LFCS 97 🐧 Network Interfaces — ip link - KandZ

⏱️ Estimated read: 10 min | |

The previous chapter covered ip addr, which manages Layer 3 protocol addresses. But an address is meaningless if the underlying link is administratively disabled. The ip link command operates one layer below: it manages the network device itself—bringing it up or down, changing its MTU, altering its MAC address, and creating virtual devices like bridges, bonds, and VLANs. On the LFCS exam, the distinction between ip link and ip addr is fundamental. A common mistake is adding an IP address to an interface and wondering why traffic does not flow—the link is still DOWN.

Key point: ip link manages the network device’s operational state and Layer 2 characteristics. ip addr manages the IP addresses assigned to that device. An interface must be UP at the link layer before any address on it can carry traffic.

Why ip link exists

The administrative state problem. Every network interface has an administrative state controlled by the kernel. When an interface is DOWN, the kernel drops all packets regardless of what IP addresses are assigned. The ip link set dev up command transitions the device to the UP state, enabling the driver to transmit and receive frames. Without this step, ip addr add is a no-op from the perspective of network connectivity .

The virtual device problem. Modern Linux networking relies heavily on virtual interfaces: bridges for Layer 2 switching, bonds for link aggregation, VLANs for network segmentation, and dummy interfaces for testing. The ip link add command creates these devices. A bridge created with ip link add name br0 type bridge is a software switch; physical or virtual ports are attached to it with ip link set dev eth0 master br0 . This is the foundation of container networking, virtualization, and advanced routing setups.

The MTU and MAC problem. The Maximum Transmission Unit (MTU) determines the largest frame an interface can transmit. Jumbo frames (MTU 9000) are common in storage networks and high-performance clusters. The MAC address can be changed for privacy, testing, or to match a hardware requirement. Both are properties of the link, not the address, and both are managed by ip link .

The naming problem. Consistent device naming (e.g., enp0s3 instead of eth0) is a udev feature, but ip link is the tool that displays the resulting names and their mapping to MAC addresses. When a system has multiple interfaces, identifying which one is which is the first step in any network configuration task .

The trade-off. ip link changes are runtime-only, just like ip addr. A bridge created with ip link add disappears after reboot unless persisted through NetworkManager, Netplan, or systemd-networkd. The LFCS exam tests both the immediate command and the knowledge that persistence requires a separate configuration layer.

a. Displaying and interpreting link state

The ip link show command (or ip link with no subcommand) lists every network interface with its flags, MTU, state, and MAC address. The output is dense but structured.

# Show all links
ip link show

# Show a specific interface
ip link show dev enp0s3

# Brief format (one line per interface)
ip -br link show

The flags between angle brackets are critical. <UP> means the interface is administratively enabled. <LOWER_UP> means the physical carrier is present (cable connected, peer responding). <BROADCAST> and <MULTICAST> indicate supported transmission modes. <SLAVE> indicates the interface is a member of a bond or bridge . The state field at the end summarizes: UP means operational, DOWN means administratively disabled, and UNKNOWN is normal for loopback and some virtual devices .

The -br (brief) flag produces a compact table: interface name, state, and MAC address. This is the fastest way to survey the system before making changes.

b. Bringing interfaces up and down

The set subcommand changes the operational state of a link. This is the most basic and most frequently used ip link operation.

# Bring an interface up
sudo ip link set dev enp0s3 up

# Bring an interface down
sudo ip link set dev enp0s3 down

# Verify the state
ip link show dev enp0s3

Bringing an interface down is not the same as deleting it. The device still exists, its configuration is preserved, and it can be brought back up without reconfiguring addresses. This is useful for maintenance or temporarily disabling a network path. However, bringing down the primary interface on a remote system will terminate the SSH session—a mistake that is difficult to recover from without console access.

c. Creating virtual links: bridges, bonds, and VLANs

The add subcommand creates virtual network devices. The type argument determines what kind of device is created. This is where ip link becomes essential for advanced networking.

# Create a bridge
sudo ip link add name br0 type bridge

# Create a bond in active-backup mode
sudo modprobe bonding
sudo ip link add name bond0 type bond mode active-backup

# Create a VLAN interface on top of enp0s3
sudo ip link add link enp0s3 name enp0s3.20 type vlan id 20

# Create a dummy interface
sudo ip link add name dummy0 type dummy

After creating a virtual device, it must be brought up with ip link set dev up and assigned an address with ip addr add. For bridges and bonds, member interfaces are attached with the master keyword: ip link set dev enp0s8 master br0. The member interfaces do not need IP addresses; the address belongs on the bridge or bond device itself .

VLAN interfaces are a special case: the VLAN device (enp0s3.20) carries the tag, and the physical interface (enp0s3) carries the traffic. The VLAN device is created as a child of the physical link with link enp0s3 .

Complete Example Session

# ============================================
# PART 1: LIST ALL LINKS
# ============================================

ip link show
# Output shows lo, enp0s3, enp0s8.
# enp0s8 has <BROADCAST,MULTICAST> but no <UP>.

# ============================================
# PART 2: CHECK A SPECIFIC INTERFACE
# ============================================

ip link show dev enp0s8
# Output: state DOWN, no <UP> flag.

# ============================================
# PART 3: BRING THE INTERFACE UP
# ============================================

sudo ip link set dev enp0s8 up
# No output on success.

# ============================================
# PART 4: VERIFY THE CHANGE
# ============================================

ip link show dev enp0s8
# Output: <BROADCAST,MULTICAST,UP,LOWER_UP> state UP

# ============================================
# PART 5: ADD AN ADDRESS (FROM CHAPTER 96)
# ============================================

sudo ip addr add 192.168.1.50/24 dev enp0s8
# Now the interface is UP and has an address.

# ============================================
# PART 6: CREATE A BRIDGE
# ============================================

sudo ip link add name br0 type bridge
sudo ip link set dev br0 up
sudo ip link set dev enp0s8 master br0
# enp0s8 becomes a port on br0.
# The address should move to br0.

# ============================================
# PART 7: CREATE A VLAN
# ============================================

sudo ip link add link enp0s3 name enp0s3.20 type vlan id 20
sudo ip link set dev enp0s3.20 up
sudo ip addr add 10.0.20.1/24 dev enp0s3.20

# ============================================
# PART 8: CHANGE MTU
# ============================================

sudo ip link set dev enp0s8 mtu 9000
ip link show dev enp0s8 | grep mtu
# mtu 9000

# ============================================
# PART 9: BRING THE INTERFACE DOWN
# ============================================

sudo ip link set dev enp0s8 down
ip link show dev enp0s8
# state DOWN, address still assigned but traffic drops.

The nine parts trace the ip link lifecycle: listing, inspecting, bringing up, verifying, adding an address, creating a bridge, creating a VLAN, changing MTU, and bringing down. The critical insight is that link state and address state are independent—an address on a DOWN interface is unreachable.

Quick Reference

ip link Commands

Command	Purpose
`ip link show`	List all links
`ip link show dev eth0`	Show one interface
`ip -br link show`	Brief one-line format
`ip link set dev eth0 up`	Enable interface
`ip link set dev eth0 down`	Disable interface
`ip link set dev eth0 mtu 9000`	Change MTU
`ip link set dev eth0 address 00:11:22:33:44:55`	Change MAC

Virtual Link Creation

Command	Purpose
`ip link add name br0 type bridge`	Create bridge
`ip link add name bond0 type bond mode active-backup`	Create bond
`ip link add link eth0 name eth0.20 type vlan id 20`	Create VLAN
`ip link add name dummy0 type dummy`	Create dummy
`ip link set dev eth0 master br0`	Attach port to bridge

Flags and States

Flag / State	Meaning
`<UP>`	Administratively enabled
`<LOWER_UP>`	Carrier present
`state UP`	Operational
`state DOWN`	Administratively disabled
`state UNKNOWN`	Normal for loopback/dummy

Best Practices

✅ Do This:

ip link show dev enp0s8
<!-- Verify state before making changes -->           # ✅

ip link set dev enp0s8 up
<!-- Bring link up before adding addresses -->        # ✅

ip link set dev enp0s8 master br0
<!-- Attach member to bridge without IP -->           # ✅

❌ Don’t Do This:

ip link set dev eth0 down
<!-- On a remote system: SSH session terminates -->   # ❌

ip link add name br0 type bridge
# Then forget ip link set br0 up
<!-- Bridge exists but is DOWN -->                   # ❌

# Assume ip link changes persist across reboot
<!-- Runtime-only; configure via nmcli/Netplan -->    # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Address assigned but no traffic	Link is `DOWN`	`ip link set dev up`
Bridge created but not forwarding	Bridge `DOWN` or no ports attached	`ip link set br0 up`, attach ports
VLAN not working	Physical parent `DOWN`	Bring parent and VLAN device up
SSH disconnect	Brought down primary interface	Use console or avoid down on primary
MTU mismatch	Peer uses different MTU	Verify both ends; use jumbo frames consistently

Real-World Examples

1. Show All Links

ip link show

2. Brief Format

ip -br link show

3. Bring Up

sudo ip link set dev enp0s8 up

4. Bring Down

sudo ip link set dev enp0s8 down

5. Change MTU

sudo ip link set dev enp0s8 mtu 9000

6. Create Bridge

sudo ip link add name br0 type bridge

7. Attach Port

sudo ip link set dev enp0s8 master br0

8. Create VLAN

sudo ip link add link enp0s3 name enp0s3.20 type vlan id 20

9. Create Bond

sudo ip link add name bond0 type bond mode active-backup

10. Create Dummy

sudo ip link add name dummy0 type dummy

Visual

ip link vs ip addr

┌──────────────────────────────────────────────┐
│  ip link set dev enp0s8 up                   │
│  (Layer 2: enables the device)               │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  ip addr add 192.168.1.50/24 dev enp0s8      │
│  (Layer 3: assigns address)                  │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Interface is UP with an address             │
│  Traffic flows                               │
└──────────────────────────────────────────────┘

The link must be up before the address is meaningful.

Bridge Topology

┌──────────────────────────────────────────────┐
│  br0 (bridge, IP address assigned here)      │
│                                              │
│  ├── enp0s8 (port, no IP)                    │
│  └── enp0s9 (port, no IP)                    │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Member ports forward at Layer 2             │
│  The bridge holds the Layer 3 configuration  │
└──────────────────────────────────────────────┘

Bridges and bonds hold the IP address; member ports do not.

Summary

Item	Value
List links	`ip link show`
Brief format	`ip -br link show`
Enable interface	`ip link set dev up`
Disable interface	`ip link set dev down`
Change MTU	`ip link set dev mtu`
Create bridge	`ip link add name br0 type bridge`
Attach port	`ip link set dev master`
Create VLAN	`ip link add link dev name dev.id type vlan id`
Persistence	Requires `nmcli`, Netplan, or systemd-networkd

Key takeaways:

ip link manages the device, ip addr manages the address. An interface must be UP at the link layer before any address on it can carry traffic.
Virtual devices are created with ip link add. Bridges, bonds, VLANs, and dummy interfaces are all link-layer constructs.
Member ports do not hold IP addresses. In a bridge or bond, the IP address is assigned to the logical device, not to the physical ports .
All changes are runtime-only. Persistence requires a network manager. The LFCS exam tests the runtime command and the knowledge that persistence is separate.
Bringing down the primary interface kills connectivity. On a remote system, this terminates SSH and requires console access to recover.

Remember: ip link is the tool that makes the interface exist and operate. ip addr gives it an identity. Without the link, the address is just a number. The exam expects you to know both layers and the order in which they must be configured: link up first, then address, then route.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!