The ip command is the standard Linux networking utility from the iproute2 suite that displays and modifies the kernel’s network configuration: interfaces, IP addresses, routes, neighbor tables, policy rules and network namespaces. In Linux networking it has replaced the legacy net-tools commands such as ifconfig, route and arp.
The ip command changes the running state of the kernel directly, which makes it the primary tool for diagnosis and quick changes. It does not store configuration on disk, so permanent settings belong to a network manager such as NetworkManager, Netplan or systemd-networkd, which in turn configure the same kernel objects.
How the ip command talks to the kernel
The ip command communicates with the kernel through rtnetlink, a family of the Netlink socket interface designed for routing and link configuration. Unlike the older ioctl calls used by net-tools, Netlink supports every modern kernel feature: multiple addresses per interface, multiple routing tables, IPv6, virtual devices and namespaces.
Its syntax follows one consistent pattern, ip [options] object command [arguments], and every object and command can be abbreviated to an unambiguous prefix, so ip a means ip address show. The main objects are listed below.
| Object | Short form | What it manages |
|---|---|---|
| link | ip l | Network devices, their state, MTU and MAC address |
| address | ip a | IPv4 and IPv6 addresses on devices |
| route | ip r | Entries in the routing tables |
| neigh | ip n | ARP and IPv6 neighbor caches |
| rule | ip ru | Policy routing rules that select a table |
| netns | ip netns | Named network namespaces |
| monitor | ip monitor | Live stream of Netlink change events |
Common tasks and their syntax
Most daily work with the ip command consists of a dozen short commands. The examples below use the documentation address ranges 192.0.2.0/24 and 198.51.100.0/24 and an interface named eth0.
| Task | Command |
|---|---|
| Show addresses briefly | ip -br address |
| Bring an interface up | ip link set eth0 up |
| Add an address | ip addr add 192.0.2.10/24 dev eth0 |
| Remove an address | ip addr del 192.0.2.10/24 dev eth0 |
| Set the default gateway | ip route replace default via 192.0.2.1 |
| Add a static route | ip route add 198.51.100.0/24 via 192.0.2.254 |
| Ask which route is used | ip route get 198.51.100.7 |
| Change the MTU | ip link set eth0 mtu 9000 |
| Show interface counters | ip -s link show eth0 |
Several global options make output easier to use. -br prints one line per device, -c adds color, -s adds packet and error counters, and -j produces JSON, which is the reliable format for scripts instead of parsing human-readable text.
The command ip route get is especially valuable for troubleshooting because it shows the exact route, source address and interface the kernel would choose for a given destination, including the effect of policy rules.
The ip command compared with net-tools
The net-tools package is deprecated on most distributions and is often not installed by default. Its commands still work for simple cases, but they hide configuration they cannot represent, such as a second IPv4 address without a label.
| Legacy net-tools command | iproute2 equivalent | Practical difference |
|---|---|---|
| ifconfig | ip addr, ip link | Shows every address, not just one per label |
| route -n | ip route | Supports multiple routing tables |
| arp -n | ip neigh | Covers IPv6 neighbors too |
| netstat -i | ip -s link | Per-device counters with error details |
| netstat -tulpn | ss -tulpn | Socket listing moved to the ss tool |
| ifconfig eth0 down | ip link set eth0 down | Same effect, consistent syntax |
Reading link states and neighbor entries
Output of ip link shows administrative and physical state separately. The flag UP means the interface is enabled by software, while LOWER_UP means the physical or virtual carrier is present; an interface showing UP but NO-CARRIER is enabled with no cable or no peer.
The neighbor cache explains many connectivity problems at layer 2. The table below shows the states that ip neigh reports and what they usually indicate.
| State | Meaning | Typical interpretation |
|---|---|---|
| REACHABLE | Recently confirmed by traffic or reply | Healthy entry |
| STALE | Valid but not recently confirmed | Normal for idle hosts |
| DELAY or PROBE | Reconfirmation in progress | Short-lived, normal |
| INCOMPLETE | Request sent, no reply yet | Host may be down |
| FAILED | No reply after retries | Wrong address, VLAN or firewall |
| PERMANENT | Static entry added manually | Never expires |
Routing tables and policy routing
Linux identifies routing tables by 32-bit table IDs, and the ip command is the only standard tool that manages them. Policy rules, evaluated in order of their priority number, decide which table answers a lookup based on source address, firewall mark, incoming interface or other selectors.
| Table | ID | Default rule priority | Content |
|---|---|---|---|
| local | 255 | 0 | Local and broadcast addresses, maintained by the kernel |
| main | 254 | 32766 | Normal routes shown by plain ip route |
| default | 253 | 32767 | Empty by default, last resort |
A plain ip route command shows only the main table, so routes in other tables stay invisible until an administrator runs ip route show table all or names the table. Forgetting this is a frequent cause of confusion on hosts that use VPNs or multiple uplinks.
Persistence and common mistakes
- Changes do not survive a reboot. Persistent configuration belongs in NetworkManager, Netplan, systemd-networkd or ifupdown.
- A network manager may overwrite manual changes at the next DHCP renewal or link event.
- Using
ip route add defaultwhen a default route exists fails with File exists;ip route replaceis idempotent. - Removing the address used for a remote SSH session cuts off the session immediately, so remote changes need a fallback.
- Parsing text output in scripts breaks between versions; JSON output with -j is stable.
The simple explanation
Every Linux computer keeps an internal record of its network: which connections exist, which addresses they have and which path each outgoing message should take. The ip command is the tool for reading and changing that record.
It works like the control panel of a postal sorting office. An operator can check which delivery vans are available, label them with addresses and decide which van carries mail for each region. Changes take effect at once, but they are forgotten after a restart unless they are also written into the computer’s saved network settings.
How it is used in practice
An engineer is asked why a Linux application server cannot reach a backup system at 198.51.100.20, although other hosts can. Running ip -br addr shows that interface eth1 has the expected address 192.0.2.15/24 and the state UP.
Next, ip route get 198.51.100.20 reveals that traffic leaves through eth0 toward the internet gateway instead of through eth1. A static route for the backup network had been added by hand months earlier and vanished after the last reboot. The engineer restores it with ip route add 198.51.100.0/24 via 192.0.2.1 dev eth1, confirms the path with ip route get again and then adds the same route to the server’s Netplan file, so the fix now survives future reboots.