A network interface is the point of attachment between a device and a network: the hardware or software component through which a host sends and receives frames, and to which the operating system binds link-layer and network-layer addresses. Among networking fundamentals, it is the unit that every configuration, routing decision and traffic statistic refers to, from a laptop’s Wi-Fi adapter to a virtual port inside a container.
An interface may be physical, such as an Ethernet port backed by a network interface card (NIC), or logical, such as a loopback, a VLAN subinterface, a VPN tunnel or a bridge. A single device often has many interfaces, and each one carries its own MAC address, IP addresses, MTU, state and counters, which makes the interface the basic object of network troubleshooting.
How a network interface works
A physical interface spans the lower layers of the OSI model. The PHY component handles signaling on copper, fiber or radio, the MAC component builds and checks Ethernet or Wi-Fi frames, and the operating system’s driver hands packets to and from the network stack, usually through ring buffers and DMA to keep CPU load low.
On the software side, the operating system exposes each interface under a name, such as eth0 or enp3s0 on Linux, en0 on macOS or a descriptive name on Windows. IP addresses belong to interfaces, not to devices, which is why a host with Ethernet and Wi-Fi connected can have two different addresses at the same time, and why the routing table lists an outgoing interface for every route.
The table below lists the main properties an interface carries.
| Property | Typical values | What it affects |
|---|---|---|
| MAC address | 48-bit, such as 3c:22:fb:1a:09:7e | Layer 2 identity on the local segment |
| IP addresses | One or more IPv4 and IPv6 | Layer 3 reachability |
| MTU | 1500 bytes standard, up to about 9000 with jumbo frames | Largest packet without fragmentation |
| Link speed and duplex | 100 Mb/s to 400 Gb/s, full duplex | Throughput ceiling |
| Operational state | Up, down, dormant | Whether traffic can flow |
| Counters | Packets, bytes, errors, drops | Health and utilization |
Physical and virtual interface types
Modern systems use far more virtual interfaces than physical ones. Virtualization, containers, VPNs and VLANs each create logical interfaces that behave like real ports to the network stack while existing only in software.
| Type | Example name | Purpose |
|---|---|---|
| Ethernet | eth0, enp3s0 | Wired LAN connection |
| Wireless | wlan0, en0 | WLAN connection over Wi-Fi |
| Loopback | lo, 127.0.0.1 and ::1 | Traffic to the host itself |
| VLAN subinterface | eth0.20 | Tagged traffic for one VLAN |
| Bridge | br0 | Software switch joining interfaces |
| Bond or team | bond0 | Link aggregation for capacity or redundancy |
| Tunnel | tun0, wg0 | VPN or encapsulated traffic |
| Virtual Ethernet pair | veth | Connects containers to the host |
On network equipment, the same idea applies with different names. Routers and Layer 3 switches use routed ports, subinterfaces and switch virtual interfaces (SVIs), which give a VLAN an IP address so the switch can route between VLANs.
Network interface compared with related concepts
Several terms are used loosely as synonyms for a network interface, but they describe different things. Precision matters when reading documentation or diagnostic output.
| Term | What it is | Relation to the interface |
|---|---|---|
| Network interface card | Physical adapter hardware | Provides one or more physical interfaces |
| Port | Physical socket on a device, or a transport-layer number | A physical port maps to one interface |
| MAC address | Layer 2 identifier | A property of an interface |
| Network node | Any device on the network | Owns one or more interfaces |
| Socket | Endpoint of an application connection | Bound to an address of an interface |
The ambiguity of port causes frequent confusion: a switch port is a physical interface, while TCP port 443 is a transport-layer number that has nothing to do with hardware. Context, usually Layer 1-2 versus Layer 4, decides which meaning applies.
Configuring and inspecting interfaces
Administrators inspect interfaces with tools such as ip addr and ip link on Linux, ifconfig on macOS and BSD, ipconfig and Get-NetAdapter on Windows, and show interfaces on network devices. These commands reveal state, addresses, MTU and error counters, which are the first data points in almost any connectivity problem.
Configuration choices with real impact include static versus DHCP addressing, the interface metric that decides which interface wins when several offer a default route, MTU settings for tunnels, and offload features such as checksum and segmentation offload, which move work from the CPU to the NIC.
Interfaces can also be bound to services and firewall zones. A server may listen for administrative SSH only on its management interface, and host firewalls commonly assign each interface to a zone with its own rules. Binding services to 0.0.0.0 or :: exposes them on every interface, which is a common source of unintended exposure.
Common interface problems
Interface faults show characteristic symptoms in the counters, which makes them diagnosable without packet capture in many cases. The table maps typical observations to their usual causes.
| Symptom | Likely cause | Typical fix |
|---|---|---|
| Rising CRC or input errors | Damaged cable, bad optic or interference | Replace cabling or transceiver |
| Late collisions, low throughput | Duplex mismatch | Set both ends to autonegotiation |
| Large transfers stall, small work | MTU mismatch or blocked ICMP | Align MTU, allow path MTU discovery |
| Traffic leaves wrong interface | Interface metric or route priority | Adjust metrics or routing table |
| Link flapping | Faulty port, power saving or negotiation | Check logs, disable energy features |
A frequent pitfall on servers is interface naming changes after hardware replacement or driver updates, which can leave configuration bound to a name that no longer exists. Predictable naming schemes and configuration by MAC address reduce this risk.
Put simply
A network interface is the doorway between a device and a network. A laptop usually has at least two doorways: one for the cable and one for Wi-Fi. Each doorway has its own address, so the network knows where to deliver data.
Some doorways are real pieces of hardware. Others exist only in software, such as the one a VPN creates. The computer treats both kinds the same way. When the internet stops working, checking these doorways is often the first step to finding the problem.
In practice
A system administrator sets up a virtualization host with two 25 Gb/s Ethernet ports. She combines them into a bond interface for redundancy, then creates VLAN subinterfaces on the bond for the management, storage and guest networks. Each VLAN subinterface is attached to a software bridge, and virtual machines connect to the bridges through their own virtual interfaces.
A week later, users report that file copies from one virtual machine stall while web browsing works. Inspecting the interfaces shows that the storage VLAN was configured with a 9000-byte MTU on the host but the upstream switch port allows only 1500 bytes. After aligning the MTU on both ends, large transfers run at full speed, and the counters show no further drops.