How to Use ip Command in Linux: The Modern Network Tool Every Admin Needs

If you’ve tried typing ifconfig on a fresh Linux install lately, you might have been greeted by a frustrating “command not found” message. Don’t panic. You’re not missing anything critical. Linux networking has simply moved on. The ip command in Linux is the modern standard, and it’s been waiting for you to catch up.

I remember the first time I encountered this shift. Years of muscle memory typing ifconfig, suddenly useless. But here’s the thing: once you learn the ip command, you’ll never want to go back. It’s cleaner, more powerful, and does everything in one unified tool. Let me show you exactly how to use it.

What is the ip Command in Linux?

The ip command is part of the iproute2 package. It handles all your network configuration needs on modern Linux systems. Think of it as your Swiss Army knife for networking. You can view interfaces, assign IP addresses, manage routes, and inspect ARP tables. All from one command with consistent syntax.

This tool has been the standard since 2009. Yet many tutorials still teach ifconfig. If you’re studying for a certification or following outdated guides, you might not realize how much has changed. The ip command isn’t just a replacement. It’s a significant upgrade.

Why ip Replaced ifconfig and net-tools

The old net-tools package (ifconfig, route, arp, netstat) stopped receiving active maintenance years ago. Ubuntu doesn’t even install ifconfig by default anymore. But the technical reasons matter more than the politics.

The ip command uses netlink protocol documentation for kernel communication. This is fundamentally different from ifconfig’s ioctl approach. Why does this matter to you?

• Network namespaces: The ip command supports container networking that ifconfig simply cannot handle
• Multiple IP addresses: Adding secondary IPs to an interface is straightforward
• Unified syntax: One tool instead of juggling ifconfig, route, arp, and netstat
• Better output: Color coding, brief modes, and statistics at your fingertips

How ip Command Works with netlink

Without getting too deep into kernel internals, netlink is a socket-based interface between user space and kernel. The ip command speaks directly to the kernel’s networking subsystem through this channel. It’s faster and more capable than the old ioctl system calls that ifconfig used.

This architecture enables features like network namespaces, which are essential for modern container workflows. If you work with Docker or Kubernetes, you’re already benefiting from this design. Even if you don’t realize it.

Basic ip Command Syntax and Structure

Here’s the foundation you need. Every ip command follows this pattern:

That’s it. Once you understand this structure, everything clicks into place. The OBJECT tells ip what you’re working with. The COMMAND tells it what to do. Options modify the output format.

Understanding ip Command Objects

The ip command organizes network configuration by objects. This aligns with the OSI model layers, making it logical once you see the pattern:

• link: Layer 2 operations (MAC addresses, interface state, MTU)
• addr: Layer 3 IP address configuration
• route: Routing table management
• neigh: Neighbor discovery cache (ARP and NDP entries)

Each object has its own set of commands like show, add, del, and set. The official ip command manual covers every option, but you’ll use the same handful constantly.

Common Options You’ll Actually Use

Three options will change your daily workflow:

• -c (color): Adds color coding to output. Makes scanning results much faster
• -s (statistics): Shows packet counts and error statistics
• -br (brief): Condensed tabular output. Perfect for quick checks

Try running ip -c -br addr right now. That brief, colorized view of your IP addresses will become a favorite.

Viewing Network Interface Information

Let’s get practical. You need to see what’s happening on your network interfaces. The ip command gives you two complementary views.

ip link show – Layer 2 Interface Properties

The ip link show command displays Layer 2 information. You’ll see interface names, MAC addresses, MTU values, and whether interfaces are UP or DOWN.

$ ip link show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP
    link/ether 00:15:5d:01:02:03 brd ff:ff:ff:ff:ff:ff

Those flags in angle brackets tell the story. BROADCAST means the interface supports broadcasting. UP means administratively enabled. LOWER_UP means the physical link is active.

ip addr show – IP Address Configuration

The ip addr show (or just ip a for short) displays both Layer 2 and Layer 3 information. You’ll see your IPv4 and IPv6 addresses, subnet masks in CIDR notation, and scope information.

$ ip addr show dev eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500
    link/ether 00:15:5d:01:02:03 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.100/24 brd 192.168.1.255 scope global eth0
    inet6 fe80::215:5dff:fe01:203/64 scope link

Want to check a specific interface? Use ip addr show dev eth0. The brief mode works great here too: ip -br addr gives you a clean, scannable list.

Managing IP Addresses with ip Command

Viewing is useful. But eventually you need to make changes. The ip command makes address management straightforward, though there’s one critical caveat I’ll explain shortly.

Adding IP Addresses to Interfaces

To assign an IP address, you’ll need root privileges. The syntax follows the same pattern:

Notice the CIDR notation (/24). This replaces the separate netmask argument that ifconfig required. Cleaner and less error-prone.

Removing IP Addresses

Removing addresses uses the same syntax with del instead of add:

You must specify the exact address including subnet mask. The ip command won’t guess which address you mean if multiple exist.

Multiple Addresses on Same Interface

Here’s where the ip command shines. Adding multiple IP addresses to a single interface is trivial. Just run the add command again with a different address. No aliases, no workarounds.

sudo ip addr add 192.168.1.50/24 dev eth0
sudo ip addr add 192.168.1.51/24 dev eth0
sudo ip addr add 10.0.0.100/8 dev eth0

This was painful with ifconfig. You needed pseudo-interfaces like eth0:0 and eth0:1. The ip command treats multiple addresses as a natural capability.

Bringing Network Interfaces Up and Down

Sometimes you need to restart an interface. Maybe you’re troubleshooting, testing configuration changes, or forcing a DHCP renewal. The ip link command handles this.

sudo ip link set dev eth0 down
sudo ip link set dev eth0 up

A word of caution: if you’re connected via SSH over that interface, you’ll lose your connection. I’ve locked myself out of remote servers this way. Always have out-of-band access or a console connection when making network changes remotely.

When troubleshooting interface issues, you’ll want to check on managing network services that depend on those interfaces. Bringing an interface down affects everything running through it.

Working with Routing Tables

The ip route command replaced the old route utility. If packets aren’t reaching their destination, this is where you look.

Viewing Routes with ip route show

To see your current routing table:

$ ip route show
default via 192.168.1.1 dev eth0 proto dhcp metric 100
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.100

The first line shows your default gateway. All traffic without a more specific route goes there. The second line shows the directly connected network on eth0.

Adding and Deleting Static Routes

Need to route a specific network through a different gateway? Add a static route:

sudo ip route add 10.10.0.0/16 via 192.168.1.254
sudo ip route del 10.10.0.0/16

This is critical for multi-homed systems, VPN configurations, and complex network topologies. If you’re running a server with multiple network interfaces, mastering ip route is essential.

Checking ARP Cache with ip neigh

The ip neigh command shows your ARP cache (IPv4) and neighbor discovery cache (IPv6). This replaces the old arp command and helps troubleshoot Layer 2 connectivity issues.

$ ip neigh show
192.168.1.1 dev eth0 lladdr 00:11:22:33:44:55 REACHABLE
192.168.1.50 dev eth0 lladdr 00:aa:bb:cc:dd:ee STALE

The state tells you about entry freshness. REACHABLE means recently confirmed. STALE means it hasn’t been verified lately. FAILED means resolution didn’t work.

If you’re troubleshooting why a host can’t communicate despite correct IP configuration, check the ARP cache. The ARP protocol RFC explains the underlying mechanism if you want the full technical picture.

Practical Examples Every Admin Should Know

Theory is great, but you need workflows you can use immediately. Here’s how I approach network diagnostics.

Quick Network Diagnostics Workflow

When troubleshooting connectivity, I follow this sequence:

1. Check interface status: ip -br link (are interfaces UP?)
2. Verify IP addresses: ip -br addr (correct IPs assigned?)
3. Check routing: ip route (default gateway correct?)
4. Test gateway: Use testing connectivity with ping to reach your gateway
5. Check ARP: ip neigh (Layer 2 resolution working?)
6. Review logs: Use checking system logs with journalctl for interface errors

This systematic approach catches most networking issues. Each step builds on the previous one, moving up the network stack.

Common Troubleshooting Scenarios

Here are real situations you’ll encounter:

Interface shows DOWN:

No IP address assigned (DHCP not working):

Wrong default gateway:

sudo ip route del default
sudo ip route add default via 192.168.1.1

After making changes, verify the fix worked. Try checking open ports and testing application connectivity with curl for testing HTTP connectivity.

For deeper socket-level analysis, the ss command for socket statistics pairs perfectly with ip command diagnostics. These tools replaced the old net-tools package together.

Making Network Changes Permanent

Critical point: Everything you do with the ip command is temporary. Reboot your system and your changes vanish. This catches many new admins off guard.

The ip command is perfect for testing changes. Verify everything works correctly. Then make it permanent through configuration files.

The exact method depends on your distribution and network manager:

• Debian/Ubuntu (Netplan): Edit files in /etc/netplan/
• RHEL/CentOS (NetworkManager): Use nmcli or edit files in /etc/NetworkManager/system-connections/
• Arch Linux: systemd-networkd files in /etc/systemd/network/

Always backup your configuration files before making changes. A syntax error can leave you without network connectivity on reboot. Test your changes with ip first, then commit them to permanent configuration.

For comprehensive network interface troubleshooting, understanding both the temporary ip commands and permanent configuration is essential.

Start Using the ip Command Today

The ip command isn’t just a replacement for ifconfig. It’s a better tool that reflects how modern Linux networking actually works. The unified syntax, netlink integration, and powerful features make it worth learning properly.

Start with the basics: ip addr, ip link, ip route. Add the -c and -br flags to your workflow. Practice making temporary changes and observing the results. The syntax will become muscle memory faster than you expect.

If you want to explore the source code or contribute improvements, the iproute2 source repository is publicly available.

Your networking skills will level up considerably once you master this tool. And the next time someone asks about ifconfig, you’ll have a better answer ready.