]>
Commit | Line | Data |
---|---|---|
985794ad SH |
1 | .TH IP 8 "17 January 2002" "iproute2" "Linux" |
2 | .SH NAME | |
3 | ip \- show / manipulate routing, devices, policy routing and tunnels | |
4 | .SH SYNOPSIS | |
5 | ||
6 | .ad l | |
7 | .in +8 | |
8 | .ti -8 | |
9 | .B ip | |
10 | .RI "[ " OPTIONS " ] " OBJECT " { " COMMAND " | " | |
11 | .BR help " }" | |
12 | .sp | |
13 | ||
14 | .ti -8 | |
15 | .IR OBJECT " := { " | |
4759758c YH |
16 | .BR link " | " addr " | " addrlabel " | " route " | " rule " | " neigh " | "\ |
17 | tunnel " | " maddr " | " mroute " | " monitor " }" | |
985794ad SH |
18 | .sp |
19 | ||
20 | .ti -8 | |
ae9b671d | 21 | .IR OPTIONS " := { " |
985794ad SH |
22 | \fB\-V\fR[\fIersion\fR] | |
23 | \fB\-s\fR[\fItatistics\fR] | | |
24 | \fB\-r\fR[\fIesolve\fR] | | |
25 | \fB\-f\fR[\fIamily\fR] { | |
26 | .BR inet " | " inet6 " | " ipx " | " dnet " | " link " } | " | |
27 | \fB\-o\fR[\fIneline\fR] } | |
28 | ||
df33d7a4 SH |
29 | .ti -8 |
30 | .BI "ip link add link " DEVICE | |
31 | .RB "[ " name " ]" | |
32 | .I NAME | |
33 | .br | |
34 | .RB "[ " txqueuelen | |
35 | .IR PACKETS " ]" | |
36 | .br | |
37 | .RB "[ " address | |
38 | .IR LLADDR " ]" | |
39 | .RB "[ " broadcast | |
40 | .IR LLADDR " ]" | |
41 | .br | |
42 | .RB "[ " mtu | |
43 | .IR MTU " ]" | |
44 | .br | |
2c19bf6a | 45 | .BR type " TYPE" |
df33d7a4 SH |
46 | .RI "[ " ARGS " ]" |
47 | ||
48 | .ti -8 | |
49 | .IR TYPE " := [ " | |
50 | .BR vlan " | " maclan " | " can " ]" | |
51 | ||
52 | .ti -8 | |
53 | .BI "ip link delete " DEVICE | |
2c19bf6a | 54 | .BI type " TYPE" |
df33d7a4 SH |
55 | .RI "[ " ARGS " ]" |
56 | ||
985794ad SH |
57 | .ti -8 |
58 | .BI "ip link set " DEVICE | |
59 | .RB "{ " up " | " down " | " arp " { " on " | " off " } |" | |
60 | .br | |
61 | .BR promisc " { " on " | " off " } |" | |
62 | .br | |
ea5dd59c | 63 | .BR allmulticast " { " on " | " off " } |" |
985794ad SH |
64 | .br |
65 | .BR dynamic " { " on " | " off " } |" | |
66 | .br | |
67 | .BR multicast " { " on " | " off " } |" | |
68 | .br | |
69 | .B txqueuelen | |
70 | .IR PACKETS " |" | |
71 | .br | |
72 | .B name | |
73 | .IR NEWNAME " |" | |
74 | .br | |
75 | .B address | |
76 | .IR LLADDR " |" | |
ae9b671d | 77 | .B broadcast |
985794ad SH |
78 | .IR LLADDR " |" |
79 | .br | |
80 | .B mtu | |
e2613dc8 BT |
81 | .IR MTU " |" |
82 | .br | |
83 | .B netns | |
46dab6e9 WM |
84 | .IR PID " |" |
85 | .br | |
86 | .B alias | |
87 | .IR NAME " |" | |
88 | .br | |
89 | .B vf | |
90 | .IR NUM " [" | |
91 | .B mac | |
92 | .IR LLADDR " ] [" | |
93 | .B vlan | |
94 | .IR VLANID " [ " | |
95 | .B qos | |
96 | .IR VLAN-QOS " ] ] [" | |
97 | .B rate | |
98 | .IR TXRATE " ]" | |
985794ad SH |
99 | |
100 | .ti -8 | |
101 | .B ip link show | |
ac694c33 VD |
102 | .RI "[ " DEVICE " | " |
103 | .B group | |
104 | .IR GROUP " ]" | |
985794ad SH |
105 | |
106 | .ti -8 | |
ae9b671d | 107 | .BR "ip addr" " { " add " | " del " } " |
985794ad SH |
108 | .IB IFADDR " dev " STRING |
109 | ||
110 | .ti -8 | |
111 | .BR "ip addr" " { " show " | " flush " } [ " dev | |
112 | .IR STRING " ] [ " | |
113 | .B scope | |
114 | .IR SCOPE-ID " ] [ " | |
ae9b671d | 115 | .B to |
985794ad SH |
116 | .IR PREFIX " ] [ " FLAG-LIST " ] [ " |
117 | .B label | |
118 | .IR PATTERN " ]" | |
119 | ||
120 | .ti -8 | |
121 | .IR IFADDR " := " PREFIX " | " ADDR | |
122 | .B peer | |
123 | .IR PREFIX " [ " | |
124 | .B broadcast | |
125 | .IR ADDR " ] [ " | |
126 | .B anycast | |
127 | .IR ADDR " ] [ " | |
128 | .B label | |
129 | .IR STRING " ] [ " | |
130 | .B scope | |
131 | .IR SCOPE-ID " ]" | |
132 | ||
133 | .ti -8 | |
134 | .IR SCOPE-ID " := " | |
135 | .RB "[ " host " | " link " | " global " | " | |
136 | .IR NUMBER " ]" | |
137 | ||
138 | .ti -8 | |
139 | .IR FLAG-LIST " := [ " FLAG-LIST " ] " FLAG | |
140 | ||
141 | .ti -8 | |
142 | .IR FLAG " := " | |
143 | .RB "[ " permanent " | " dynamic " | " secondary " | " primary " | "\ | |
a1b9ffcc | 144 | tentative " | " deprecated " | " dadfailed " | " temporary " ]" |
985794ad | 145 | |
4759758c | 146 | .ti -8 |
ae9b671d | 147 | .BR "ip addrlabel" " { " add " | " del " } " prefix |
4759758c YH |
148 | .BR PREFIX " [ " |
149 | .B dev | |
150 | .IR DEV " ] [ " | |
151 | .B label | |
152 | .IR NUMBER " ]" | |
153 | ||
154 | .ti -8 | |
155 | .BR "ip addrlabel" " { " list " | " flush " }" | |
156 | ||
985794ad SH |
157 | .ti -8 |
158 | .BR "ip route" " { " | |
159 | .BR list " | " flush " } " | |
160 | .I SELECTOR | |
161 | ||
f4ff11e3 DS |
162 | .ti -8 |
163 | .BR "ip route save" | |
164 | .I SELECTOR | |
165 | ||
166 | .ti -8 | |
167 | .BR "ip route restore" | |
168 | ||
985794ad | 169 | .ti -8 |
ae9b671d | 170 | .B ip route get |
985794ad SH |
171 | .IR ADDRESS " [ " |
172 | .BI from " ADDRESS " iif " STRING" | |
ae9b671d | 173 | .RB " ] [ " oif |
985794ad SH |
174 | .IR STRING " ] [ " |
175 | .B tos | |
176 | .IR TOS " ]" | |
177 | ||
178 | .ti -8 | |
179 | .BR "ip route" " { " add " | " del " | " change " | " append " | "\ | |
180 | replace " | " monitor " } " | |
181 | .I ROUTE | |
182 | ||
183 | .ti -8 | |
184 | .IR SELECTOR " := " | |
185 | .RB "[ " root | |
186 | .IR PREFIX " ] [ " | |
187 | .B match | |
188 | .IR PREFIX " ] [ " | |
189 | .B exact | |
190 | .IR PREFIX " ] [ " | |
191 | .B table | |
192 | .IR TABLE_ID " ] [ " | |
193 | .B proto | |
194 | .IR RTPROTO " ] [ " | |
195 | .B type | |
196 | .IR TYPE " ] [ " | |
197 | .B scope | |
198 | .IR SCOPE " ]" | |
199 | ||
200 | .ti -8 | |
201 | .IR ROUTE " := " NODE_SPEC " [ " INFO_SPEC " ]" | |
202 | ||
203 | .ti -8 | |
204 | .IR NODE_SPEC " := [ " TYPE " ] " PREFIX " [" | |
205 | .B tos | |
206 | .IR TOS " ] [ " | |
207 | .B table | |
208 | .IR TABLE_ID " ] [ " | |
209 | .B proto | |
210 | .IR RTPROTO " ] [ " | |
211 | .B scope | |
212 | .IR SCOPE " ] [ " | |
213 | .B metric | |
214 | .IR METRIC " ]" | |
215 | ||
216 | .ti -8 | |
217 | .IR INFO_SPEC " := " "NH OPTIONS FLAGS" " [" | |
218 | .B nexthop | |
219 | .IR NH " ] ..." | |
220 | ||
221 | .ti -8 | |
222 | .IR NH " := [ " | |
223 | .B via | |
224 | .IR ADDRESS " ] [ " | |
225 | .B dev | |
226 | .IR STRING " ] [ " | |
227 | .B weight | |
228 | .IR NUMBER " ] " NHFLAGS | |
229 | ||
230 | .ti -8 | |
231 | .IR OPTIONS " := " FLAGS " [ " | |
232 | .B mtu | |
233 | .IR NUMBER " ] [ " | |
234 | .B advmss | |
235 | .IR NUMBER " ] [ " | |
236 | .B rtt | |
54e0b2e7 | 237 | .IR TIME " ] [ " |
985794ad | 238 | .B rttvar |
54e0b2e7 | 239 | .IR TIME " ] [ " |
985794ad SH |
240 | .B window |
241 | .IR NUMBER " ] [ " | |
242 | .B cwnd | |
243 | .IR NUMBER " ] [ " | |
244 | .B ssthresh | |
245 | .IR REALM " ] [ " | |
246 | .B realms | |
54e0b2e7 RJ |
247 | .IR REALM " ] [ " |
248 | .B rto_min | |
6299857d BB |
249 | .IR TIME " ] [ " |
250 | .B initcwnd | |
704f4df4 SH |
251 | .IR NUMBER " ] [ " |
252 | .B initrwnd | |
6299857d | 253 | .IR NUMBER " ]" |
985794ad SH |
254 | |
255 | .ti -8 | |
256 | .IR TYPE " := [ " | |
257 | .BR unicast " | " local " | " broadcast " | " multicast " | "\ | |
258 | throw " | " unreachable " | " prohibit " | " blackhole " | " nat " ]" | |
259 | ||
260 | .ti -8 | |
261 | .IR TABLE_ID " := [ " | |
262 | .BR local "| " main " | " default " | " all " |" | |
263 | .IR NUMBER " ]" | |
264 | ||
265 | .ti -8 | |
266 | .IR SCOPE " := [ " | |
267 | .BR host " | " link " | " global " |" | |
268 | .IR NUMBER " ]" | |
269 | ||
985794ad SH |
270 | .ti -8 |
271 | .IR NHFLAGS " := [ " | |
272 | .BR onlink " | " pervasive " ]" | |
273 | ||
274 | .ti -8 | |
275 | .IR RTPROTO " := [ " | |
276 | .BR kernel " | " boot " | " static " |" | |
277 | .IR NUMBER " ]" | |
278 | ||
279 | .ti -8 | |
280 | .B ip rule | |
890fe64e | 281 | .RB " [ " list " | " add " | " del " | " flush " ]" |
985794ad SH |
282 | .I SELECTOR ACTION |
283 | ||
284 | .ti -8 | |
285 | .IR SELECTOR " := [ " | |
286 | .B from | |
287 | .IR PREFIX " ] [ " | |
288 | .B to | |
289 | .IR PREFIX " ] [ " | |
290 | .B tos | |
291 | .IR TOS " ] [ " | |
292 | .B fwmark | |
be7f286e | 293 | .IR FWMARK[/MASK] " ] [ " |
85eae222 PM |
294 | .B iif |
295 | .IR STRING " ] [ " | |
296 | .B oif | |
985794ad SH |
297 | .IR STRING " ] [ " |
298 | .B pref | |
299 | .IR NUMBER " ]" | |
300 | ||
301 | .ti -8 | |
302 | .IR ACTION " := [ " | |
303 | .B table | |
304 | .IR TABLE_ID " ] [ " | |
305 | .B nat | |
306 | .IR ADDRESS " ] [ " | |
307 | .BR prohibit " | " reject " | " unreachable " ] [ " realms | |
308 | .RI "[" SRCREALM "/]" DSTREALM " ]" | |
309 | ||
310 | .ti -8 | |
311 | .IR TABLE_ID " := [ " | |
312 | .BR local " | " main " | " default " |" | |
313 | .IR NUMBER " ]" | |
314 | ||
315 | .ti -8 | |
316 | .BR "ip neigh" " { " add " | " del " | " change " | " replace " } { " | |
317 | .IR ADDR " [ " | |
318 | .B lladdr | |
319 | .IR LLADDR " ] [ " | |
320 | .BR nud " { " permanent " | " noarp " | " stale " | " reachable " } ] | " proxy | |
321 | .IR ADDR " } [ " | |
322 | .B dev | |
323 | .IR DEV " ]" | |
324 | ||
325 | .ti -8 | |
326 | .BR "ip neigh" " { " show " | " flush " } [ " to | |
327 | .IR PREFIX " ] [ " | |
328 | .B dev | |
329 | .IR DEV " ] [ " | |
330 | .B nud | |
331 | .IR STATE " ]" | |
332 | ||
333 | .ti -8 | |
a07e9912 | 334 | .BR "ip tunnel" " { " add " | " change " | " del " | " show " | " prl " }" |
985794ad SH |
335 | .RI "[ " NAME " ]" |
336 | .br | |
8a10d311 YH |
337 | .RB "[ " mode |
338 | .IR MODE " ] [ " | |
339 | .B remote | |
985794ad SH |
340 | .IR ADDR " ] [ " |
341 | .B local | |
342 | .IR ADDR " ]" | |
343 | .br | |
344 | .RB "[ [" i "|" o "]" seq " ] [ [" i "|" o "]" key | |
345 | .IR KEY " ] [ " | |
346 | .RB "[" i "|" o "]" csum " ] ]" | |
347 | .br | |
8a10d311 YH |
348 | .RB "[ " encaplimit |
349 | .IR ELIM " ]" | |
985794ad | 350 | .RB "[ " ttl |
8a10d311 YH |
351 | .IR TTL " ]" |
352 | .br | |
353 | .RB "[ " tos | |
985794ad | 354 | .IR TOS " ] [ " |
8a10d311 YH |
355 | .B flowlabel |
356 | .IR FLOWLABEL " ]" | |
985794ad | 357 | .br |
a07e9912 SH |
358 | .RB "[ " prl-default |
359 | .IR ADDR " ] [ " | |
360 | .B prl-nodefault | |
361 | .IR ADDR " ] [ " | |
362 | .B prl-delete | |
363 | .IR ADDR " ]" | |
364 | .br | |
8a10d311 | 365 | .RB "[ [" no "]" pmtudisc " ]" |
985794ad SH |
366 | .RB "[ " dev |
367 | .IR PHYS_DEV " ]" | |
8a10d311 YH |
368 | .RB "[ " "dscp inherit" " ]" |
369 | ||
370 | .ti -8 | |
371 | .IR MODE " := " | |
372 | .RB " { " ipip " | " gre " | " sit " | " isatap " | " ip6ip6 " | " ipip6 " | " any " }" | |
985794ad SH |
373 | |
374 | .ti -8 | |
375 | .IR ADDR " := { " IP_ADDRESS " |" | |
376 | .BR any " }" | |
377 | ||
378 | .ti -8 | |
379 | .IR TOS " := { " NUMBER " |" | |
380 | .BR inherit " }" | |
381 | ||
8a10d311 | 382 | .ti -8 |
ae9b671d | 383 | .IR ELIM " := { |
8a10d311 YH |
384 | .BR none " | " |
385 | .IR 0 ".." 255 " }" | |
386 | ||
387 | .ti -8 | |
985794ad SH |
388 | .ti -8 |
389 | .IR TTL " := { " 1 ".." 255 " | " | |
390 | .BR inherit " }" | |
391 | ||
392 | .ti -8 | |
393 | .IR KEY " := { " DOTTED_QUAD " | " NUMBER " }" | |
394 | ||
54e0b2e7 | 395 | .ti -8 |
fca1dae8 | 396 | .IR TIME " := " NUMBER "[s|ms]" |
54e0b2e7 | 397 | |
985794ad SH |
398 | .ti -8 |
399 | .BR "ip maddr" " [ " add " | " del " ]" | |
400 | .IB MULTIADDR " dev " STRING | |
401 | ||
402 | .ti -8 | |
403 | .BR "ip maddr show" " [ " dev | |
404 | .IR STRING " ]" | |
405 | ||
406 | .ti -8 | |
407 | .BR "ip mroute show" " [" | |
408 | .IR PREFIX " ] [ " | |
409 | .B from | |
410 | .IR PREFIX " ] [ " | |
411 | .B iif | |
412 | .IR DEVICE " ]" | |
413 | ||
414 | .ti -8 | |
415 | .BR "ip monitor" " [ " all " |" | |
416 | .IR LISTofOBJECTS " ]" | |
ae9b671d MM |
417 | |
418 | .ti -8 | |
419 | .BR "ip xfrm" | |
420 | .IR XFRM_OBJECT " { " COMMAND " }" | |
421 | ||
422 | .ti -8 | |
423 | .IR XFRM_OBJECT " := { " state " | " policy " | " monitor " } " | |
424 | ||
425 | .ti -8 | |
426 | .BR "ip xfrm state " { " add " | " update " } " | |
427 | .IR ID " [ " | |
428 | .IR XFRM_OPT " ] " | |
429 | .RB " [ " mode | |
430 | .IR MODE " ] " | |
431 | .br | |
432 | .RB " [ " reqid | |
433 | .IR REQID " ] " | |
434 | .RB " [ " seq | |
435 | .IR SEQ " ] " | |
436 | .RB " [ " replay-window | |
437 | .IR SIZE " ] " | |
438 | .br | |
439 | .RB " [ " flag | |
440 | .IR FLAG-LIST " ] " | |
441 | .RB " [ " encap | |
442 | .IR ENCAP " ] " | |
443 | .RB " [ " sel | |
444 | .IR SELECTOR " ] " | |
445 | .br | |
446 | .RB " [ " | |
447 | .IR LIMIT-LIST " ] " | |
448 | ||
449 | .ti -8 | |
450 | .BR "ip xfrm state allocspi " | |
451 | .IR ID | |
452 | .RB " [ " mode | |
453 | .IR MODE " ] " | |
454 | .RB " [ " reqid | |
455 | .IR REQID " ] " | |
456 | .RB " [ " seq | |
457 | .IR SEQ " ] " | |
458 | .RB " [ " min | |
459 | .IR SPI | |
460 | .B max | |
461 | .IR SPI " ] " | |
462 | ||
463 | .ti -8 | |
464 | .BR "ip xfrm state" " { " delete " | " get " } " | |
465 | .IR ID | |
466 | ||
467 | .ti -8 | |
468 | .BR "ip xfrm state" " { " deleteall " | " list " } [ " | |
469 | .IR ID " ] " | |
470 | .RB " [ " mode | |
471 | .IR MODE " ] " | |
472 | .br | |
473 | .RB " [ " reqid | |
474 | .IR REQID " ] " | |
475 | .RB " [ " flag | |
476 | .IR FLAG_LIST " ] " | |
477 | ||
478 | .ti -8 | |
479 | .BR "ip xfrm state flush" " [ " proto | |
480 | .IR XFRM_PROTO " ] " | |
481 | ||
482 | .ti -8 | |
483 | .BR "ip xfrm state count" | |
484 | ||
485 | .ti -8 | |
486 | .IR ID " := " | |
487 | .RB " [ " src | |
488 | .IR ADDR " ] " | |
489 | .RB " [ " dst | |
490 | .IR ADDR " ] " | |
491 | .RB " [ " proto | |
492 | .IR XFRM_PROTO " ] " | |
493 | .RB " [ " spi | |
494 | .IR SPI " ] " | |
495 | ||
496 | .ti -8 | |
497 | .IR XFRM_PROTO " := " | |
498 | .RB " [ " esp " | " ah " | " comp " | " route2 " | " hao " ] " | |
499 | ||
500 | .ti -8 | |
501 | .IR MODE " := " | |
502 | .RB " [ " transport " | " tunnel " | " ro " | " beet " ] " | |
83ad2dd7 | 503 | .B (default=transport) |
ae9b671d MM |
504 | |
505 | .ti -8 | |
506 | .IR FLAG-LIST " := " | |
507 | .RI " [ " FLAG-LIST " ] " FLAG | |
508 | ||
509 | .ti -8 | |
510 | .IR FLAG " := " | |
511 | .RB " [ " noecn " | " decap-dscp " | " wildrecv " ] " | |
512 | ||
513 | .ti -8 | |
514 | .IR ENCAP " := " ENCAP-TYPE " " SPORT " " DPORT " " OADDR | |
515 | ||
516 | .ti -8 | |
517 | .IR ENCAP-TYPE " := " | |
518 | .B espinudp | |
519 | .RB " | " | |
520 | .B espinudp-nonike | |
521 | ||
522 | .ti -8 | |
523 | .IR ALGO-LIST " := [ " | |
524 | .IR ALGO-LIST " ] | [ " | |
525 | .IR ALGO " ] " | |
526 | ||
527 | .ti -8 | |
528 | .IR ALGO " := " | |
529 | .IR ALGO_TYPE | |
530 | .IR ALGO_NAME | |
531 | .IR ALGO_KEY | |
532 | ||
533 | .ti -8 | |
534 | .IR ALGO_TYPE " := " | |
535 | .RB " [ " enc " | " auth " | " comp " ] " | |
536 | ||
537 | .ti -8 | |
538 | .IR SELECTOR " := " | |
539 | .B src | |
540 | .IR ADDR "[/" PLEN "]" | |
541 | .B dst | |
542 | .IR ADDR "[/" PLEN "]" | |
543 | .RI " [ " UPSPEC " ] " | |
544 | .RB " [ " dev | |
545 | .IR DEV " ] " | |
546 | ||
547 | .ti -8 | |
548 | .IR UPSPEC " := " | |
549 | .B proto | |
550 | .IR PROTO " [[ " | |
551 | .B sport | |
552 | .IR PORT " ] " | |
553 | .RB " [ " dport | |
554 | .IR PORT " ] | " | |
555 | .br | |
556 | .RB " [ " type | |
557 | .IR NUMBER " ] " | |
558 | .RB " [ " code | |
4a9608e6 TT |
559 | .IR NUMBER " ] | " |
560 | .br | |
561 | .RB " [ " key | |
562 | .IR KEY " ]] " | |
ae9b671d MM |
563 | |
564 | .ti -8 | |
565 | .IR LIMIT-LIST " := [ " LIMIT-LIST " ] |" | |
566 | .RB " [ "limit | |
567 | .IR LIMIT " ] " | |
568 | ||
569 | .ti -8 | |
570 | .IR LIMIT " := " | |
571 | .RB " [ [" time-soft "|" time-hard "|" time-use-soft "|" time-use-hard "]" | |
572 | .IR SECONDS " ] | " | |
573 | .RB "[ ["byte-soft "|" byte-hard "]" | |
574 | .IR SIZE " ] | " | |
575 | .br | |
576 | .RB " [ ["packet-soft "|" packet-hard "]" | |
577 | .IR COUNT " ] " | |
578 | ||
579 | .ti -8 | |
580 | .BR "ip xfrm policy" " { " add " | " update " } " " dir " | |
581 | .IR DIR | |
582 | .IR SELECTOR " [ " | |
583 | .BR index | |
584 | .IR INDEX " ] " | |
585 | .br | |
586 | .RB " [ " ptype | |
587 | .IR PTYPE " ] " | |
588 | .RB " [ " action | |
589 | .IR ACTION " ] " | |
590 | .RB " [ " priority | |
591 | .IR PRIORITY " ] " | |
592 | .br | |
593 | .RI " [ " LIMIT-LIST " ] [ " | |
594 | .IR TMPL-LIST " ] " | |
595 | ||
596 | .ti -8 | |
597 | .BR "ip xfrm policy" " { " delete " | " get " } " " dir " | |
598 | .IR DIR " [ " SELECTOR " | " | |
599 | .BR index | |
600 | .IR INDEX | |
601 | .RB " ] " | |
602 | .br | |
603 | .RB " [ " ptype | |
604 | .IR PTYPE " ] " | |
605 | ||
606 | .ti -8 | |
607 | .BR "ip xfrm policy" " { " deleteall " | " list " } " | |
608 | .RB " [ " dir | |
609 | .IR DIR " ] [ " | |
610 | .IR SELECTOR " ] " | |
611 | .br | |
612 | .RB " [ " index | |
613 | .IR INDEX " ] " | |
614 | .RB " [ " action | |
615 | .IR ACTION " ] " | |
616 | .RB " [ " priority | |
617 | .IR PRIORITY " ] " | |
618 | ||
619 | .ti -8 | |
620 | .B "ip xfrm policy flush" | |
621 | .RB " [ " ptype | |
622 | .IR PTYPE " ] " | |
623 | ||
624 | .ti -8 | |
625 | .B "ip xfrm count" | |
626 | ||
627 | .ti -8 | |
628 | .IR PTYPE " := " | |
629 | .RB " [ " main " | " sub " ] " | |
83ad2dd7 | 630 | .B (default=main) |
ae9b671d MM |
631 | |
632 | .ti -8 | |
633 | .IR DIR " := " | |
634 | .RB " [ " in " | " out " | " fwd " ] " | |
635 | ||
636 | .ti -8 | |
637 | .IR SELECTOR " := " | |
638 | .B src | |
639 | .IR ADDR "[/" PLEN "]" | |
640 | .B dst | |
641 | .IR ADDR "[/" PLEN] " [ " UPSPEC | |
642 | .RB " ] [ " dev | |
643 | .IR DEV " ] " | |
644 | ||
645 | .ti -8 | |
646 | .IR UPSPEC " := " | |
647 | .B proto | |
648 | .IR PROTO " [ " | |
649 | .RB " [ " sport | |
650 | .IR PORT " ] " | |
651 | .RB " [ " dport | |
652 | .IR PORT " ] | " | |
653 | .br | |
654 | .RB " [ " type | |
655 | .IR NUMBER " ] " | |
656 | .RB " [ " code | |
4a9608e6 TT |
657 | .IR NUMBER " ] | " |
658 | .br | |
659 | .RB " [ " key | |
660 | .IR KEY " ] ] " | |
ae9b671d MM |
661 | |
662 | .ti -8 | |
663 | .IR ACTION " := " | |
664 | .RB " [ " allow " | " block " ]" | |
83ad2dd7 | 665 | .B (default=allow) |
ae9b671d MM |
666 | |
667 | .ti -8 | |
668 | .IR LIMIT-LIST " := " | |
669 | .RB " [ " | |
670 | .IR LIMIT-LIST " ] | " | |
671 | .RB " [ " limit | |
672 | .IR LIMIT " ] " | |
673 | ||
674 | .ti -8 | |
675 | .IR LIMIT " := " | |
676 | .RB " [ [" time-soft "|" time-hard "|" time-use-soft "|" time-use-hard "]" | |
677 | .IR SECONDS " ] | " | |
678 | .RB " [ [" byte-soft "|" byte-hard "]" | |
679 | .IR SIZE " ] | " | |
680 | .br [ " | |
681 | .RB "[" packet-soft "|" packet-hard "]" | |
682 | .IR NUMBER " ] " | |
683 | ||
684 | .ti -8 | |
685 | .IR TMPL-LIST " := " | |
83ad2dd7 | 686 | .B " [ " |
ae9b671d MM |
687 | .IR TMPL-LIST " ] | " |
688 | .RB " [ " tmpl | |
689 | .IR TMPL " ] " | |
690 | ||
691 | .ti -8 | |
692 | .IR TMPL " := " | |
693 | .IR ID " [ " | |
694 | .B mode | |
695 | .IR MODE " ] " | |
696 | .RB " [ " reqid | |
697 | .IR REQID " ] " | |
698 | .RB " [ " level | |
699 | .IR LEVEL " ] " | |
700 | ||
701 | .ti -8 | |
702 | .IR ID " := " | |
703 | .RB " [ " src | |
704 | .IR ADDR " ] " | |
705 | .RB " [ " dst | |
706 | .IR ADDR " ] " | |
707 | .RB " [ " proto | |
708 | .IR XFRM_PROTO " ] " | |
709 | .RB " [ " spi | |
710 | .IR SPI " ] " | |
711 | ||
712 | .ti -8 | |
713 | .IR XFRM_PROTO " := " | |
714 | .RB " [ " esp " | " ah " | " comp " | " route2 " | " hao " ] " | |
715 | ||
716 | .ti -8 | |
717 | .IR MODE " := " | |
718 | .RB " [ " transport " | " tunnel " | " beet " ] " | |
83ad2dd7 | 719 | .B (default=transport) |
ae9b671d MM |
720 | |
721 | .ti -8 | |
722 | .IR LEVEL " := " | |
723 | .RB " [ " required " | " use " ] " | |
83ad2dd7 | 724 | .B (default=required) |
ae9b671d MM |
725 | |
726 | .ti -8 | |
727 | .BR "ip xfrm monitor" " [ " all " | " | |
728 | .IR LISTofOBJECTS " ] " | |
729 | ||
985794ad SH |
730 | .in -8 |
731 | .ad b | |
732 | ||
733 | .SH OPTIONS | |
734 | ||
735 | .TP | |
736 | .BR "\-V" , " -Version" | |
737 | print the version of the | |
738 | .B ip | |
739 | utility and exit. | |
740 | ||
741 | .TP | |
742 | .BR "\-s" , " \-stats", " \-statistics" | |
743 | output more information. If the option | |
744 | appears twice or more, the amount of information increases. | |
745 | As a rule, the information is statistics or some time values. | |
746 | ||
64c79560 BG |
747 | .TP |
748 | .BR "\-l" , " \-loops" | |
749 | Specify maximum number of loops the 'ip addr flush' logic | |
750 | will attempt before giving up. The default is 10. | |
751 | Zero (0) means loop until all addresses are removed. | |
752 | ||
985794ad SH |
753 | .TP |
754 | .BR "\-f" , " \-family" | |
755 | followed by protocol family identifier: | |
756 | .BR "inet" , " inet6" | |
757 | or | |
758 | .B link | |
759 | ,enforce the protocol family to use. If the option is not present, | |
ae9b671d | 760 | the protocol family is guessed from other arguments. If the rest |
985794ad SH |
761 | of the command line does not give enough information to guess the |
762 | family, | |
763 | .B ip | |
764 | falls back to the default one, usually | |
765 | .B inet | |
766 | or | |
767 | .BR "any" . | |
768 | .B link | |
769 | is a special family identifier meaning that no networking protocol | |
770 | is involved. | |
771 | ||
772 | .TP | |
773 | .B \-4 | |
774 | shortcut for | |
775 | .BR "-family inet" . | |
776 | ||
777 | .TP | |
778 | .B \-6 | |
779 | shortcut for | |
780 | .BR "\-family inet6" . | |
781 | ||
782 | .TP | |
783 | .B \-0 | |
784 | shortcut for | |
785 | .BR "\-family link" . | |
786 | ||
787 | .TP | |
788 | .BR "\-o" , " \-oneline" | |
789 | output each record on a single line, replacing line feeds | |
790 | with the | |
b096fa5f | 791 | .B '\e\' |
ae9b671d | 792 | character. This is convenient when you want to count records |
985794ad SH |
793 | with |
794 | .BR wc (1) | |
795 | or to | |
796 | .BR grep (1) | |
797 | the output. | |
798 | ||
799 | .TP | |
800 | .BR "\-r" , " \-resolve" | |
801 | use the system's name resolver to print DNS names instead of | |
802 | host addresses. | |
803 | ||
804 | .SH IP - COMMAND SYNTAX | |
805 | ||
806 | .SS | |
807 | .I OBJECT | |
808 | ||
809 | .TP | |
810 | .B link | |
811 | - network device. | |
812 | ||
813 | .TP | |
814 | .B address | |
815 | - protocol (IP or IPv6) address on a device. | |
4759758c YH |
816 | |
817 | .TP | |
818 | .B addrlabel | |
819 | - label configuration for protocol address selection. | |
820 | ||
985794ad SH |
821 | .TP |
822 | .B neighbour | |
823 | - ARP or NDISC cache entry. | |
824 | ||
825 | .TP | |
826 | .B route | |
827 | - routing table entry. | |
828 | ||
829 | .TP | |
830 | .B rule | |
831 | - rule in routing policy database. | |
832 | ||
833 | .TP | |
834 | .B maddress | |
835 | - multicast address. | |
836 | ||
837 | .TP | |
838 | .B mroute | |
839 | - multicast routing cache entry. | |
840 | ||
841 | .TP | |
842 | .B tunnel | |
843 | - tunnel over IP. | |
844 | ||
ae9b671d MM |
845 | .TP |
846 | .B xfrm | |
847 | - framework for IPsec protocol. | |
848 | ||
985794ad SH |
849 | .PP |
850 | The names of all objects may be written in full or | |
851 | abbreviated form, f.e. | |
852 | .B address | |
853 | is abbreviated as | |
854 | .B addr | |
855 | or just | |
856 | .B a. | |
857 | ||
858 | .SS | |
859 | .I COMMAND | |
860 | ||
861 | Specifies the action to perform on the object. | |
862 | The set of possible actions depends on the object type. | |
863 | As a rule, it is possible to | |
864 | .BR "add" , " delete" | |
865 | and | |
866 | .B show | |
867 | (or | |
868 | .B list | |
869 | ) objects, but some objects do not allow all of these operations | |
870 | or have some additional commands. The | |
871 | .B help | |
872 | command is available for all objects. It prints | |
873 | out a list of available commands and argument syntax conventions. | |
874 | .sp | |
875 | If no command is given, some default command is assumed. | |
876 | Usually it is | |
877 | .B list | |
878 | or, if the objects of this class cannot be listed, | |
879 | .BR "help" . | |
880 | ||
881 | .SH ip link - network device configuration | |
882 | ||
883 | .B link | |
884 | is a network device and the corresponding commands | |
885 | display and change the state of devices. | |
886 | ||
df33d7a4 | 887 | .SS ip link add - add virtual link |
985794ad SH |
888 | |
889 | .TP | |
df33d7a4 SH |
890 | .BI link " DEVICE " |
891 | specifies the physical device to act operate on. | |
892 | ||
985794ad | 893 | .I NAME |
df33d7a4 SH |
894 | specifies the name of the new virtual device. |
895 | ||
896 | .I TYPE | |
897 | specifies the type of the new device. | |
898 | .sp | |
899 | Link types: | |
900 | ||
901 | .in +8 | |
902 | .B vlan | |
903 | - 802.1q tagged virrtual LAN interface | |
904 | .sp | |
905 | .B macvlan | |
906 | - virtual interface base on link layer address (MAC) | |
907 | .sp | |
908 | .B can | |
909 | - Controller Area Network interface | |
910 | .in -8 | |
911 | ||
912 | .SS ip link delete - delete virtual link | |
913 | .I DEVICE | |
914 | specifies the virtual device to act operate on. | |
915 | .I TYPE | |
916 | specifies the type of the device. | |
917 | ||
918 | ||
919 | .TP | |
920 | .BI dev " DEVICE " | |
921 | specifies the physical device to act operate on. | |
922 | ||
923 | .SS ip link set - change device attributes | |
924 | ||
925 | .TP | |
926 | .BI dev " DEVICE " | |
927 | .I DEVICE | |
46dab6e9 WM |
928 | specifies network device to operate on. When configuring SR-IOV Virtual Fuction |
929 | (VF) devices, this keyword should specify the associated Physical Function (PF) | |
930 | device. | |
985794ad SH |
931 | |
932 | .TP | |
933 | .BR up " and " down | |
934 | change the state of the device to | |
935 | .B UP | |
936 | or | |
937 | .BR "DOWN" . | |
938 | ||
939 | .TP | |
940 | .BR "arp on " or " arp off" | |
941 | change the | |
942 | .B NOARP | |
943 | flag on the device. | |
944 | ||
945 | .TP | |
946 | .BR "multicast on " or " multicast off" | |
947 | change the | |
948 | .B MULTICAST | |
949 | flag on the device. | |
950 | ||
951 | .TP | |
952 | .BR "dynamic on " or " dynamic off" | |
953 | change the | |
954 | .B DYNAMIC | |
955 | flag on the device. | |
956 | ||
957 | .TP | |
958 | .BI name " NAME" | |
959 | change the name of the device. This operation is not | |
960 | recommended if the device is running or has some addresses | |
961 | already configured. | |
962 | ||
963 | .TP | |
964 | .BI txqueuelen " NUMBER" | |
ae9b671d | 965 | .TP |
985794ad SH |
966 | .BI txqlen " NUMBER" |
967 | change the transmit queue length of the device. | |
968 | ||
969 | .TP | |
970 | .BI mtu " NUMBER" | |
ae9b671d | 971 | change the |
985794ad SH |
972 | .I MTU |
973 | of the device. | |
974 | ||
975 | .TP | |
976 | .BI address " LLADDRESS" | |
977 | change the station address of the interface. | |
978 | ||
979 | .TP | |
980 | .BI broadcast " LLADDRESS" | |
981 | .TP | |
982 | .BI brd " LLADDRESS" | |
983 | .TP | |
984 | .BI peer " LLADDRESS" | |
985 | change the link layer broadcast address or the peer address when | |
986 | the interface is | |
987 | .IR "POINTOPOINT" . | |
988 | ||
e2613dc8 BT |
989 | .TP |
990 | .BI netns " PID" | |
991 | move the device to the network namespace associated with the process | |
46dab6e9 WM |
992 | .IR "PID". |
993 | ||
994 | .TP | |
995 | .BI alias " NAME" | |
996 | give the device a symbolic name for easy reference. | |
997 | ||
998 | .TP | |
999 | .BI vf " NUM" | |
1000 | specify a Virtual Function device to be configured. The associated PF device | |
1001 | must be specified using the | |
1002 | .B dev | |
1003 | parameter. | |
1004 | ||
1005 | .in +8 | |
1006 | .BI mac " LLADDRESS" | |
1007 | - change the station address for the specified VF. The | |
1008 | .B vf | |
1009 | parameter must be specified. | |
1010 | ||
1011 | .sp | |
1012 | .BI vlan " VLANID" | |
1013 | - change the assigned VLAN for the specified VF. When specified, all traffic | |
1014 | sent from the VF will be tagged with the specified VLAN ID. Incoming traffic | |
1015 | will be filtered for the specified VLAN ID, and will have all VLAN tags | |
1016 | stripped before being passed to the VF. Setting this parameter to 0 disables | |
1017 | VLAN tagging and filtering. The | |
1018 | .B vf | |
1019 | parameter must be specified. | |
1020 | ||
1021 | .sp | |
1022 | .BI qos " VLAN-QOS" | |
1023 | - assign VLAN QOS (priority) bits for the VLAN tag. When specified, all VLAN | |
1024 | tags transmitted by the VF will include the specified priority bits in the | |
1025 | VLAN tag. If not specified, the value is assumed to be 0. Both the | |
1026 | .B vf | |
1027 | and | |
1028 | .B vlan | |
1029 | parameters must be specified. Setting both | |
1030 | .B vlan | |
1031 | and | |
1032 | .B qos | |
1033 | as 0 disables VLAN tagging and filtering for the VF. | |
1034 | ||
1035 | .sp | |
1036 | .BI rate " TXRATE" | |
1037 | - change the allowed transmit bandwidth, in Mbps, for the specified VF. | |
1038 | Setting this parameter to 0 disables rate limiting. The | |
1039 | .B vf | |
1040 | parameter must be specified. | |
1041 | .in -8 | |
e2613dc8 | 1042 | |
985794ad SH |
1043 | .PP |
1044 | .B Warning: | |
1045 | If multiple parameter changes are requested, | |
1046 | .B ip | |
1047 | aborts immediately after any of the changes have failed. | |
1048 | This is the only case when | |
1049 | .B ip | |
1050 | can move the system to an unpredictable state. The solution | |
1051 | is to avoid changing several parameters with one | |
1052 | .B ip link set | |
1053 | call. | |
1054 | ||
1055 | .SS ip link show - display device attributes | |
1056 | ||
1057 | .TP | |
1058 | .BI dev " NAME " (default) | |
1059 | .I NAME | |
1060 | specifies the network device to show. | |
ac694c33 VD |
1061 | If this argument is omitted all devices in the default group are listed. |
1062 | ||
1063 | .TP | |
1064 | .BI group " GROUP " | |
1065 | .I GROUP | |
1066 | specifies what group of devices to show. | |
985794ad SH |
1067 | |
1068 | .TP | |
1069 | .B up | |
1070 | only display running interfaces. | |
1071 | ||
1072 | .SH ip address - protocol address management. | |
1073 | ||
1074 | The | |
1075 | .B address | |
1076 | is a protocol (IP or IPv6) address attached | |
1077 | to a network device. Each device must have at least one address | |
1078 | to use the corresponding protocol. It is possible to have several | |
1079 | different addresses attached to one device. These addresses are not | |
1080 | discriminated, so that the term | |
1081 | .B alias | |
1082 | is not quite appropriate for them and we do not use it in this document. | |
1083 | .sp | |
1084 | The | |
1085 | .B ip addr | |
1086 | command displays addresses and their properties, adds new addresses | |
1087 | and deletes old ones. | |
1088 | ||
1089 | .SS ip address add - add new protocol address. | |
1090 | ||
1091 | .TP | |
1092 | .BI dev " NAME" | |
1093 | the name of the device to add the address to. | |
1094 | ||
1095 | .TP | |
1096 | .BI local " ADDRESS " (default) | |
1097 | the address of the interface. The format of the address depends | |
1098 | on the protocol. It is a dotted quad for IP and a sequence of | |
1099 | hexadecimal halfwords separated by colons for IPv6. The | |
1100 | .I ADDRESS | |
1101 | may be followed by a slash and a decimal number which encodes | |
1102 | the network prefix length. | |
1103 | ||
1104 | .TP | |
1105 | .BI peer " ADDRESS" | |
1106 | the address of the remote endpoint for pointopoint interfaces. | |
1107 | Again, the | |
1108 | .I ADDRESS | |
1109 | may be followed by a slash and a decimal number, encoding the network | |
1110 | prefix length. If a peer address is specified, the local address | |
1111 | cannot have a prefix length. The network prefix is associated | |
1112 | with the peer rather than with the local address. | |
1113 | ||
1114 | .TP | |
1115 | .BI broadcast " ADDRESS" | |
1116 | the broadcast address on the interface. | |
1117 | .sp | |
1118 | It is possible to use the special symbols | |
1119 | .B '+' | |
1120 | and | |
1121 | .B '-' | |
1122 | instead of the broadcast address. In this case, the broadcast address | |
1123 | is derived by setting/resetting the host bits of the interface prefix. | |
1124 | ||
1125 | .TP | |
1126 | .BI label " NAME" | |
1127 | Each address may be tagged with a label string. | |
1128 | In order to preserve compatibility with Linux-2.0 net aliases, | |
1129 | this string must coincide with the name of the device or must be prefixed | |
1130 | with the device name followed by colon. | |
1131 | ||
1132 | .TP | |
1133 | .BI scope " SCOPE_VALUE" | |
1134 | the scope of the area where this address is valid. | |
1135 | The available scopes are listed in file | |
1136 | .BR "/etc/iproute2/rt_scopes" . | |
1137 | Predefined scope values are: | |
1138 | ||
1139 | .in +8 | |
1140 | .B global | |
1141 | - the address is globally valid. | |
1142 | .sp | |
1143 | .B site | |
1144 | - (IPv6 only) the address is site local, i.e. it is | |
1145 | valid inside this site. | |
1146 | .sp | |
1147 | .B link | |
1148 | - the address is link local, i.e. it is valid only on this device. | |
1149 | .sp | |
1150 | .B host | |
1151 | - the address is valid only inside this host. | |
1152 | .in -8 | |
1153 | ||
1154 | .SS ip address delete - delete protocol address | |
1155 | .B Arguments: | |
1156 | coincide with the arguments of | |
1157 | .B ip addr add. | |
1158 | The device name is a required argument. The rest are optional. | |
1159 | If no arguments are given, the first address is deleted. | |
1160 | ||
1161 | .SS ip address show - look at protocol addresses | |
1162 | ||
1163 | .TP | |
1164 | .BI dev " NAME " (default) | |
1165 | name of device. | |
1166 | ||
1167 | .TP | |
1168 | .BI scope " SCOPE_VAL" | |
1169 | only list addresses with this scope. | |
1170 | ||
1171 | .TP | |
1172 | .BI to " PREFIX" | |
1173 | only list addresses matching this prefix. | |
1174 | ||
1175 | .TP | |
1176 | .BI label " PATTERN" | |
1177 | only list addresses with labels matching the | |
1178 | .IR "PATTERN" . | |
1179 | .I PATTERN | |
1180 | is a usual shell style pattern. | |
1181 | ||
1182 | .TP | |
1183 | .BR dynamic " and " permanent | |
1184 | (IPv6 only) only list addresses installed due to stateless | |
1185 | address configuration or only list permanent (not dynamic) | |
1186 | addresses. | |
1187 | ||
1188 | .TP | |
1189 | .B tentative | |
a1f27794 | 1190 | (IPv6 only) only list addresses which have not yet passed duplicate |
985794ad SH |
1191 | address detection. |
1192 | ||
1193 | .TP | |
1194 | .B deprecated | |
1195 | (IPv6 only) only list deprecated addresses. | |
1196 | ||
a1f27794 BH |
1197 | .TP |
1198 | .B dadfailed | |
1199 | (IPv6 only) only list addresses which have failed duplicate | |
1200 | address detection. | |
1201 | ||
a1b9ffcc BH |
1202 | .TP |
1203 | .B temporary | |
1204 | (IPv6 only) only list temporary addresses. | |
1205 | ||
985794ad SH |
1206 | .TP |
1207 | .BR primary " and " secondary | |
1208 | only list primary (or secondary) addresses. | |
1209 | ||
1210 | .SS ip address flush - flush protocol addresses | |
1211 | This command flushes the protocol addresses selected by some criteria. | |
1212 | ||
1213 | .PP | |
1214 | This command has the same arguments as | |
1215 | .B show. | |
1216 | The difference is that it does not run when no arguments are given. | |
1217 | ||
1218 | .PP | |
1219 | .B Warning: | |
1220 | This command (and other | |
1221 | .B flush | |
1222 | commands described below) is pretty dangerous. If you make a mistake, | |
1223 | it will not forgive it, but will cruelly purge all the addresses. | |
1224 | ||
1225 | .PP | |
1226 | With the | |
1227 | .B -statistics | |
1228 | option, the command becomes verbose. It prints out the number of deleted | |
1229 | addresses and the number of rounds made to flush the address list. If | |
1230 | this option is given twice, | |
1231 | .B ip addr flush | |
1232 | also dumps all the deleted addresses in the format described in the | |
1233 | previous subsection. | |
1234 | ||
4759758c YH |
1235 | .SH ip addrlabel - protocol address label management. |
1236 | ||
1237 | IPv6 address label is used for address selection | |
1238 | described in RFC 3484. Precedence is managed by userspace, | |
1239 | and only label is stored in kernel. | |
1240 | ||
1241 | .SS ip addrlabel add - add an address label | |
1242 | the command adds an address label entry to the kernel. | |
1243 | .TP | |
1244 | .BI prefix " PREFIX" | |
1245 | .TP | |
1246 | .BI dev " DEV" | |
1247 | the outgoing interface. | |
1248 | .TP | |
1249 | .BI label " NUMBER" | |
1250 | the label for the prefix. | |
1251 | 0xffffffff is reserved. | |
1252 | .SS ip addrlabel del - delete an address label | |
1253 | the command deletes an address label entry in the kernel. | |
1254 | .B Arguments: | |
1255 | coincide with the arguments of | |
1256 | .B ip addrlabel add | |
1257 | but label is not required. | |
1258 | .SS ip addrlabel list - list address labels | |
1259 | the command show contents of address labels. | |
1260 | .SS ip addrlabel flush - flush address labels | |
915fae19 | 1261 | the command flushes the contents of address labels and it does not restore default settings. |
985794ad SH |
1262 | .SH ip neighbour - neighbour/arp tables management. |
1263 | ||
1264 | .B neighbour | |
1265 | objects establish bindings between protocol addresses and | |
1266 | link layer addresses for hosts sharing the same link. | |
1267 | Neighbour entries are organized into tables. The IPv4 neighbour table | |
1268 | is known by another name - the ARP table. | |
1269 | ||
1270 | .P | |
1271 | The corresponding commands display neighbour bindings | |
1272 | and their properties, add new neighbour entries and delete old ones. | |
1273 | ||
1274 | .SS ip neighbour add - add a new neighbour entry | |
1275 | .SS ip neighbour change - change an existing entry | |
1276 | .SS ip neighbour replace - add a new entry or change an existing one | |
1277 | ||
1278 | These commands create new neighbour records or update existing ones. | |
1279 | ||
1280 | .TP | |
1281 | .BI to " ADDRESS " (default) | |
1282 | the protocol address of the neighbour. It is either an IPv4 or IPv6 address. | |
1283 | ||
1284 | .TP | |
1285 | .BI dev " NAME" | |
1286 | the interface to which this neighbour is attached. | |
1287 | ||
1288 | .TP | |
1289 | .BI lladdr " LLADDRESS" | |
1290 | the link layer address of the neighbour. | |
1291 | .I LLADDRESS | |
1292 | can also be | |
1293 | .BR "null" . | |
1294 | ||
1295 | .TP | |
1296 | .BI nud " NUD_STATE" | |
1297 | the state of the neighbour entry. | |
1298 | .B nud | |
5c68fc88 | 1299 | is an abbreviation for 'Neighbour Unreachability Detection'. |
985794ad SH |
1300 | The state can take one of the following values: |
1301 | ||
1302 | .in +8 | |
1303 | .B permanent | |
1304 | - the neighbour entry is valid forever and can be only | |
1305 | be removed administratively. | |
1306 | .sp | |
1307 | ||
1308 | .B noarp | |
1309 | - the neighbour entry is valid. No attempts to validate | |
1310 | this entry will be made but it can be removed when its lifetime expires. | |
1311 | .sp | |
1312 | ||
1313 | .B reachable | |
1314 | - the neighbour entry is valid until the reachability | |
1315 | timeout expires. | |
1316 | .sp | |
1317 | ||
1318 | .B stale | |
1319 | - the neighbour entry is valid but suspicious. | |
1320 | This option to | |
1321 | .B ip neigh | |
1322 | does not change the neighbour state if it was valid and the address | |
1323 | is not changed by this command. | |
1324 | .in -8 | |
1325 | ||
1326 | .SS ip neighbour delete - delete a neighbour entry | |
1327 | This command invalidates a neighbour entry. | |
1328 | ||
1329 | .PP | |
1330 | The arguments are the same as with | |
1331 | .BR "ip neigh add" , | |
1332 | except that | |
1333 | .B lladdr | |
1334 | and | |
1335 | .B nud | |
1336 | are ignored. | |
1337 | ||
1338 | .PP | |
1339 | .B Warning: | |
1340 | Attempts to delete or manually change a | |
1341 | .B noarp | |
1342 | entry created by the kernel may result in unpredictable behaviour. | |
1343 | Particularly, the kernel may try to resolve this address even | |
1344 | on a | |
1345 | .B NOARP | |
1346 | interface or if the address is multicast or broadcast. | |
1347 | ||
1348 | .SS ip neighbour show - list neighbour entries | |
1349 | ||
1350 | This commands displays neighbour tables. | |
1351 | ||
1352 | .TP | |
1353 | .BI to " ADDRESS " (default) | |
1354 | the prefix selecting the neighbours to list. | |
1355 | ||
1356 | .TP | |
1357 | .BI dev " NAME" | |
1358 | only list the neighbours attached to this device. | |
1359 | ||
1360 | .TP | |
1361 | .B unused | |
1362 | only list neighbours which are not currently in use. | |
1363 | ||
1364 | .TP | |
1365 | .BI nud " NUD_STATE" | |
1366 | only list neighbour entries in this state. | |
1367 | .I NUD_STATE | |
1368 | takes values listed below or the special value | |
1369 | .B all | |
1370 | which means all states. This option may occur more than once. | |
1371 | If this option is absent, | |
1372 | .B ip | |
1373 | lists all entries except for | |
1374 | .B none | |
1375 | and | |
1376 | .BR "noarp" . | |
1377 | ||
1378 | .SS ip neighbour flush - flush neighbour entries | |
1379 | This command flushes neighbour tables, selecting | |
1380 | entries to flush by some criteria. | |
1381 | ||
1382 | .PP | |
1383 | This command has the same arguments as | |
1384 | .B show. | |
1385 | The differences are that it does not run when no arguments are given, | |
1386 | and that the default neighbour states to be flushed do not include | |
1387 | .B permanent | |
1388 | and | |
1389 | .BR "noarp" . | |
1390 | ||
1391 | .PP | |
1392 | With the | |
1393 | .B -statistics | |
1394 | option, the command becomes verbose. It prints out the number of | |
1395 | deleted neighbours and the number of rounds made to flush the | |
1396 | neighbour table. If the option is given | |
1397 | twice, | |
1398 | .B ip neigh flush | |
1399 | also dumps all the deleted neighbours. | |
1400 | ||
1401 | .SH ip route - routing table management | |
1402 | Manipulate route entries in the kernel routing tables keep | |
1403 | information about paths to other networked nodes. | |
1404 | .sp | |
1405 | .B Route types: | |
1406 | ||
1407 | .in +8 | |
1408 | .B unicast | |
1409 | - the route entry describes real paths to the destinations covered | |
1410 | by the route prefix. | |
1411 | ||
1412 | .sp | |
1413 | .B unreachable | |
1414 | - these destinations are unreachable. Packets are discarded and the | |
1415 | ICMP message | |
1416 | .I host unreachable | |
1417 | is generated. | |
1418 | The local senders get an | |
1419 | .I EHOSTUNREACH | |
1420 | error. | |
1421 | ||
1422 | .sp | |
1423 | .B blackhole | |
1424 | - these destinations are unreachable. Packets are discarded silently. | |
1425 | The local senders get an | |
1426 | .I EINVAL | |
1427 | error. | |
1428 | ||
1429 | .sp | |
1430 | .B prohibit | |
1431 | - these destinations are unreachable. Packets are discarded and the | |
1432 | ICMP message | |
1433 | .I communication administratively prohibited | |
1434 | is generated. The local senders get an | |
1435 | .I EACCES | |
1436 | error. | |
1437 | ||
1438 | .sp | |
1439 | .B local | |
1440 | - the destinations are assigned to this host. The packets are looped | |
1441 | back and delivered locally. | |
1442 | ||
1443 | .sp | |
1444 | .B broadcast | |
1445 | - the destinations are broadcast addresses. The packets are sent as | |
1446 | link broadcasts. | |
1447 | ||
1448 | .sp | |
1449 | .B throw | |
1450 | - a special control route used together with policy rules. If such a | |
1451 | route is selected, lookup in this table is terminated pretending that | |
1452 | no route was found. Without policy routing it is equivalent to the | |
1453 | absence of the route in the routing table. The packets are dropped | |
1454 | and the ICMP message | |
1455 | .I net unreachable | |
1456 | is generated. The local senders get an | |
1457 | .I ENETUNREACH | |
1458 | error. | |
1459 | ||
1460 | .sp | |
1461 | .B nat | |
1462 | - a special NAT route. Destinations covered by the prefix | |
1463 | are considered to be dummy (or external) addresses which require translation | |
1464 | to real (or internal) ones before forwarding. The addresses to translate to | |
1465 | are selected with the attribute | |
526afe40 | 1466 | .B Warning: |
1467 | Route NAT is no longer supported in Linux 2.6. | |
1468 | ||
985794ad | 1469 | |
526afe40 | 1470 | .BR "via" . |
985794ad SH |
1471 | .sp |
1472 | .B anycast | |
1473 | .RI "- " "not implemented" | |
1474 | the destinations are | |
1475 | .I anycast | |
1476 | addresses assigned to this host. They are mainly equivalent | |
1477 | to | |
1478 | .B local | |
1479 | with one difference: such addresses are invalid when used | |
1480 | as the source address of any packet. | |
1481 | ||
1482 | .sp | |
1483 | .B multicast | |
1484 | - a special type used for multicast routing. It is not present in | |
1485 | normal routing tables. | |
1486 | .in -8 | |
1487 | ||
1488 | .P | |
1489 | .B Route tables: | |
4ec1933d SH |
1490 | Linux-2.x can pack routes into several routing tables identified |
1491 | by a number in the range from 1 to 2^31 or by name from the file | |
985794ad | 1492 | .B /etc/iproute2/rt_tables |
cd796bc7 | 1493 | By default all normal routes are inserted into the |
985794ad SH |
1494 | .B main |
1495 | table (ID 254) and the kernel only uses this table when calculating routes. | |
4ec1933d | 1496 | Values (0, 253, 254, and 255) are reserved for built-in use. |
985794ad SH |
1497 | |
1498 | .sp | |
1499 | Actually, one other table always exists, which is invisible but | |
1500 | even more important. It is the | |
1501 | .B local | |
1502 | table (ID 255). This table | |
1503 | consists of routes for local and broadcast addresses. The kernel maintains | |
1504 | this table automatically and the administrator usually need not modify it | |
1505 | or even look at it. | |
1506 | ||
1507 | The multiple routing tables enter the game when | |
1508 | .I policy routing | |
1509 | is used. | |
1510 | ||
1511 | .SS ip route add - add new route | |
1512 | .SS ip route change - change route | |
1513 | .SS ip route replace - change or add new one | |
1514 | ||
1515 | .TP | |
1516 | .BI to " TYPE PREFIX " (default) | |
1517 | the destination prefix of the route. If | |
1518 | .I TYPE | |
1519 | is omitted, | |
1520 | .B ip | |
1521 | assumes type | |
1522 | .BR "unicast" . | |
1523 | Other values of | |
1524 | .I TYPE | |
1525 | are listed above. | |
1526 | .I PREFIX | |
1527 | is an IP or IPv6 address optionally followed by a slash and the | |
1528 | prefix length. If the length of the prefix is missing, | |
1529 | .B ip | |
1530 | assumes a full-length host route. There is also a special | |
1531 | .I PREFIX | |
1532 | .B default | |
1533 | - which is equivalent to IP | |
1534 | .B 0/0 | |
1535 | or to IPv6 | |
1536 | .BR "::/0" . | |
1537 | ||
1538 | .TP | |
1539 | .BI tos " TOS" | |
1540 | .TP | |
1541 | .BI dsfield " TOS" | |
1542 | the Type Of Service (TOS) key. This key has no associated mask and | |
1543 | the longest match is understood as: First, compare the TOS | |
1544 | of the route and of the packet. If they are not equal, then the packet | |
1545 | may still match a route with a zero TOS. | |
1546 | .I TOS | |
1547 | is either an 8 bit hexadecimal number or an identifier | |
1548 | from | |
1549 | .BR "/etc/iproute2/rt_dsfield" . | |
1550 | ||
1551 | .TP | |
1552 | .BI metric " NUMBER" | |
1553 | .TP | |
1554 | .BI preference " NUMBER" | |
1555 | the preference value of the route. | |
1556 | .I NUMBER | |
1557 | is an arbitrary 32bit number. | |
1558 | ||
1559 | .TP | |
1560 | .BI table " TABLEID" | |
1561 | the table to add this route to. | |
1562 | .I TABLEID | |
1563 | may be a number or a string from the file | |
1564 | .BR "/etc/iproute2/rt_tables" . | |
1565 | If this parameter is omitted, | |
1566 | .B ip | |
1567 | assumes the | |
1568 | .B main | |
1569 | table, with the exception of | |
1570 | .BR local " , " broadcast " and " nat | |
1571 | routes, which are put into the | |
1572 | .B local | |
1573 | table by default. | |
1574 | ||
1575 | .TP | |
1576 | .BI dev " NAME" | |
1577 | the output device name. | |
1578 | ||
1579 | .TP | |
1580 | .BI via " ADDRESS" | |
1581 | the address of the nexthop router. Actually, the sense of this field | |
1582 | depends on the route type. For normal | |
1583 | .B unicast | |
1584 | routes it is either the true next hop router or, if it is a direct | |
1585 | route installed in BSD compatibility mode, it can be a local address | |
1586 | of the interface. For NAT routes it is the first address of the block | |
1587 | of translated IP destinations. | |
1588 | ||
1589 | .TP | |
1590 | .BI src " ADDRESS" | |
1591 | the source address to prefer when sending to the destinations | |
1592 | covered by the route prefix. | |
1593 | ||
1594 | .TP | |
1595 | .BI realm " REALMID" | |
1596 | the realm to which this route is assigned. | |
1597 | .I REALMID | |
1598 | may be a number or a string from the file | |
1599 | .BR "/etc/iproute2/rt_realms" . | |
1600 | ||
1601 | .TP | |
1602 | .BI mtu " MTU" | |
1603 | .TP | |
1604 | .BI "mtu lock" " MTU" | |
1605 | the MTU along the path to the destination. If the modifier | |
1606 | .B lock | |
1607 | is not used, the MTU may be updated by the kernel due to | |
1608 | Path MTU Discovery. If the modifier | |
1609 | .B lock | |
1610 | is used, no path MTU discovery will be tried, all packets | |
1611 | will be sent without the DF bit in IPv4 case or fragmented | |
1612 | to MTU for IPv6. | |
1613 | ||
1614 | .TP | |
1615 | .BI window " NUMBER" | |
1616 | the maximal window for TCP to advertise to these destinations, | |
1617 | measured in bytes. It limits maximal data bursts that our TCP | |
1618 | peers are allowed to send to us. | |
1619 | ||
1620 | .TP | |
54e0b2e7 RJ |
1621 | .BI rtt " TIME" |
1622 | the initial RTT ('Round Trip Time') estimate. If no suffix is | |
1623 | specified the units are raw values passed directly to the | |
5c68fc88 | 1624 | routing code to maintain compatibility with previous releases. |
54e0b2e7 | 1625 | Otherwise if a suffix of s, sec or secs is used to specify |
fca1dae8 | 1626 | seconds and ms, msec or msecs to specify milliseconds. |
54e0b2e7 RJ |
1627 | |
1628 | ||
1629 | .TP | |
1630 | .BI rttvar " TIME " "(2.3.15+ only)" | |
ae9b671d | 1631 | the initial RTT variance estimate. Values are specified as with |
54e0b2e7 RJ |
1632 | .BI rtt |
1633 | above. | |
985794ad SH |
1634 | |
1635 | .TP | |
54e0b2e7 RJ |
1636 | .BI rto_min " TIME " "(2.6.23+ only)" |
1637 | the minimum TCP Retransmission TimeOut to use when communicating with this | |
1638 | destination. Values are specified as with | |
1639 | .BI rtt | |
1640 | above. | |
985794ad SH |
1641 | |
1642 | .TP | |
1643 | .BI ssthresh " NUMBER " "(2.3.15+ only)" | |
1644 | an estimate for the initial slow start threshold. | |
1645 | ||
1646 | .TP | |
1647 | .BI cwnd " NUMBER " "(2.3.15+ only)" | |
1648 | the clamp for congestion window. It is ignored if the | |
1649 | .B lock | |
1650 | flag is not used. | |
1651 | ||
6299857d BB |
1652 | .TP |
1653 | .BI initcwnd " NUMBER " "(2.5.70+ only)" | |
704f4df4 | 1654 | the initial congestion window size for connections to this destination. |
6299857d BB |
1655 | Actual window size is this value multiplied by the MSS |
1656 | (``Maximal Segment Size'') for same connection. The default is | |
1657 | zero, meaning to use the values specified in RFC2414. | |
1658 | ||
704f4df4 SH |
1659 | .TP |
1660 | .BI initrwnd " NUMBER " "(2.6.33+ only)" | |
1661 | the initial receive window size for connections to this destination. | |
1662 | Actual window size is this value multiplied by the MSS of the connection. | |
1663 | The default value is zero, meaning to use Slow Start value. | |
1664 | ||
985794ad SH |
1665 | .TP |
1666 | .BI advmss " NUMBER " "(2.3.15+ only)" | |
1667 | the MSS ('Maximal Segment Size') to advertise to these | |
1668 | destinations when establishing TCP connections. If it is not given, | |
1669 | Linux uses a default value calculated from the first hop device MTU. | |
1670 | (If the path to these destination is asymmetric, this guess may be wrong.) | |
1671 | ||
1672 | .TP | |
1673 | .BI reordering " NUMBER " "(2.3.15+ only)" | |
1674 | Maximal reordering on the path to this destination. | |
1675 | If it is not given, Linux uses the value selected with | |
1676 | .B sysctl | |
1677 | variable | |
1678 | .BR "net/ipv4/tcp_reordering" . | |
1679 | ||
1680 | .TP | |
1681 | .BI nexthop " NEXTHOP" | |
1682 | the nexthop of a multipath route. | |
1683 | .I NEXTHOP | |
1684 | is a complex value with its own syntax similar to the top level | |
1685 | argument lists: | |
1686 | ||
1687 | .in +8 | |
1688 | .BI via " ADDRESS" | |
1689 | - is the nexthop router. | |
1690 | .sp | |
1691 | ||
1692 | .BI dev " NAME" | |
1693 | - is the output device. | |
1694 | .sp | |
1695 | ||
1696 | .BI weight " NUMBER" | |
1697 | - is a weight for this element of a multipath | |
1698 | route reflecting its relative bandwidth or quality. | |
1699 | .in -8 | |
1700 | ||
1701 | .TP | |
1702 | .BI scope " SCOPE_VAL" | |
1703 | the scope of the destinations covered by the route prefix. | |
1704 | .I SCOPE_VAL | |
1705 | may be a number or a string from the file | |
1706 | .BR "/etc/iproute2/rt_scopes" . | |
1707 | If this parameter is omitted, | |
1708 | .B ip | |
1709 | assumes scope | |
1710 | .B global | |
1711 | for all gatewayed | |
1712 | .B unicast | |
1713 | routes, scope | |
1714 | .B link | |
1715 | for direct | |
1716 | .BR unicast " and " broadcast | |
1717 | routes and scope | |
1718 | .BR host " for " local | |
1719 | routes. | |
1720 | ||
1721 | .TP | |
1722 | .BI protocol " RTPROTO" | |
1723 | the routing protocol identifier of this route. | |
1724 | .I RTPROTO | |
1725 | may be a number or a string from the file | |
1726 | .BR "/etc/iproute2/rt_protos" . | |
1727 | If the routing protocol ID is not given, | |
1728 | .B ip assumes protocol | |
1729 | .B boot | |
1730 | (i.e. it assumes the route was added by someone who doesn't | |
1731 | understand what they are doing). Several protocol values have | |
1732 | a fixed interpretation. | |
1733 | Namely: | |
1734 | ||
1735 | .in +8 | |
1736 | .B redirect | |
1737 | - the route was installed due to an ICMP redirect. | |
1738 | .sp | |
1739 | ||
1740 | .B kernel | |
1741 | - the route was installed by the kernel during autoconfiguration. | |
1742 | .sp | |
1743 | ||
1744 | .B boot | |
1745 | - the route was installed during the bootup sequence. | |
1746 | If a routing daemon starts, it will purge all of them. | |
1747 | .sp | |
1748 | ||
1749 | .B static | |
1750 | - the route was installed by the administrator | |
1751 | to override dynamic routing. Routing daemon will respect them | |
1752 | and, probably, even advertise them to its peers. | |
1753 | .sp | |
1754 | ||
1755 | .B ra | |
1756 | - the route was installed by Router Discovery protocol. | |
1757 | .in -8 | |
1758 | ||
1759 | .sp | |
1760 | The rest of the values are not reserved and the administrator is free | |
1761 | to assign (or not to assign) protocol tags. | |
1762 | ||
1763 | .TP | |
1764 | .B onlink | |
1765 | pretend that the nexthop is directly attached to this link, | |
1766 | even if it does not match any interface prefix. | |
1767 | ||
985794ad SH |
1768 | .SS ip route delete - delete route |
1769 | ||
1770 | .B ip route del | |
1771 | has the same arguments as | |
1772 | .BR "ip route add" , | |
1773 | but their semantics are a bit different. | |
1774 | ||
1775 | Key values | |
1776 | .RB "(" to ", " tos ", " preference " and " table ")" | |
1777 | select the route to delete. If optional attributes are present, | |
1778 | .B ip | |
1779 | verifies that they coincide with the attributes of the route to delete. | |
1780 | If no route with the given key and attributes was found, | |
1781 | .B ip route del | |
1782 | fails. | |
1783 | ||
1784 | .SS ip route show - list routes | |
1785 | the command displays the contents of the routing tables or the route(s) | |
1786 | selected by some criteria. | |
1787 | ||
1788 | .TP | |
1789 | .BI to " SELECTOR " (default) | |
1790 | only select routes from the given range of destinations. | |
1791 | .I SELECTOR | |
1792 | consists of an optional modifier | |
1793 | .RB "(" root ", " match " or " exact ")" | |
1794 | and a prefix. | |
1795 | .BI root " PREFIX" | |
1796 | selects routes with prefixes not shorter than | |
1797 | .IR PREFIX "." | |
1798 | F.e. | |
1799 | .BI root " 0/0" | |
1800 | selects the entire routing table. | |
1801 | .BI match " PREFIX" | |
1802 | selects routes with prefixes not longer than | |
1803 | .IR PREFIX "." | |
1804 | F.e. | |
1805 | .BI match " 10.0/16" | |
1806 | selects | |
1807 | .IR 10.0/16 "," | |
1808 | .IR 10/8 " and " 0/0 , | |
1809 | but it does not select | |
1810 | .IR 10.1/16 " and " 10.0.0/24 . | |
1811 | And | |
1812 | .BI exact " PREFIX" | |
1813 | (or just | |
1814 | .IR PREFIX ")" | |
1815 | selects routes with this exact prefix. If neither of these options | |
1816 | are present, | |
1817 | .B ip | |
1818 | assumes | |
1819 | .BI root " 0/0" | |
1820 | i.e. it lists the entire table. | |
1821 | ||
1822 | .TP | |
1823 | .BI tos " TOS" | |
1824 | .BI dsfield " TOS" | |
1825 | only select routes with the given TOS. | |
1826 | ||
1827 | .TP | |
1828 | .BI table " TABLEID" | |
1829 | show the routes from this table(s). The default setting is to show | |
1830 | .BR table main "." | |
1831 | .I TABLEID | |
1832 | may either be the ID of a real table or one of the special values: | |
1833 | .sp | |
1834 | .in +8 | |
1835 | .B all | |
1836 | - list all of the tables. | |
1837 | .sp | |
1838 | .B cache | |
1839 | - dump the routing cache. | |
1840 | .in -8 | |
1841 | ||
1842 | .TP | |
1843 | .B cloned | |
1844 | .TP | |
1845 | .B cached | |
1846 | list cloned routes i.e. routes which were dynamically forked from | |
1847 | other routes because some route attribute (f.e. MTU) was updated. | |
1848 | Actually, it is equivalent to | |
1849 | .BR "table cache" "." | |
1850 | ||
1851 | .TP | |
1852 | .BI from " SELECTOR" | |
1853 | the same syntax as for | |
1854 | .BR to "," | |
1855 | but it binds the source address range rather than destinations. | |
1856 | Note that the | |
1857 | .B from | |
1858 | option only works with cloned routes. | |
1859 | ||
1860 | .TP | |
1861 | .BI protocol " RTPROTO" | |
1862 | only list routes of this protocol. | |
1863 | ||
1864 | .TP | |
1865 | .BI scope " SCOPE_VAL" | |
1866 | only list routes with this scope. | |
1867 | ||
1868 | .TP | |
1869 | .BI type " TYPE" | |
1870 | only list routes of this type. | |
1871 | ||
1872 | .TP | |
1873 | .BI dev " NAME" | |
1874 | only list routes going via this device. | |
1875 | ||
1876 | .TP | |
1877 | .BI via " PREFIX" | |
1878 | only list routes going via the nexthop routers selected by | |
1879 | .IR PREFIX "." | |
1880 | ||
1881 | .TP | |
1882 | .BI src " PREFIX" | |
1883 | only list routes with preferred source addresses selected | |
1884 | by | |
1885 | .IR PREFIX "." | |
1886 | ||
1887 | .TP | |
1888 | .BI realm " REALMID" | |
1889 | .TP | |
1890 | .BI realms " FROMREALM/TOREALM" | |
1891 | only list routes with these realms. | |
1892 | ||
1893 | .SS ip route flush - flush routing tables | |
1894 | this command flushes routes selected by some criteria. | |
1895 | ||
1896 | .sp | |
1897 | The arguments have the same syntax and semantics as the arguments of | |
1898 | .BR "ip route show" , | |
1899 | but routing tables are not listed but purged. The only difference is | |
1900 | the default action: | |
1901 | .B show | |
1902 | dumps all the IP main routing table but | |
1903 | .B flush | |
1904 | prints the helper page. | |
1905 | ||
1906 | .sp | |
1907 | With the | |
1908 | .B -statistics | |
1909 | option, the command becomes verbose. It prints out the number of | |
1910 | deleted routes and the number of rounds made to flush the routing | |
1911 | table. If the option is given | |
1912 | twice, | |
1913 | .B ip route flush | |
1914 | also dumps all the deleted routes in the format described in the | |
1915 | previous subsection. | |
1916 | ||
1917 | .SS ip route get - get a single route | |
1918 | this command gets a single route to a destination and prints its | |
1919 | contents exactly as the kernel sees it. | |
1920 | ||
1921 | .TP | |
1922 | .BI to " ADDRESS " (default) | |
1923 | the destination address. | |
1924 | ||
1925 | .TP | |
1926 | .BI from " ADDRESS" | |
1927 | the source address. | |
1928 | ||
1929 | .TP | |
1930 | .BI tos " TOS" | |
1931 | .TP | |
1932 | .BI dsfield " TOS" | |
1933 | the Type Of Service. | |
1934 | ||
1935 | .TP | |
1936 | .BI iif " NAME" | |
1937 | the device from which this packet is expected to arrive. | |
1938 | ||
1939 | .TP | |
1940 | .BI oif " NAME" | |
1941 | force the output device on which this packet will be routed. | |
1942 | ||
1943 | .TP | |
1944 | .B connected | |
ae9b671d | 1945 | if no source address |
985794ad SH |
1946 | .RB "(option " from ")" |
1947 | was given, relookup the route with the source set to the preferred | |
1948 | address received from the first lookup. | |
1949 | If policy routing is used, it may be a different route. | |
1950 | ||
1951 | .P | |
1952 | Note that this operation is not equivalent to | |
1953 | .BR "ip route show" . | |
1954 | .B show | |
1955 | shows existing routes. | |
1956 | .B get | |
1957 | resolves them and creates new clones if necessary. Essentially, | |
1958 | .B get | |
1959 | is equivalent to sending a packet along this path. | |
1960 | If the | |
1961 | .B iif | |
1962 | argument is not given, the kernel creates a route | |
1963 | to output packets towards the requested destination. | |
1964 | This is equivalent to pinging the destination | |
1965 | with a subsequent | |
1966 | .BR "ip route ls cache" , | |
1967 | however, no packets are actually sent. With the | |
1968 | .B iif | |
1969 | argument, the kernel pretends that a packet arrived from this interface | |
1970 | and searches for a path to forward the packet. | |
1971 | ||
f4ff11e3 DS |
1972 | .SS ip route save - save routing table information to stdout |
1973 | this command behaves like | |
1974 | .BR "ip route show" | |
1975 | except that the output is raw data suitable for passing to | |
1976 | .BR "ip route restore" . | |
1977 | ||
1978 | .SS ip route restore - restore routing table information from stdin | |
1979 | this command expects to read a data stream as returned from | |
1980 | .BR "ip route save" . | |
1981 | It will attempt to restore the routing table information exactly as | |
1982 | it was at the time of the save, so any translation of information | |
1983 | in the stream (such as device indexes) must be done first. Any existing | |
1984 | routes are left unchanged. Any routes specified in the data stream that | |
1985 | already exist in the table will be ignored. | |
1986 | ||
985794ad SH |
1987 | .SH ip rule - routing policy database management |
1988 | ||
1989 | .BR "Rule" s | |
1990 | in the routing policy database control the route selection algorithm. | |
1991 | ||
1992 | .P | |
1993 | Classic routing algorithms used in the Internet make routing decisions | |
1994 | based only on the destination address of packets (and in theory, | |
1995 | but not in practice, on the TOS field). | |
1996 | ||
1997 | .P | |
1998 | In some circumstances we want to route packets differently depending not only | |
1999 | on destination addresses, but also on other packet fields: source address, | |
2000 | IP protocol, transport protocol ports or even packet payload. | |
2001 | This task is called 'policy routing'. | |
2002 | ||
2003 | .P | |
2004 | To solve this task, the conventional destination based routing table, ordered | |
2005 | according to the longest match rule, is replaced with a 'routing policy | |
2006 | database' (or RPDB), which selects routes by executing some set of rules. | |
2007 | ||
2008 | .P | |
2009 | Each policy routing rule consists of a | |
2010 | .B selector | |
2011 | and an | |
2012 | .B action predicate. | |
2013 | The RPDB is scanned in the order of increasing priority. The selector | |
2014 | of each rule is applied to {source address, destination address, incoming | |
2015 | interface, tos, fwmark} and, if the selector matches the packet, | |
2016 | the action is performed. The action predicate may return with success. | |
2017 | In this case, it will either give a route or failure indication | |
2018 | and the RPDB lookup is terminated. Otherwise, the RPDB program | |
2019 | continues on the next rule. | |
2020 | ||
2021 | .P | |
2022 | Semantically, natural action is to select the nexthop and the output device. | |
2023 | ||
2024 | .P | |
2025 | At startup time the kernel configures the default RPDB consisting of three | |
2026 | rules: | |
2027 | ||
2028 | .TP | |
2029 | 1. | |
2030 | Priority: 0, Selector: match anything, Action: lookup routing | |
2031 | table | |
2032 | .B local | |
2033 | (ID 255). | |
2034 | The | |
2035 | .B local | |
2036 | table is a special routing table containing | |
2037 | high priority control routes for local and broadcast addresses. | |
2038 | .sp | |
2039 | Rule 0 is special. It cannot be deleted or overridden. | |
2040 | ||
2041 | .TP | |
2042 | 2. | |
2043 | Priority: 32766, Selector: match anything, Action: lookup routing | |
2044 | table | |
2045 | .B main | |
2046 | (ID 254). | |
2047 | The | |
2048 | .B main | |
2049 | table is the normal routing table containing all non-policy | |
2050 | routes. This rule may be deleted and/or overridden with other | |
2051 | ones by the administrator. | |
2052 | ||
2053 | .TP | |
2054 | 3. | |
2055 | Priority: 32767, Selector: match anything, Action: lookup routing | |
2056 | table | |
2057 | .B default | |
2058 | (ID 253). | |
2059 | The | |
2060 | .B default | |
2061 | table is empty. It is reserved for some post-processing if no previous | |
2062 | default rules selected the packet. | |
2063 | This rule may also be deleted. | |
2064 | ||
2065 | .P | |
2066 | Each RPDB entry has additional | |
2067 | attributes. F.e. each rule has a pointer to some routing | |
2068 | table. NAT and masquerading rules have an attribute to select new IP | |
2069 | address to translate/masquerade. Besides that, rules have some | |
2070 | optional attributes, which routes have, namely | |
2071 | .BR "realms" . | |
2072 | These values do not override those contained in the routing tables. They | |
2073 | are only used if the route did not select any attributes. | |
2074 | ||
2075 | .sp | |
2076 | The RPDB may contain rules of the following types: | |
2077 | ||
2078 | .in +8 | |
2079 | .B unicast | |
2080 | - the rule prescribes to return the route found | |
2081 | in the routing table referenced by the rule. | |
2082 | ||
2083 | .B blackhole | |
2084 | - the rule prescribes to silently drop the packet. | |
2085 | ||
2086 | .B unreachable | |
2087 | - the rule prescribes to generate a 'Network is unreachable' error. | |
2088 | ||
2089 | .B prohibit | |
2090 | - the rule prescribes to generate 'Communication is administratively | |
2091 | prohibited' error. | |
2092 | ||
2093 | .B nat | |
2094 | - the rule prescribes to translate the source address | |
2095 | of the IP packet into some other value. | |
2096 | .in -8 | |
2097 | ||
2098 | .SS ip rule add - insert a new rule | |
2099 | .SS ip rule delete - delete a rule | |
2100 | ||
2101 | .TP | |
2102 | .BI type " TYPE " (default) | |
2103 | the type of this rule. The list of valid types was given in the previous | |
2104 | subsection. | |
2105 | ||
2106 | .TP | |
2107 | .BI from " PREFIX" | |
2108 | select the source prefix to match. | |
2109 | ||
2110 | .TP | |
2111 | .BI to " PREFIX" | |
2112 | select the destination prefix to match. | |
2113 | ||
2114 | .TP | |
2115 | .BI iif " NAME" | |
2116 | select the incoming device to match. If the interface is loopback, | |
2117 | the rule only matches packets originating from this host. This means | |
2118 | that you may create separate routing tables for forwarded and local | |
2119 | packets and, hence, completely segregate them. | |
2120 | ||
85eae222 PM |
2121 | .TP |
2122 | .BI oif " NAME" | |
2123 | select the outgoing device to match. The outgoing interface is only | |
2124 | available for packets originating from local sockets that are bound to | |
2125 | a device. | |
2126 | ||
985794ad SH |
2127 | .TP |
2128 | .BI tos " TOS" | |
2129 | .TP | |
2130 | .BI dsfield " TOS" | |
2131 | select the TOS value to match. | |
2132 | ||
2133 | .TP | |
2134 | .BI fwmark " MARK" | |
2135 | select the | |
2136 | .B fwmark | |
2137 | value to match. | |
2138 | ||
2139 | .TP | |
2140 | .BI priority " PREFERENCE" | |
2141 | the priority of this rule. Each rule should have an explicitly | |
2142 | set | |
2143 | .I unique | |
2144 | priority value. | |
21561e71 | 2145 | The options preference and order are synonyms with priority. |
985794ad SH |
2146 | |
2147 | .TP | |
2148 | .BI table " TABLEID" | |
2149 | the routing table identifier to lookup if the rule selector matches. | |
21561e71 | 2150 | It is also possible to use lookup instead of table. |
985794ad SH |
2151 | |
2152 | .TP | |
2153 | .BI realms " FROM/TO" | |
2154 | Realms to select if the rule matched and the routing table lookup | |
ae9b671d | 2155 | succeeded. Realm |
985794ad SH |
2156 | .I TO |
2157 | is only used if the route did not select any realm. | |
2158 | ||
2159 | .TP | |
2160 | .BI nat " ADDRESS" | |
2161 | The base of the IP address block to translate (for source addresses). | |
ae9b671d | 2162 | The |
985794ad SH |
2163 | .I ADDRESS |
2164 | may be either the start of the block of NAT addresses (selected by NAT | |
2165 | routes) or a local host address (or even zero). | |
2166 | In the last case the router does not translate the packets, but | |
2167 | masquerades them to this address. | |
21561e71 | 2168 | Using map-to instead of nat means the same thing. |
985794ad SH |
2169 | |
2170 | .B Warning: | |
2171 | Changes to the RPDB made with these commands do not become active | |
2172 | immediately. It is assumed that after a script finishes a batch of | |
2173 | updates, it flushes the routing cache with | |
2174 | .BR "ip route flush cache" . | |
2175 | ||
890fe64e SH |
2176 | .SS ip rule flush - also dumps all the deleted rules. |
2177 | This command has no arguments. | |
2178 | ||
985794ad SH |
2179 | .SS ip rule show - list rules |
2180 | This command has no arguments. | |
21561e71 | 2181 | The options list or lst are synonyms with show. |
985794ad SH |
2182 | |
2183 | .SH ip maddress - multicast addresses management | |
2184 | ||
2185 | .B maddress | |
2186 | objects are multicast addresses. | |
2187 | ||
2188 | .SS ip maddress show - list multicast addresses | |
2189 | ||
2190 | .TP | |
2191 | .BI dev " NAME " (default) | |
2192 | the device name. | |
2193 | ||
2194 | .SS ip maddress add - add a multicast address | |
2195 | .SS ip maddress delete - delete a multicast address | |
2196 | these commands attach/detach a static link layer multicast address | |
2197 | to listen on the interface. | |
2198 | Note that it is impossible to join protocol multicast groups | |
2199 | statically. This command only manages link layer addresses. | |
2200 | ||
2201 | .TP | |
2202 | .BI address " LLADDRESS " (default) | |
2203 | the link layer multicast address. | |
2204 | ||
2205 | .TP | |
2206 | .BI dev " NAME" | |
2207 | the device to join/leave this multicast address. | |
2208 | ||
2209 | .SH ip mroute - multicast routing cache management | |
2210 | .B mroute | |
2211 | objects are multicast routing cache entries created by a user level | |
2212 | mrouting daemon (f.e. | |
2213 | .B pimd | |
2214 | or | |
2215 | .B mrouted | |
2216 | ). | |
2217 | ||
2218 | Due to the limitations of the current interface to the multicast routing | |
2219 | engine, it is impossible to change | |
2220 | .B mroute | |
2221 | objects administratively, so we may only display them. This limitation | |
2222 | will be removed in the future. | |
2223 | ||
2224 | .SS ip mroute show - list mroute cache entries | |
2225 | ||
2226 | .TP | |
2227 | .BI to " PREFIX " (default) | |
2228 | the prefix selecting the destination multicast addresses to list. | |
2229 | ||
2230 | .TP | |
2231 | .BI iif " NAME" | |
2232 | the interface on which multicast packets are received. | |
2233 | ||
2234 | .TP | |
2235 | .BI from " PREFIX" | |
2236 | the prefix selecting the IP source addresses of the multicast route. | |
2237 | ||
2238 | .SH ip tunnel - tunnel configuration | |
2239 | .B tunnel | |
8a10d311 | 2240 | objects are tunnels, encapsulating packets in IP packets and then |
985794ad | 2241 | sending them over the IP infrastructure. |
8a10d311 YH |
2242 | The encapulating (or outer) address family is specified by the |
2243 | .B -f | |
2244 | option. The default is IPv4. | |
985794ad SH |
2245 | |
2246 | .SS ip tunnel add - add a new tunnel | |
2247 | .SS ip tunnel change - change an existing tunnel | |
2248 | .SS ip tunnel delete - destroy a tunnel | |
2249 | ||
2250 | .TP | |
2251 | .BI name " NAME " (default) | |
2252 | select the tunnel device name. | |
2253 | ||
2254 | .TP | |
2255 | .BI mode " MODE" | |
8a10d311 YH |
2256 | set the tunnel mode. Available modes depend on the encapsulating address family. |
2257 | .br | |
2258 | Modes for IPv4 encapsulation available: | |
2259 | .BR ipip ", " sit ", " isatap " and " gre "." | |
2260 | .br | |
2261 | Modes for IPv6 encapsulation available: | |
2262 | .BR ip6ip6 ", " ipip6 " and " any "." | |
985794ad SH |
2263 | |
2264 | .TP | |
2265 | .BI remote " ADDRESS" | |
2266 | set the remote endpoint of the tunnel. | |
2267 | ||
2268 | .TP | |
2269 | .BI local " ADDRESS" | |
2270 | set the fixed local address for tunneled packets. | |
2271 | It must be an address on another interface of this host. | |
2272 | ||
2273 | .TP | |
2274 | .BI ttl " N" | |
ae9b671d | 2275 | set a fixed TTL |
985794ad SH |
2276 | .I N |
2277 | on tunneled packets. | |
2278 | .I N | |
2279 | is a number in the range 1--255. 0 is a special value | |
ae9b671d | 2280 | meaning that packets inherit the TTL value. |
8a10d311 | 2281 | The default value for IPv4 tunnels is: |
985794ad | 2282 | .BR "inherit" . |
8a10d311 YH |
2283 | The default value for IPv6 tunnels is: |
2284 | .BR "64" . | |
2285 | ||
985794ad SH |
2286 | |
2287 | .TP | |
2288 | .BI tos " T" | |
2289 | .TP | |
2290 | .BI dsfield " T" | |
8a10d311 YH |
2291 | .TP |
2292 | .BI tclass " T" | |
2293 | set a fixed TOS (or traffic class in IPv6) | |
985794ad SH |
2294 | .I T |
2295 | on tunneled packets. | |
2296 | The default value is: | |
2297 | .BR "inherit" . | |
2298 | ||
2299 | .TP | |
ae9b671d | 2300 | .BI dev " NAME" |
985794ad SH |
2301 | bind the tunnel to the device |
2302 | .I NAME | |
2303 | so that tunneled packets will only be routed via this device and will | |
2304 | not be able to escape to another device when the route to endpoint | |
2305 | changes. | |
2306 | ||
2307 | .TP | |
2308 | .B nopmtudisc | |
2309 | disable Path MTU Discovery on this tunnel. | |
2310 | It is enabled by default. Note that a fixed ttl is incompatible | |
2311 | with this option: tunnelling with a fixed ttl always makes pmtu | |
2312 | discovery. | |
2313 | ||
2314 | .TP | |
2315 | .BI key " K" | |
2316 | .TP | |
2317 | .BI ikey " K" | |
2318 | .TP | |
2319 | .BI okey " K" | |
2320 | .RB ( " only GRE tunnels " ) | |
2321 | use keyed GRE with key | |
2322 | .IR K ". " K | |
2323 | is either a number or an IP address-like dotted quad. | |
2324 | The | |
2325 | .B key | |
2326 | parameter sets the key to use in both directions. | |
2327 | The | |
2328 | .BR ikey " and " okey | |
2329 | parameters set different keys for input and output. | |
ae9b671d | 2330 | |
985794ad SH |
2331 | .TP |
2332 | .BR csum ", " icsum ", " ocsum | |
2333 | .RB ( " only GRE tunnels " ) | |
2334 | generate/require checksums for tunneled packets. | |
ae9b671d | 2335 | The |
985794ad SH |
2336 | .B ocsum |
2337 | flag calculates checksums for outgoing packets. | |
2338 | The | |
2339 | .B icsum | |
2340 | flag requires that all input packets have the correct | |
2341 | checksum. The | |
2342 | .B csum | |
2343 | flag is equivalent to the combination | |
2344 | .BR "icsum ocsum" . | |
2345 | ||
2346 | .TP | |
2347 | .BR seq ", " iseq ", " oseq | |
2348 | .RB ( " only GRE tunnels " ) | |
2349 | serialize packets. | |
2350 | The | |
2351 | .B oseq | |
2352 | flag enables sequencing of outgoing packets. | |
2353 | The | |
2354 | .B iseq | |
2355 | flag requires that all input packets are serialized. | |
2356 | The | |
2357 | .B seq | |
ae9b671d | 2358 | flag is equivalent to the combination |
985794ad SH |
2359 | .BR "iseq oseq" . |
2360 | .B It isn't work. Don't use it. | |
2361 | ||
8a10d311 | 2362 | .TP |
488f1c77 | 2363 | .BR "dscp inherit" |
8a10d311 YH |
2364 | .RB ( " only IPv6 tunnels " ) |
2365 | Inherit DS field between inner and outer header. | |
2366 | ||
2367 | .TP | |
8a10d311 YH |
2368 | .BI encaplim " ELIM" |
2369 | .RB ( " only IPv6 tunnels " ) | |
2370 | set a fixed encapsulation limit. Default is 4. | |
2371 | ||
2372 | .TP | |
8a10d311 YH |
2373 | .BI flowlabel " FLOWLABEL" |
2374 | .RB ( " only IPv6 tunnels " ) | |
2375 | set a fixed flowlabel. | |
2376 | ||
a07e9912 SH |
2377 | .SS ip tunnel prl - potential router list (ISATAP only) |
2378 | ||
2379 | .TP | |
2380 | .BI dev " NAME" | |
2381 | mandatory device name. | |
2382 | ||
2383 | .TP | |
2384 | .BI prl-default " ADDR" | |
2385 | .TP | |
2386 | .BI prl-nodefault " ADDR" | |
2387 | .TP | |
2388 | .BI prl-delete " ADDR" | |
2389 | .RB "Add or delete " ADDR | |
2390 | as a potential router or default router. | |
2391 | ||
985794ad SH |
2392 | .SS ip tunnel show - list tunnels |
2393 | This command has no arguments. | |
2394 | ||
2395 | .SH ip monitor and rtmon - state monitoring | |
2396 | ||
2397 | The | |
2398 | .B ip | |
2399 | utility can monitor the state of devices, addresses | |
2400 | and routes continuously. This option has a slightly different format. | |
2401 | Namely, the | |
2402 | .B monitor | |
2403 | command is the first in the command line and then the object list follows: | |
2404 | ||
2405 | .BR "ip monitor" " [ " all " |" | |
2406 | .IR LISTofOBJECTS " ]" | |
2407 | ||
2408 | .I OBJECT-LIST | |
2409 | is the list of object types that we want to monitor. | |
2410 | It may contain | |
2411 | .BR link ", " address " and " route "." | |
2412 | If no | |
2413 | .B file | |
2414 | argument is given, | |
2415 | .B ip | |
2416 | opens RTNETLINK, listens on it and dumps state changes in the format | |
2417 | described in previous sections. | |
2418 | ||
2419 | .P | |
2420 | If a file name is given, it does not listen on RTNETLINK, | |
2421 | but opens the file containing RTNETLINK messages saved in binary format | |
2422 | and dumps them. Such a history file can be generated with the | |
2423 | .B rtmon | |
2424 | utility. This utility has a command line syntax similar to | |
2425 | .BR "ip monitor" . | |
2426 | Ideally, | |
2427 | .B rtmon | |
2428 | should be started before the first network configuration command | |
2429 | is issued. F.e. if you insert: | |
2430 | .sp | |
2431 | .in +8 | |
2432 | rtmon file /var/log/rtmon.log | |
2433 | .in -8 | |
2434 | .sp | |
2435 | in a startup script, you will be able to view the full history | |
2436 | later. | |
2437 | ||
2438 | .P | |
2439 | Certainly, it is possible to start | |
2440 | .B rtmon | |
2441 | at any time. | |
2442 | It prepends the history with the state snapshot dumped at the moment | |
2443 | of starting. | |
2444 | ||
ae9b671d MM |
2445 | .SH ip xfrm - setting xfrm |
2446 | xfrm is an IP framework, which can transform format of the datagrams, | |
2447 | .br | |
2448 | i.e. encrypt the packets with some algorithm. xfrm policy and xfrm state | |
2449 | are associated through templates | |
2450 | .IR TMPL_LIST "." | |
2451 | This framework is used as a part of IPsec protocol. | |
2452 | ||
2453 | .SS ip xfrm state add - add new state into xfrm | |
2454 | ||
2455 | .SS ip xfrm state update - update existing xfrm state | |
2456 | ||
2457 | .SS ip xfrm state allocspi - allocate SPI value | |
2458 | ||
2459 | .TP | |
2460 | .I MODE | |
2461 | is set as default to | |
2462 | .BR transport "," | |
2463 | but it could be set to | |
2464 | .BR tunnel "," ro " or " beet "." | |
2465 | ||
2466 | .TP | |
2467 | .I FLAG-LIST | |
2468 | contains one or more flags. | |
2469 | ||
2470 | .TP | |
2471 | .I FLAG | |
2472 | could be set to | |
2473 | .BR noecn ", " decap-dscp " or " wildrecv "." | |
2474 | ||
2475 | .TP | |
2476 | .I ENCAP | |
2477 | encapsulation is set to encapsulation type | |
2478 | .IR ENCAP-TYPE ", source port " SPORT ", destination port " DPORT " and " OADDR "." | |
2479 | ||
2480 | .TP | |
2481 | .I ENCAP-TYPE | |
2482 | could be set to | |
2483 | .BR espinudp " or " espinudp-nonike "." | |
2484 | ||
2485 | .TP | |
2486 | .I ALGO-LIST | |
2487 | contains one or more algorithms | |
2488 | .I ALGO | |
2489 | which depend on the type of algorithm set by | |
2490 | .IR ALGO_TYPE "." | |
5c68fc88 | 2491 | Valid algorithms are: |
ae9b671d MM |
2492 | .BR enc ", " auth " or " comp "." |
2493 | ||
2494 | .SS ip xfrm policy add - add a new policy | |
2495 | ||
2496 | .SS ip xfrm policy update - update an existing policy | |
2497 | ||
2498 | .SS ip xfrm policy delete - delete existing policy | |
2499 | ||
2500 | .SS ip xfrm policy get - get existing policy | |
2501 | ||
2502 | .SS ip xfrm policy deleteall - delete all existing xfrm policy | |
2503 | ||
2504 | .SS ip xfrm policy list - print out the list of xfrm policy | |
2505 | ||
2506 | .SS ip xfrm policy flush - flush policies | |
2507 | It can be flush | |
2508 | .BR all | |
2509 | policies or only those specified with | |
2510 | .BR ptype "." | |
2511 | ||
2512 | .TP | |
2513 | .BI dir " DIR " | |
2514 | directory could be one of these: | |
2515 | .BR "inp", " out " or " fwd". | |
2516 | ||
2517 | .TP | |
2518 | .IR SELECTOR | |
2519 | selects for which addresses will be set up the policy. The selector | |
2520 | is defined by source and destination address. | |
2521 | ||
2522 | .TP | |
2523 | .IR UPSPEC | |
2524 | is defined by source port | |
2525 | .BR sport ", " | |
2526 | destination port | |
2527 | .BR dport ", " type | |
4a9608e6 | 2528 | as number, |
ae9b671d | 2529 | .B code |
4a9608e6 TT |
2530 | also number and |
2531 | .BR key | |
2532 | as dotted-quad or number. | |
ae9b671d MM |
2533 | |
2534 | .TP | |
2535 | .BI dev " DEV " | |
2536 | specify network device. | |
2537 | ||
2538 | .TP | |
2539 | .BI index " INDEX " | |
2540 | the number of indexed policy. | |
2541 | ||
2542 | .TP | |
2543 | .BI ptype " PTYPE " | |
2544 | type is set as default on | |
2545 | .BR "main" , | |
2546 | could be switch on | |
2547 | .BR "sub" . | |
2548 | ||
2549 | .TP | |
2550 | .BI action " ACTION " | |
2551 | is set as default on | |
2552 | .BR "allow". | |
2553 | It could be switch on | |
2554 | .BR "block". | |
2555 | ||
2556 | .TP | |
2557 | .BI priority " PRIORITY " | |
2558 | priority is a number. Default priority is set on zero. | |
2559 | ||
2560 | .TP | |
2561 | .IR LIMIT-LIST | |
2562 | limits are set in seconds, bytes or numbers of packets. | |
2563 | ||
2564 | .TP | |
2565 | .IR TMPL-LIST | |
2566 | template list is based on | |
2567 | .IR ID "," | |
2568 | .BR mode ", " reqid " and " level ". " | |
2569 | ||
2570 | .TP | |
2571 | .IR ID | |
2572 | is specified by source address, destination address, | |
2573 | .I proto | |
2574 | and value of | |
2575 | .IR spi "." | |
2576 | ||
2577 | .TP | |
2578 | .IR XFRM_PROTO | |
2579 | values: | |
2580 | .BR esp ", " ah ", " comp ", " route2 " or " hao "." | |
2581 | ||
2582 | .TP | |
2583 | .IR MODE | |
2584 | is set as default on | |
2585 | .BR transport "," | |
2586 | but it could be set on | |
2587 | .BR tunnel " or " beet "." | |
2588 | ||
2589 | .TP | |
2590 | .IR LEVEL | |
2591 | is set as default on | |
2592 | .BR required | |
2593 | and the other choice is | |
2594 | .BR use "." | |
2595 | ||
2596 | .TP | |
2597 | .IR UPSPEC | |
2598 | is specified by | |
4a9608e6 TT |
2599 | .BR sport " and " dport " (for UDP/TCP), " |
2600 | .BR type " and " code " (for ICMP; as number) or " | |
2601 | .BR key " (for GRE; as dotted-quad or number)." | |
2602 | . | |
ae9b671d MM |
2603 | |
2604 | .SS ip xfrm monitor - is used for listing all objects or defined group of them. | |
2605 | The | |
2606 | .B xfrm monitor | |
2607 | can monitor the policies for all objects or defined group of them. | |
2608 | ||
985794ad | 2609 | .SH HISTORY |
985794ad SH |
2610 | .B ip |
2611 | was written by Alexey N. Kuznetsov and added in Linux 2.2. | |
2612 | .SH SEE ALSO | |
2613 | .BR tc (8) | |
2614 | .br | |
2615 | .RB "IP Command reference " ip-cref.ps | |
2616 | .br | |
2617 | .RB "IP tunnels " ip-cref.ps | |
fd3877fe AW |
2618 | .br |
2619 | .RB "User documentation at " http://lartc.org/ ", but please direct bugreports and patches to: " <netdev@vger.kernel.org> | |
985794ad SH |
2620 | |
2621 | .SH AUTHOR | |
526afe40 | 2622 | Original Manpage by Michail Litvak <mci@owl.openwall.com> |