `UNKNOWN`
The flags	The `UP`, `LOWER_UP`, `BROADCAST`
The statistics	The bytes, the packets, the errors, the drops
The scope	The `global`, `link`, `host`
The multiple	The primary, the secondary

Key takeaways:

The ip link shows the link layer, and the ip addr shows the network layer — the two together are the complete picture of an interface
The UP is the administrative state, and the LOWER_UP is the physical — the UP without the LOWER_UP means the cable is unplugged, which is the common diagnosis
The interface names follow the predictable pattern — the eth0 for the Ethernet, the wlan0 for the wireless, the lo for the loopback, the docker0 for the Docker bridge
The ip -s link shows the statistics — the errors, the drops, the missed, the carrier, and the collisions are the diagnosis for the problems the state alone does not reveal
The collisions indicate the duplex mismatch — the modern Ethernet is the full-duplex, and the collisions are the switch’s port’s problem
The inet and the inet6 lines are the IPv4 and the IPv6 — the -4 and the -6 filters show the family-specific
The scope is the address’s reach — the global is the globally routable, the link is the link-local, and the host is the loopback
The dynamic and the valid_lft are the DHCP’s — the lease’s timers show the remaining, and the forever is the static
The multiple addresses are the primary and the secondary — the interface can have the multiple, and the secondary flag marks the additional
The ip addr add and the ip addr del are the temporary — the persistence is the configuration’s, and the ip command is the runtime

Remember: The ip link and the ip addr are the first tools in any network diagnosis. The link layer shows the state and the MAC, the network layer shows the addresses and the prefixes, and the statistics show the errors and the drops. The UP and the LOWER_UP are the two flags to check, the errors and the drops are the counters to watch, and the scope is the address’s reach. The two commands together are the interface’s complete picture.

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!