man/man8/ip-link.8.in

   1 .TH IP\-LINK 8 "13 Dec 2012" "iproute2" "Linux"
   2 .SH "NAME"
   3 ip-link \- network device configuration
   4 .SH "SYNOPSIS"
   5 .sp
   6 .ad l
   7 .in +8
   8 .ti -8
   9 .B ip link
  10 .RI  " { " COMMAND " | "
  11 .BR help " }"
  12 .sp
  13
  14 .ti -8
  15 .BI "ip link add"
  16 .RB "[ " link
  17 .IR DEVICE " ]"
  18 .RB "[ " name " ]"
  19 .I NAME
  20 .br
  21 .RB "[ " txqueuelen
  22 .IR PACKETS " ]"
  23 .br
  24 .RB "[ " address
  25 .IR LLADDR " ]"
  26 .RB "[ " broadcast
  27 .IR LLADDR " ]"
  28 .br
  29 .RB "[ " mtu
  30 .IR MTU " ]"
  31 .RB "[ " index
  32 .IR IDX " ]"
  33 .br
  34 .RB "[ " numtxqueues
  35 .IR QUEUE_COUNT " ]"
  36 .RB "[ " numrxqueues
  37 .IR QUEUE_COUNT " ]"
  38 .br
  39 .BI type " TYPE"
  40 .RI "[ " ARGS " ]"
  41
  42 .ti -8
  43 .BR "ip link delete " {
  44 .IR DEVICE " | "
  45 .BI "group " GROUP
  46 }
  47 .BI type " TYPE"
  48 .RI "[ " ARGS " ]"
  49
  50 .ti -8
  51 .BR "ip link set " {
  52 .IR DEVICE " | "
  53 .BI "group " GROUP
  54 }
  55 .br
  56 .RB "[ { " up " | " down " } ]"
  57 .br
  58 .RB "[ " type
  59 .IR "ETYPE TYPE_ARGS" " ]"
  60 .br
  61 .RB "[ " arp " { " on " | " off " } ]"
  62 .br
  63 .RB "[ " dynamic " { " on " | " off " } ]"
  64 .br
  65 .RB "[ " multicast " { " on " | " off " } ]"
  66 .br
  67 .RB "[ " allmulticast " { " on " | " off " } ]"
  68 .br
  69 .RB "[ " promisc " { " on " | " off " } ]"
  70 .br
  71 .RB "[ " protodown " { " on " | " off " } ]"
  72 .br
  73 .RB "[ " trailers " { " on " | " off " } ]"
  74 .br
  75 .RB "[ " txqueuelen
  76 .IR PACKETS " ]"
  77 .br
  78 .RB "[ " name
  79 .IR NEWNAME " ]"
  80 .br
  81 .RB "[ " address
  82 .IR LLADDR " ]"
  83 .br
  84 .RB "[ " broadcast
  85 .IR LLADDR " ]"
  86 .br
  87 .RB "[ " mtu
  88 .IR MTU " ]"
  89 .br
  90 .RB "[ " netns " {"
  91 .IR PID " | " NETNSNAME " } ]"
  92 .br
  93 .RB "[ " link-netnsid
  94 .IR ID " ]"
  95 .br
  96 .RB "[ " alias
  97 .IR NAME  " ]"
  98 .br
  99 .RB "[ " vf
 100 .IR NUM " ["
 101 .B  mac
 102 .IR LLADDR " ]"
 103 .br
 104 .in +9
 105 .RI "[ " VFVLAN-LIST " ]"
 106 .br
 107 .RB "[ " rate
 108 .IR TXRATE " ]"
 109 .br
 110 .RB "[ " max_tx_rate
 111 .IR TXRATE " ]"
 112 .br
 113 .RB "[ " min_tx_rate
 114 .IR TXRATE " ]"
 115 .br
 116 .RB "[ " spoofchk " { " on " | " off " } ]"
 117 .br
 118 .RB "[ " query_rss " { " on " | " off " } ]"
 119 .br
 120 .RB "[ " state " { " auto " | " enable " | " disable " } ]"
 121 .br
 122 .RB "[ " trust " { " on " | " off " } ]"
 123 .br
 124 .RB "[ " node_guid " eui64 ]"
 125 .br
 126 .RB "[ " port_guid " eui64 ] ]"
 127 .br
 128 .in -9
 129 .RB "[ { " xdp " | " xdpgeneric  " | " xdpdrv " } { " off " | "
 130 .br
 131 .in +8
 132 .BR object
 133 .IR FILE
 134 .RB "[ " section
 135 .IR NAME " ]"
 136 .RB "[ " verbose " ] |"
 137 .br
 138 .BR pinned
 139 .IR FILE " } ]"
 140 .br
 141 .in -8
 142 .RB "[ " master
 143 .IR DEVICE " ]"
 144 .br
 145 .RB "[ " nomaster " ]"
 146 .br
 147 .RB "[ " vrf
 148 .IR NAME " ]"
 149 .br
 150 .RB "[ " addrgenmode " { " eui64 " | " none " | " stable_secret " | " random " } ]"
 151 .br
 152 .RB "[ " macaddr " { " flush " | { " add " | " del " } "
 153 .IR MACADDR " | set [ "
 154 .IR MACADDR " [ "
 155 .IR MACADDR " [ ... ] ] ] } ]"
 156 .br
 157
 158 .ti -8
 159 .B ip link show
 160 .RI "[ " DEVICE " | "
 161 .B group
 162 .IR GROUP " ] ["
 163 .BR up " ] ["
 164 .B master
 165 .IR DEVICE " ] ["
 166 .B type
 167 .IR ETYPE " ] ["
 168 .B vrf
 169 .IR NAME " ]"
 170
 171 .ti -8
 172 .B ip link xstats
 173 .BI type " TYPE"
 174 .RI "[ " ARGS " ]"
 175
 176 .ti -8
 177 .B ip link afstats
 178 .RB "[ " dev
 179 .IR DEVICE " ]"
 180
 181 .ti -8
 182 .B ip link help
 183 .RI "[ " TYPE " ]"
 184
 185 .ti -8
 186 .IR TYPE " := [ "
 187 .BR bridge " | "
 188 .BR bond " | "
 189 .BR can " | "
 190 .BR dummy " | "
 191 .BR hsr " | "
 192 .BR ifb " | "
 193 .BR ipoib " |"
 194 .BR macvlan  " | "
 195 .BR macvtap  " | "
 196 .BR vcan " | "
 197 .BR veth " | "
 198 .BR vlan " | "
 199 .BR vxlan " |"
 200 .BR ip6tnl " |"
 201 .BR ipip " |"
 202 .BR sit " |"
 203 .BR gre " |"
 204 .BR gretap " |"
 205 .BR ip6gre " |"
 206 .BR ip6gretap " |"
 207 .BR vti " |"
 208 .BR nlmon " |"
 209 .BR ipvlan " |"
 210 .BR lowpan " |"
 211 .BR geneve " |"
 212 .BR vrf " |"
 213 .BR macsec " ]"
 214
 215 .ti -8
 216 .IR ETYPE " := [ " TYPE " |"
 217 .BR bridge_slave " | " bond_slave " ]"
 218
 219 .ti -8
 220 .IR VFVLAN-LIST " := [ "  VFVLAN-LIST " ] " VFVLAN
 221
 222 .ti -8
 223 .IR VFVLAN " := "
 224 .RB "[ " vlan
 225 .IR VLANID " [ "
 226 .B qos
 227 .IR VLAN-QOS " ] ["
 228 .B proto
 229 .IR VLAN-PROTO " ] ]"
 230
 231 .SH "DESCRIPTION"
 232 .SS ip link add - add virtual link
 233
 234 .TP
 235 .BI link " DEVICE "
 236 specifies the physical device to act operate on.
 237
 238 .I NAME
 239 specifies the name of the new virtual device.
 240
 241 .I TYPE
 242 specifies the type of the new device.
 243 .sp
 244 Link types:
 245
 246 .in +8
 247 .B bridge
 248 - Ethernet Bridge device
 249 .sp
 250 .B bond
 251 - Bonding device
 252 .B can
 253 - Controller Area Network interface
 254 .sp
 255 .B dummy
 256 - Dummy network interface
 257 .sp
 258 .B hsr
 259 - High-availability Seamless Redundancy device
 260 .sp
 261 .B ifb
 262 - Intermediate Functional Block device
 263 .sp
 264 .B ipoib
 265 - IP over Infiniband device
 266 .sp
 267 .B macvlan
 268 - Virtual interface base on link layer address (MAC)
 269 .sp
 270 .B macvtap
 271 - Virtual interface based on link layer address (MAC) and TAP.
 272 .sp
 273 .B vcan
 274 - Virtual Controller Area Network interface
 275 .sp
 276 .B veth
 277 - Virtual ethernet interface
 278 .sp
 279 .BR vlan
 280 - 802.1q tagged virtual LAN interface
 281 .sp
 282 .BR vxlan
 283 - Virtual eXtended LAN
 284 .sp
 285 .BR ip6tnl
 286 - Virtual tunnel interface IPv4|IPv6 over IPv6
 287 .sp
 288 .BR ipip
 289 - Virtual tunnel interface IPv4 over IPv4
 290 .sp
 291 .BR sit
 292 - Virtual tunnel interface IPv6 over IPv4
 293 .sp
 294 .BR gre
 295 - Virtual tunnel interface GRE over IPv4
 296 .sp
 297 .BR gretap
 298 - Virtual L2 tunnel interface GRE over IPv4
 299 .sp
 300 .BR ip6gre
 301 - Virtual tunnel interface GRE over IPv6
 302 .sp
 303 .BR ip6gretap
 304 - Virtual L2 tunnel interface GRE over IPv6
 305 .sp
 306 .BR vti
 307 - Virtual tunnel interface
 308 .sp
 309 .BR nlmon
 310 - Netlink monitoring device
 311 .sp
 312 .BR ipvlan
 313 - Interface for L3 (IPv6/IPv4) based VLANs
 314 .sp
 315 .BR lowpan
 316 - Interface for 6LoWPAN (IPv6) over IEEE 802.15.4 / Bluetooth
 317 .sp
 318 .BR geneve
 319 - GEneric NEtwork Virtualization Encapsulation
 320 .sp
 321 .BR macsec
 322 - Interface for IEEE 802.1AE MAC Security (MACsec)
 323 .sp
 324 .BR vrf
 325 - Interface for L3 VRF domains
 326 .in -8
 327
 328 .TP
 329 .BI numtxqueues " QUEUE_COUNT "
 330 specifies the number of transmit queues for new device.
 331
 332 .TP
 333 .BI numrxqueues " QUEUE_COUNT "
 334 specifies the number of receive queues for new device.
 335
 336 .TP
 337 .BI index " IDX "
 338 specifies the desired index of the new virtual device. The link creation fails, if the index is busy.
 339
 340 .TP
 341 VLAN Type Support
 342 For a link of type
 343 .I VLAN
 344 the following additional arguments are supported:
 345
 346 .BI "ip link add
 347 .BI link " DEVICE "
 348 .BI name " NAME "
 349 .B "type vlan"
 350 [
 351 .BI protocol " VLAN_PROTO "
 352 ]
 353 .BI id " VLANID "
 354 [
 355 .BR reorder_hdr " { " on " | " off " } "
 356 ]
 357 [
 358 .BR gvrp " { " on " | " off " } "
 359 ]
 360 [
 361 .BR mvrp " { " on " | " off " } "
 362 ]
 363 [
 364 .BR loose_binding " { " on " | " off " } "
 365 ]
 366 [
 367 .BI ingress-qos-map " QOS-MAP "
 368 ]
 369 [
 370 .BI egress-qos-map " QOS-MAP "
 371 ]
 372
 373 .in +8
 374 .sp
 375 .BI protocol " VLAN_PROTO "
 376 - either 802.1Q or 802.1ad.
 377
 378 .BI id " VLANID "
 379 - specifies the VLAN Identifer to use. Note that numbers with a leading " 0 " or " 0x " are interpreted as octal or hexadeimal, respectively.
 380
 381 .BR reorder_hdr " { " on " | " off " } "
 382 - specifies whether ethernet headers are reordered or not (default is
 383 .BR on ")."
 384
 385 .in +4
 386 If
 387 .BR reorder_hdr " is " on
 388 then VLAN header will be not inserted immediately but only before passing to the
 389 physical device (if this device does not support VLAN offloading), the similar
 390 on the RX direction - by default the packet will be untagged before being
 391 received by VLAN device. Reordering allows to accelerate tagging on egress and
 392 to hide VLAN header on ingress so the packet looks like regular Ethernet packet,
 393 at the same time it might be confusing for packet capture as the VLAN header
 394 does not exist within the packet.
 395
 396 VLAN offloading can be checked by
 397 .BR ethtool "(8):"
 398 .in +4
 399 .sp
 400 .B ethtool -k
 401 <phy_dev> |
 402 .RB grep " tx-vlan-offload"
 403 .sp
 404 .in -4
 405 where <phy_dev> is the physical device to which VLAN device is bound.
 406 .in -4
 407
 408 .BR gvrp " { " on " | " off " } "
 409 - specifies whether this VLAN should be registered using GARP VLAN Registration Protocol.
 410
 411 .BR mvrp " { " on " | " off " } "
 412 - specifies whether this VLAN should be registered using Multiple VLAN Registration Protocol.
 413
 414 .BR loose_binding " { " on " | " off " } "
 415 - specifies whether the VLAN device state is bound to the physical device state.
 416
 417 .BI ingress-qos-map " QOS-MAP "
 418 - defines a mapping of VLAN header prio field to the Linux internal packet
 419 priority on incoming frames. The format is FROM:TO with multiple mappings
 420 separated by spaces.
 421
 422 .BI egress-qos-map " QOS-MAP "
 423 - defines a mapping of Linux internal packet priority to VLAN header prio field
 424 but for outgoing frames. The format is the same as for ingress-qos-map.
 425 .in +4
 426
 427 Linux packet priority can be set by
 428 .BR iptables "(8)":
 429 .in +4
 430 .sp
 431 .B iptables
 432 -t mangle -A POSTROUTING [...] -j CLASSIFY --set-class 0:4
 433 .sp
 434 .in -4
 435 and this "4" priority can be used in the egress qos mapping to set VLAN prio "5":
 436 .sp
 437 .in +4
 438 .B ip
 439 link set veth0.10 type vlan egress 4:5
 440 .in -4
 441 .in -4
 442 .in -8
 443
 444 .TP
 445 VXLAN Type Support
 446 For a link of type
 447 .I VXLAN
 448 the following additional arguments are supported:
 449
 450 .BI "ip link add " DEVICE
 451 .BI type " vxlan " id " VNI"
 452 [
 453 .BI dev " PHYS_DEV "
 454 .RB " ] [ { " group " | " remote " } "
 455 .I IPADDR
 456 ] [
 457 .B local
 458 .RI "{ "IPADDR " | "any " } "
 459 ] [
 460 .BI ttl " TTL "
 461 ] [
 462 .BI tos " TOS "
 463 ] [
 464 .BI flowlabel " FLOWLABEL "
 465 ] [
 466 .BI dstport " PORT "
 467 ] [
 468 .BI srcport " MIN MAX "
 469 ] [
 470 .RB [ no ] learning
 471 ] [
 472 .RB [ no ] proxy
 473 ] [
 474 .RB [ no ] rsc
 475 ] [
 476 .RB [ no ] l2miss
 477 ] [
 478 .RB [ no ] l3miss
 479 ] [
 480 .RB [ no ] udpcsum
 481 ] [
 482 .RB [ no ] udp6zerocsumtx
 483 ] [
 484 .RB [ no ] udp6zerocsumrx
 485 ] [
 486 .BI ageing " SECONDS "
 487 ] [
 488 .BI maxaddress " NUMBER "
 489 ] [
 490 .RB [ no ] external
 491 ] [
 492 .B gbp
 493 ] [
 494 .B gpe
 495 ]
 496
 497 .in +8
 498 .sp
 499 .BI  id " VNI "
 500 - specifies the VXLAN Network Identifer (or VXLAN Segment
 501 Identifier) to use.
 502
 503 .BI dev " PHYS_DEV"
 504 - specifies the physical device to use for tunnel endpoint communication.
 505
 506 .sp
 507 .BI group " IPADDR"
 508 - specifies the multicast IP address to join.
 509 This parameter cannot be specified with the
 510 .B remote
 511 parameter.
 512
 513 .sp
 514 .BI remote " IPADDR"
 515 - specifies the unicast destination IP address to use in outgoing packets
 516 when the destination link layer address is not known in the VXLAN device
 517 forwarding database. This parameter cannot be specified with the
 518 .B group
 519 parameter.
 520
 521 .sp
 522 .BI local " IPADDR"
 523 - specifies the source IP address to use in outgoing packets.
 524
 525 .sp
 526 .BI ttl " TTL"
 527 - specifies the TTL value to use in outgoing packets.
 528
 529 .sp
 530 .BI tos " TOS"
 531 - specifies the TOS value to use in outgoing packets.
 532
 533 .sp
 534 .BI flowlabel " FLOWLABEL"
 535 - specifies the flow label to use in outgoing packets.
 536
 537 .sp
 538 .BI dstport " PORT"
 539 - specifies the UDP destination port to communicate to the remote VXLAN tunnel endpoint.
 540
 541 .sp
 542 .BI srcport " MIN MAX"
 543 - specifies the range of port numbers to use as UDP
 544 source ports to communicate to the remote VXLAN tunnel endpoint.
 545
 546 .sp
 547 .RB [ no ] learning
 548 - specifies if unknown source link layer addresses and IP addresses
 549 are entered into the VXLAN device forwarding database.
 550
 551 .sp
 552 .RB [ no ] rsc
 553 - specifies if route short circuit is turned on.
 554
 555 .sp
 556 .RB [ no ] proxy
 557 - specifies ARP proxy is turned on.
 558
 559 .sp
 560 .RB [ no ] l2miss
 561 - specifies if netlink LLADDR miss notifications are generated.
 562
 563 .sp
 564 .RB [ no ] l3miss
 565 - specifies if netlink IP ADDR miss notifications are generated.
 566
 567 .sp
 568 .RB [ no ] udpcsum
 569 - specifies if UDP checksum is calculated for transmitted packets over IPv4.
 570
 571 .sp
 572 .RB [ no ] udp6zerocsumtx
 573 - skip UDP checksum calculation for transmitted packets over IPv6.
 574
 575 .sp
 576 .RB [ no ] udp6zerocsumrx
 577 - allow incoming UDP packets over IPv6 with zero checksum field.
 578
 579 .sp
 580 .BI ageing " SECONDS"
 581 - specifies the lifetime in seconds of FDB entries learnt by the kernel.
 582
 583 .sp
 584 .BI maxaddress " NUMBER"
 585 - specifies the maximum number of FDB entries.
 586
 587 .sp
 588 .RB [ no ] external
 589 - specifies whether an external control plane
 590 .RB "(e.g. " "ip route encap" )
 591 or the internal FDB should be used.
 592
 593 .sp
 594 .B gbp
 595 - enables the Group Policy extension (VXLAN-GBP).
 596
 597 .in +4
 598 Allows to transport group policy context across VXLAN network peers.
 599 If enabled, includes the mark of a packet in the VXLAN header for outgoing
 600 packets and fills the packet mark based on the information found in the
 601 VXLAN header for incomming packets.
 602
 603 Format of upper 16 bits of packet mark (flags);
 604
 605 .in +2
 606 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 607 .br
 608 |-|-|-|-|-|-|-|-|-|D|-|-|A|-|-|-|
 609 .br
 610 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 611
 612 .B D :=
 613 Don't Learn bit. When set, this bit indicates that the egress
 614 VTEP MUST NOT learn the source address of the encapsulated frame.
 615
 616 .B A :=
 617 Indicates that the group policy has already been applied to
 618 this packet. Policies MUST NOT be applied by devices when the A bit is set.
 619 .in -2
 620
 621 Format of lower 16 bits of packet mark (policy ID):
 622
 623 .in +2
 624 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 625 .br
 626 |        Group Policy ID        |
 627 .br
 628 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 629 .in -2
 630
 631 Example:
 632   iptables -A OUTPUT [...] -j MARK --set-mark 0x800FF
 633
 634 .in -4
 635
 636 .sp
 637 .B gpe
 638 - enables the Generic Protocol extension (VXLAN-GPE). Currently, this is
 639 only supported together with the
 640 .B external
 641 keyword.
 642
 643 .in -8
 644
 645 .TP
 646 GRE, IPIP, SIT Type Support
 647 For a link of types
 648 .I GRE/IPIP/SIT
 649 the following additional arguments are supported:
 650
 651 .BI "ip link add " DEVICE
 652 .BR type " { " gre " | " ipip " | " sit " }"
 653 .BI " remote " ADDR " local " ADDR
 654 [
 655 .BR encap " { " fou " | " gue " | " none " }"
 656 ] [
 657 .BR encap-sport " { " \fIPORT " | " auto " }"
 658 ] [
 659 .BI "encap-dport " PORT
 660 ] [
 661 .RB [ no ] encap-csum
 662 ] [
 663 .RB [ no ] encap-remcsum
 664 ]
 665
 666 .in +8
 667 .sp
 668 .BI  remote " ADDR "
 669 - specifies the remote address of the tunnel.
 670
 671 .sp
 672 .BI  local " ADDR "
 673 - specifies the fixed local address for tunneled packets.
 674 It must be an address on another interface on this host.
 675
 676 .sp
 677 .BR encap " { " fou " | " gue " | " none " }"
 678 - specifies type of secondary UDP encapsulation. "fou" indicates
 679 Foo-Over-UDP, "gue" indicates Generic UDP Encapsulation.
 680
 681 .sp
 682 .BR encap-sport " { " \fIPORT " | " auto " }"
 683 - specifies the source port in UDP encapsulation.
 684 .IR PORT
 685 indicates the port by number, "auto"
 686 indicates that the port number should be chosen automatically
 687 (the kernel picks a flow based on the flow hash of the
 688 encapsulated packet).
 689
 690 .sp
 691 .RB [ no ] encap-csum
 692 - specifies if UDP checksums are enabled in the secondary
 693 encapsulation.
 694
 695 .sp
 696 .RB [ no ] encap-remcsum
 697 - specifies if Remote Checksum Offload is enabled. This is only
 698 applicable for Generic UDP Encapsulation.
 699
 700 .in -8
 701
 702 .TP
 703 IP6GRE/IP6GRETAP Type Support
 704 For a link of type
 705 .I IP6GRE/IP6GRETAP
 706 the following additional arguments are supported:
 707
 708 .BI "ip link add " DEVICE
 709 .BR type " { " ip6gre " | " ip6gretap " }"
 710 .BI remote " ADDR " local " ADDR"
 711 [
 712 .RB [ i | o ] seq
 713 ] [
 714 .RB [ i | o ] key
 715 .I KEY
 716 ] [
 717 .RB [ i | o ] csum
 718 ] [
 719 .BI hoplimit " TTL "
 720 ] [
 721 .BI encaplimit " ELIM "
 722 ] [
 723 .BI tclass " TCLASS "
 724 ] [
 725 .BI flowlabel " FLOWLABEL "
 726 ] [
 727 .BI "dscp inherit"
 728 ] [
 729 .BI dev " PHYS_DEV "
 730 ]
 731
 732 .in +8
 733 .sp
 734 .BI  remote " ADDR "
 735 - specifies the remote IPv6 address of the tunnel.
 736
 737 .sp
 738 .BI  local " ADDR "
 739 - specifies the fixed local IPv6 address for tunneled packets.
 740 It must be an address on another interface on this host.
 741
 742 .sp
 743 .RB  [ i | o ] seq
 744 - serialize packets.
 745 The
 746 .B oseq
 747 flag enables sequencing of outgoing packets.
 748 The
 749 .B iseq
 750 flag requires that all input packets are serialized.
 751
 752 .sp
 753 .RB  [ i | o ] key " \fIKEY"
 754 - use keyed GRE with key
 755 .IR KEY ". "KEY
 756 is either a number or an IPv4 address-like dotted quad.
 757 The
 758 .B key
 759 parameter specifies the same key to use in both directions.
 760 The
 761 .BR ikey " and " okey
 762 parameters specify different keys for input and output.
 763
 764 .sp
 765 .RB  [ i | o ] csum
 766 - generate/require checksums for tunneled packets.
 767 The
 768 .B ocsum
 769 flag calculates checksums for outgoing packets.
 770 The
 771 .B icsum
 772 flag requires that all input packets have the correct
 773 checksum. The
 774 .B csum
 775 flag is equivalent to the combination
 776 .BR "icsum ocsum" .
 777
 778 .sp
 779 .BI  hoplimit " TTL"
 780 - specifies Hop Limit value to use in outgoing packets.
 781
 782 .sp
 783 .BI  encaplimit " ELIM"
 784 - specifies a fixed encapsulation limit. Default is 4.
 785
 786 .sp
 787 .BI  flowlabel " FLOWLABEL"
 788 - specifies a fixed flowlabel.
 789
 790 .sp
 791 .BI  tclass " TCLASS"
 792 - specifies the traffic class field on
 793 tunneled packets, which can be specified as either a two-digit
 794 hex value (e.g. c0) or a predefined string (e.g. internet).
 795 The value
 796 .B inherit
 797 causes the field to be copied from the original IP header. The
 798 values
 799 .BI "inherit/" STRING
 800 or
 801 .BI "inherit/" 00 ".." ff
 802 will set the field to
 803 .I STRING
 804 or
 805 .IR 00 ".." ff
 806 when tunneling non-IP packets. The default value is 00.
 807
 808 .in -8
 809
 810 .TP
 811 IPoIB Type Support
 812 For a link of type
 813 .I IPoIB
 814 the following additional arguments are supported:
 815
 816 .BI "ip link add " DEVICE " name " NAME
 817 .BR "type ipoib " [ " pkey \fIPKEY" " ] [ " mode " \fIMODE \fR]"
 818
 819 .in +8
 820 .sp
 821 .BI  pkey " PKEY "
 822 - specifies the IB P-Key to use.
 823
 824 .BI  mode " MODE "
 825 - specifies the mode (datagram or connected) to use.
 826
 827 .TP
 828 GENEVE Type Support
 829 For a link of type
 830 .I GENEVE
 831 the following additional arguments are supported:
 832
 833 .BI "ip link add " DEVICE
 834 .BI type " geneve " id " VNI " remote " IPADDR"
 835 [
 836 .BI ttl " TTL "
 837 ] [
 838 .BI tos " TOS "
 839 ] [
 840 .BI flowlabel " FLOWLABEL "
 841 ] [
 842 .BI dstport " PORT"
 843 ] [
 844 .RB [ no ] external
 845 ] [
 846 .RB [ no ] udpcsum
 847 ] [
 848 .RB [ no ] udp6zerocsumtx
 849 ] [
 850 .RB [ no ] udp6zerocsumrx
 851 ]
 852
 853 .in +8
 854 .sp
 855 .BI  id " VNI "
 856 - specifies the Virtual Network Identifer to use.
 857
 858 .sp
 859 .BI remote " IPADDR"
 860 - specifies the unicast destination IP address to use in outgoing packets.
 861
 862 .sp
 863 .BI ttl " TTL"
 864 - specifies the TTL value to use in outgoing packets.
 865
 866 .sp
 867 .BI tos " TOS"
 868 - specifies the TOS value to use in outgoing packets.
 869
 870 .sp
 871 .BI flowlabel " FLOWLABEL"
 872 - specifies the flow label to use in outgoing packets.
 873
 874 .sp
 875 .BI dstport " PORT"
 876 - select a destination port other than the default of 6081.
 877
 878 .sp
 879 .RB [ no ] external
 880 - make this tunnel externally controlled (or not, which is the default). This
 881 flag is mutually exclusive with the
 882 .BR id ,
 883 .BR remote ,
 884 .BR ttl ,
 885 .BR tos " and " flowlabel
 886 options.
 887
 888 .sp
 889 .RB [ no ] udpcsum
 890 - specifies if UDP checksum is calculated for transmitted packets over IPv4.
 891
 892 .sp
 893 .RB [ no ] udp6zerocsumtx
 894 - skip UDP checksum calculation for transmitted packets over IPv6.
 895
 896 .sp
 897 .RB [ no ] udp6zerocsumrx
 898 - allow incoming UDP packets over IPv6 with zero checksum field.
 899
 900 .in -8
 901
 902 .TP
 903 MACVLAN and MACVTAP Type Support
 904 For a link of type
 905 .I MACVLAN
 906 or
 907 .I MACVTAP
 908 the following additional arguments are supported:
 909
 910 .BI "ip link add link " DEVICE " name " NAME
 911 .BR type " { " macvlan " | " macvtap " } "
 912 .BR mode " { " private " | " vepa " | " bridge " | " passthru
 913 .RB " [ " nopromisc " ] | " source " } "
 914
 915 .in +8
 916 .sp
 917 .BR type " { " macvlan " | " macvtap " } "
 918 - specifies the link type to use.
 919 .BR macvlan " creates just a virtual interface, while "
 920 .BR macvtap " in addition creates a character device "
 921 .BR /dev/tapX " to be used just like a " tuntap " device."
 922
 923 .B mode private
 924 - Do not allow communication between
 925 .B macvlan
 926 instances on the same physical interface, even if the external switch supports
 927 hairpin mode.
 928
 929 .B mode vepa
 930 - Virtual Ethernet Port Aggregator mode. Data from one
 931 .B macvlan
 932 instance to the other on the same physical interface is transmitted over the
 933 physical interface. Either the attached switch needs to support hairpin mode,
 934 or there must be a TCP/IP router forwarding the packets in order to allow
 935 communication. This is the default mode.
 936
 937 .B mode bridge
 938 - In bridge mode, all endpoints are directly connected to each other,
 939 communication is not redirected through the physical interface's peer.
 940
 941 .BR mode " " passthru " [ " nopromisc " ] "
 942 - This mode gives more power to a single endpoint, usually in
 943 .BR macvtap " mode. It is not allowed for more than one endpoint on the same "
 944 physical interface. All traffic will be forwarded to this endpoint, allowing
 945 virtio guests to change MAC address or set promiscuous mode in order to bridge
 946 the interface or create vlan interfaces on top of it. By default, this mode
 947 forces the underlying interface into promiscuous mode. Passing the
 948 .BR nopromisc " flag prevents this, so the promisc flag may be controlled "
 949 using standard tools.
 950
 951 .B mode source
 952 - allows one to set a list of allowed mac address, which is used to match
 953 against source mac address from received frames on underlying interface. This
 954 allows creating mac based VLAN associations, instead of standard port or tag
 955 based. The feature is useful to deploy 802.1x mac based behavior,
 956 where drivers of underlying interfaces doesn't allows that.
 957 .in -8
 958
 959 .TP
 960 High-availability Seamless Redundancy (HSR) Support
 961 For a link of type
 962 .I HSR
 963 the following additional arguments are supported:
 964
 965 .BI "ip link add link " DEVICE " name " NAME " type hsr"
 966 .BI slave1 " SLAVE1-IF " slave2 " SLAVE2-IF "
 967 .RB [ " supervision"
 968 .IR ADDR-BYTE " ] ["
 969 .BR version " { " 0 " | " 1 " } ]"
 970
 971 .in +8
 972 .sp
 973 .BR type " hsr "
 974 - specifies the link type to use, here HSR.
 975
 976 .BI slave1 " SLAVE1-IF "
 977 - Specifies the physical device used for the first of the two ring ports.
 978
 979 .BI slave2 " SLAVE2-IF "
 980 - Specifies the physical device used for the second of the two ring ports.
 981
 982 .BI supervision " ADDR-BYTE"
 983 - The last byte of the multicast address used for HSR supervision frames.
 984 Default option is "0", possible values 0-255.
 985
 986 .BR version " { " 0 " | " 1 " }"
 987 - Selects the protocol version of the interface. Default option is "0", which
 988 corresponds to the 2010 version of the HSR standard. Option "1" activates the
 989 2012 version.
 990 .in -8
 991
 992 .TP
 993 BRIDGE Type Support
 994 For a link of type
 995 .I BRIDGE
 996 the following additional arguments are supported:
 997
 998 .BI "ip link add " DEVICE " type bridge "
 999 [
1000 .BI ageing_time " AGEING_TIME "
1001 ] [
1002 .BI group_fwd_mask " MASK "
1003 ] [
1004 .BI group_address " ADDRESS "
1005 ] [
1006 .BI forward_delay " FORWARD_DELAY "
1007 ] [
1008 .BI hello_time " HELLO_TIME "
1009 ] [
1010 .BI max_age " MAX_AGE "
1011 ] [
1012 .BI stp_state " STP_STATE "
1013 ] [
1014 .BI priority " PRIORITY "
1015 ] [
1016 .BI vlan_filtering " VLAN_FILTERING "
1017 ] [
1018 .BI vlan_protocol " VLAN_PROTOCOL "
1019 ] [
1020 .BI vlan_default_pvid " VLAN_DEFAULT_PVID "
1021 ] [
1022 .BI vlan_stats_enabled " VLAN_STATS_ENABLED "
1023 ] [
1024 .BI mcast_snooping " MULTICAST_SNOOPING "
1025 ] [
1026 .BI mcast_router " MULTICAST_ROUTER "
1027 ] [
1028 .BI mcast_query_use_ifaddr " MCAST_QUERY_USE_IFADDR "
1029 ] [
1030 .BI mcast_querier " MULTICAST_QUERIER "
1031 ] [
1032 .BI mcast_hash_elasticity " HASH_ELASTICITY "
1033 ] [
1034 .BI mcast_hash_max " HASH_MAX "
1035 ] [
1036 .BI mcast_last_member_count " LAST_MEMBER_COUNT "
1037 ] [
1038 .BI mcast_startup_query_count " STARTUP_QUERY_COUNT "
1039 ] [
1040 .BI mcast_last_member_interval " LAST_MEMBER_INTERVAL "
1041 ] [
1042 .BI mcast_membership_interval " MEMBERSHIP_INTERVAL "
1043 ] [
1044 .BI mcast_querier_interval " QUERIER_INTERVAL "
1045 ] [
1046 .BI mcast_query_interval " QUERY_INTERVAL "
1047 ] [
1048 .BI mcast_query_response_interval " QUERY_RESPONSE_INTERVAL "
1049 ] [
1050 .BI mcast_startup_query_interval " STARTUP_QUERY_INTERVAL "
1051 ] [
1052 .BI mcast_stats_enabled " MCAST_STATS_ENABLED "
1053 ] [
1054 .BI mcast_igmp_version " IGMP_VERSION "
1055 ] [
1056 .BI mcast_mld_version " MLD_VERSION "
1057 ] [
1058 .BI nf_call_iptables " NF_CALL_IPTABLES "
1059 ] [
1060 .BI nf_call_ip6tables " NF_CALL_IP6TABLES "
1061 ] [
1062 .BI nf_call_arptables " NF_CALL_ARPTABLES "
1063 ]
1064
1065 .in +8
1066 .sp
1067 .BI ageing_time " AGEING_TIME "
1068 - configure the bridge's FDB entries ageing time, ie the number of seconds a MAC address will be kept in the FDB after a packet has been received from that address. after this time has passed, entries are cleaned up.
1069
1070 .BI group_fwd_mask " MASK "
1071 - set the group forward mask. This is the bitmask that is applied to decide whether to forward incoming frames destined to link-local addresses, ie addresses of the form 01:80:C2:00:00:0X (defaults to 0, ie the bridge does not forward any link-local frames).
1072
1073 .BI group_address " ADDRESS "
1074 - set the MAC address of the multicast group this bridge uses for STP.  The address must be a link-local address in standard Ethernet MAC address format, ie an address of the form 01:80:C2:00:00:0X, with X in [0, 4..f].
1075
1076 .BI forward_delay " FORWARD_DELAY "
1077 - set the forwarding delay in seconds, ie the time spent in LISTENING state (before moving to LEARNING) and in LEARNING state (before moving to FORWARDING). Only relevant if STP is enabled. Valid values are between 2 and 30.
1078
1079 .BI hello_time " HELLO_TIME "
1080 - set the time in seconds between hello packets sent by the bridge, when it is a root bridge or a designated bridges. Only relevant if STP is enabled. Valid values are between 1 and 10.
1081
1082 .BI max_age " MAX_AGE "
1083 - set the hello packet timeout, ie the time in seconds until another bridge in the spanning tree is assumed to be dead, after reception of its last hello message. Only relevant if STP is enabled. Valid values are between 6 and 40.
1084
1085 .BI stp_state " STP_STATE "
1086 - turn spanning tree protocol on
1087 .RI ( STP_STATE " > 0) "
1088 or off
1089 .RI ( STP_STATE " == 0). "
1090 for this bridge.
1091
1092 .BI priority " PRIORITY "
1093 - set this bridge's spanning tree priority, used during STP root bridge election.
1094 .I PRIORITY
1095 is a 16bit unsigned integer.
1096
1097 .BI vlan_filtering " VLAN_FILTERING "
1098 - turn VLAN filtering on
1099 .RI ( VLAN_FILTERING " > 0) "
1100 or off
1101 .RI ( VLAN_FILTERING " == 0). "
1102 When disabled, the bridge will not consider the VLAN tag when handling packets.
1103
1104 .BR vlan_protocol " { " 802.1Q " | " 802.1ad " } "
1105 - set the protocol used for VLAN filtering.
1106
1107 .BI vlan_default_pvid " VLAN_DEFAULT_PVID "
1108 - set the default PVID (native/untagged VLAN ID) for this bridge.
1109
1110 .BI vlan_stats_enabled " VLAN_STATS_ENABLED "
1111 - enable
1112 .RI ( VLAN_STATS_ENABLED " == 1) "
1113 or disable
1114 .RI ( VLAN_STATS_ENABLED " == 0) "
1115 per-VLAN stats accounting.
1116
1117 .BI mcast_snooping " MULTICAST_SNOOPING "
1118 - turn multicast snooping on
1119 .RI ( MULTICAST_SNOOPING " > 0) "
1120 or off
1121 .RI ( MULTICAST_SNOOPING " == 0). "
1122
1123 .BI mcast_router " MULTICAST_ROUTER "
1124 - set bridge's multicast router if IGMP snooping is enabled.
1125 .I MULTICAST_ROUTER
1126 is an integer value having the following meaning:
1127 .in +8
1128 .sp
1129 .B 0
1130 - disabled.
1131
1132 .B 1
1133 - automatic (queried).
1134
1135 .B 2
1136 - permanently enabled.
1137 .in -8
1138
1139 .BI mcast_query_use_ifaddr " MCAST_QUERY_USE_IFADDR "
1140 - whether to use the bridge's own IP address as source address for IGMP queries
1141 .RI ( MCAST_QUERY_USE_IFADDR " > 0) "
1142 or the default of 0.0.0.0
1143 .RI ( MCAST_QUERY_USE_IFADDR " == 0). "
1144
1145 .BI mcast_querier " MULTICAST_QUERIER "
1146 - enable
1147 .RI ( MULTICAST_QUERIER " > 0) "
1148 or disable
1149 .RI ( MULTICAST_QUERIER " == 0) "
1150 IGMP querier, ie sending of multicast queries by the bridge (default: disabled).
1151
1152 .BI mcast_querier_interval " QUERIER_INTERVAL "
1153 - interval between queries sent by other routers. if no queries are seen after this delay has passed, the bridge will start to send its own queries (as if
1154 .BI mcast_querier
1155 was enabled).
1156
1157 .BI mcast_hash_elasticity " HASH_ELASTICITY "
1158 - set multicast database hash elasticity, ie the maximum chain length in the multicast hash table (defaults to 4).
1159
1160 .BI mcast_hash_max " HASH_MAX "
1161 - set maximum size of multicast hash table (defaults to 512, value must be a power of 2).
1162
1163 .BI mcast_last_member_count " LAST_MEMBER_COUNT "
1164 - set multicast last member count, ie the number of queries the bridge will send before stopping forwarding a multicast group after a "leave" message has been received (defaults to 2).
1165
1166 .BI mcast_last_member_interval " LAST_MEMBER_INTERVAL "
1167 - interval between queries to find remaining members of a group, after a "leave" message is received.
1168
1169 .BI mcast_startup_query_count " STARTUP_QUERY_COUNT "
1170 - set the number of IGMP queries to send during startup phase (defaults to 2).
1171
1172 .BI mcast_startup_query_interval " STARTUP_QUERY_INTERVAL "
1173 - interval between queries in the startup phase.
1174
1175 .BI mcast_query_interval " QUERY_INTERVAL "
1176 - interval between queries sent by the bridge after the end of the startup phase.
1177
1178 .BI mcast_query_response_interval " QUERY_RESPONSE_INTERVAL "
1179 - set the Max Response Time/Maximum Response Delay for IGMP/MLD queries sent by the bridge.
1180
1181 .BI mcast_membership_interval " MEMBERSHIP_INTERVAL "
1182 - delay after which the bridge will leave a group, if no membership reports for this group are received.
1183
1184 .BI mcast_stats_enabled " MCAST_STATS_ENABLED "
1185 - enable
1186 .RI ( MCAST_STATS_ENABLED " > 0) "
1187 or disable
1188 .RI ( MCAST_STATS_ENABLED " == 0) "
1189 multicast (IGMP/MLD) stats accounting.
1190
1191 .BI mcast_igmp_version " IGMP_VERSION "
1192 - set the IGMP version.
1193
1194 .BI mcast_mld_version " MLD_VERSION "
1195 - set the MLD version.
1196
1197 .BI nf_call_iptables " NF_CALL_IPTABLES "
1198 - enable
1199 .RI ( NF_CALL_IPTABLES " > 0) "
1200 or disable
1201 .RI ( NF_CALL_IPTABLES " == 0) "
1202 iptables hooks on the bridge.
1203
1204 .BI nf_call_ip6tables " NF_CALL_IP6TABLES "
1205 - enable
1206 .RI ( NF_CALL_IP6TABLES " > 0) "
1207 or disable
1208 .RI ( NF_CALL_IP6TABLES " == 0) "
1209 ip6tables hooks on the bridge.
1210
1211 .BI nf_call_arptables " NF_CALL_ARPTABLES "
1212 - enable
1213 .RI ( NF_CALL_ARPTABLES " > 0) "
1214 or disable
1215 .RI ( NF_CALL_ARPTABLES " == 0) "
1216 arptables hooks on the bridge.
1217
1218
1219 .in-8
1220
1221 .TP
1222 MACsec Type Support
1223 For a link of type
1224 .I MACsec
1225 the following additional arguments are supported:
1226
1227 .BI "ip link add link " DEVICE " name " NAME " type macsec"
1228 [ [
1229 .BI address " <lladdr>"
1230 ]
1231 .BI port " PORT"
1232 |
1233 .BI sci " SCI"
1234 ] [
1235 .BI cipher " CIPHER_SUITE"
1236 ] [
1237 .BR icvlen " { "
1238 .IR 8..16 " } ] ["
1239 .BR encrypt " {"
1240 .BR on " | " off " } ] [ "
1241 .BR send_sci " { " on " | " off " } ] ["
1242 .BR end_station " { " on " | " off " } ] ["
1243 .BR scb " { " on " | " off " } ] ["
1244 .BR protect " { " on " | " off " } ] ["
1245 .BR replay " { " on " | " off " }"
1246 .BR window " { "
1247 .IR 0..2^32-1 " } ] ["
1248 .BR validate " { " strict " | " check " | " disabled " } ] ["
1249 .BR encodingsa " { "
1250 .IR 0..3 " } ]"
1251
1252 .in +8
1253 .sp
1254 .BI address " <lladdr> "
1255 - sets the system identifier component of secure channel for this MACsec device.
1256
1257 .sp
1258 .BI port " PORT "
1259 - sets the port number component of secure channel for this MACsec device, in a
1260 range from 1 to 65535 inclusive. Numbers with a leading " 0 " or " 0x " are
1261 interpreted as octal and hexadecimal, respectively.
1262
1263 .sp
1264 .BI sci " SCI "
1265 - sets the secure channel identifier for this MACsec device.
1266 .I SCI
1267 is a 64bit wide number in hexadecimal format.
1268
1269 .sp
1270 .BI cipher " CIPHER_SUITE "
1271 - defines the cipher suite to use.
1272
1273 .sp
1274 .BI icvlen " LENGTH "
1275 - sets the length of the Integrity Check Value (ICV).
1276
1277 .sp
1278 .BR "encrypt on " or " encrypt off"
1279 - switches between authenticated encryption, or authenticity mode only.
1280
1281 .sp
1282 .BR "send_sci on " or " send_sci off"
1283 - specifies whether the SCI is included in every packet, or only when it is necessary.
1284
1285 .sp
1286 .BR "end_station on " or " end_station off"
1287 - sets the End Station bit.
1288
1289 .sp
1290 .BR "scb on " or " scb off"
1291 - sets the Single Copy Broadcast bit.
1292
1293 .sp
1294 .BR "protect on " or " protect off"
1295 - enables MACsec protection on the device.
1296
1297 .sp
1298 .BR "replay on " or " replay off"
1299 - enables replay protection on the device.
1300
1301 .in +8
1302
1303 .sp
1304 .BI window " SIZE "
1305 - sets the size of the replay window.
1306
1307 .in -8
1308
1309 .sp
1310 .BR "validate strict " or " validate check " or " validate disabled"
1311 - sets the validation mode on the device.
1312
1313 .sp
1314 .BI encodingsa " AN "
1315 - sets the active secure association for transmission.
1316
1317 .in -8
1318
1319 .TP
1320 VRF Type Support
1321 For a link of type
1322 .I VRF
1323 the following additional arguments are supported:
1324
1325 .BI "ip link add " DEVICE " type vrf table " TABLE
1326
1327 .in +8
1328 .sp
1329 .BR table " table id associated with VRF device"
1330
1331 .in -8
1332
1333 .SS ip link delete - delete virtual link
1334
1335 .TP
1336 .BI dev " DEVICE "
1337 specifies the virtual device to act operate on.
1338
1339 .TP
1340 .BI group " GROUP "
1341 specifies the group of virtual links to delete. Group 0 is not allowed to be
1342 deleted since it is the default group.
1343
1344 .TP
1345 .BI type " TYPE "
1346 specifies the type of the device.
1347
1348 .SS ip link set - change device attributes
1349
1350 .PP
1351 .B Warning:
1352 If multiple parameter changes are requested,
1353 .B ip
1354 aborts immediately after any of the changes have failed.
1355 This is the only case when
1356 .B ip
1357 can move the system to an unpredictable state. The solution
1358 is to avoid changing several parameters with one
1359 .B ip link set
1360 call.
1361
1362 .TP
1363 .BI dev " DEVICE "
1364 .I DEVICE
1365 specifies network device to operate on. When configuring SR-IOV Virtual Function
1366 (VF) devices, this keyword should specify the associated Physical Function (PF)
1367 device.
1368
1369 .TP
1370 .BI group " GROUP "
1371 .I GROUP
1372 has a dual role: If both group and dev are present, then move the device to the
1373 specified group. If only a group is specified, then the command operates on
1374 all devices in that group.
1375
1376 .TP
1377 .BR up " and " down
1378 change the state of the device to
1379 .B UP
1380 or
1381 .BR "DOWN" .
1382
1383 .TP
1384 .BR "arp on " or " arp off"
1385 change the
1386 .B NOARP
1387 flag on the device.
1388
1389 .TP
1390 .BR "multicast on " or " multicast off"
1391 change the
1392 .B MULTICAST
1393 flag on the device.
1394
1395 .TP
1396 .BR "protodown on " or " protodown off"
1397 change the
1398 .B PROTODOWN
1399 state on the device. Indicates that a protocol error has been detected on the port. Switch drivers can react to this error by doing a phys down on the switch port.
1400
1401 .TP
1402 .BR "dynamic on " or " dynamic off"
1403 change the
1404 .B DYNAMIC
1405 flag on the device. Indicates that address can change when interface goes down (currently
1406 .B NOT
1407 used by the Linux).
1408
1409 .TP
1410 .BI name " NAME"
1411 change the name of the device. This operation is not
1412 recommended if the device is running or has some addresses
1413 already configured.
1414
1415 .TP
1416 .BI txqueuelen " NUMBER"
1417 .TP
1418 .BI txqlen " NUMBER"
1419 change the transmit queue length of the device.
1420
1421 .TP
1422 .BI mtu " NUMBER"
1423 change the
1424 .I MTU
1425 of the device.
1426
1427 .TP
1428 .BI address " LLADDRESS"
1429 change the station address of the interface.
1430
1431 .TP
1432 .BI broadcast " LLADDRESS"
1433 .TP
1434 .BI brd " LLADDRESS"
1435 .TP
1436 .BI peer " LLADDRESS"
1437 change the link layer broadcast address or the peer address when
1438 the interface is
1439 .IR "POINTOPOINT" .
1440
1441 .TP
1442 .BI netns " NETNSNAME " \fR| " PID"
1443 move the device to the network namespace associated with name
1444 .IR "NETNSNAME " or
1445 .RI process " PID".
1446
1447 Some devices are not allowed to change network namespace: loopback, bridge,
1448 ppp, wireless. These are network namespace local devices. In such case
1449 .B ip
1450 tool will return "Invalid argument" error. It is possible to find out if device is local
1451 to a single network namespace by checking
1452 .B netns-local
1453 flag in the output of the
1454 .BR ethtool ":"
1455
1456 .in +8
1457 .B ethtool -k
1458 .I DEVICE
1459 .in -8
1460
1461 To change network namespace for wireless devices the
1462 .B iw
1463 tool can be used. But it allows to change network namespace only for physical devices and by process
1464 .IR PID .
1465
1466 .TP
1467 .BI alias " NAME"
1468 give the device a symbolic name for easy reference.
1469
1470 .TP
1471 .BI group " GROUP"
1472 specify the group the device belongs to.
1473 The available groups are listed in file
1474 .BR "@SYSCONFDIR@/group" .
1475
1476 .TP
1477 .BI vf " NUM"
1478 specify a Virtual Function device to be configured. The associated PF device
1479 must be specified using the
1480 .B dev
1481 parameter.
1482
1483 .in +8
1484 .BI mac " LLADDRESS"
1485 - change the station address for the specified VF. The
1486 .B vf
1487 parameter must be specified.
1488
1489 .sp
1490 .BI vlan " VLANID"
1491 - change the assigned VLAN for the specified VF. When specified, all traffic
1492 sent from the VF will be tagged with the specified VLAN ID. Incoming traffic
1493 will be filtered for the specified VLAN ID, and will have all VLAN tags
1494 stripped before being passed to the VF. Setting this parameter to 0 disables
1495 VLAN tagging and filtering. The
1496 .B vf
1497 parameter must be specified.
1498
1499 .sp
1500 .BI qos " VLAN-QOS"
1501 - assign VLAN QOS (priority) bits for the VLAN tag. When specified, all VLAN
1502 tags transmitted by the VF will include the specified priority bits in the
1503 VLAN tag. If not specified, the value is assumed to be 0. Both the
1504 .B vf
1505 and
1506 .B vlan
1507 parameters must be specified. Setting both
1508 .B vlan
1509 and
1510 .B qos
1511 as 0 disables VLAN tagging and filtering for the VF.
1512
1513 .sp
1514 .BI proto " VLAN-PROTO"
1515 - assign VLAN PROTOCOL for the VLAN tag, either 802.1Q or 802.1ad.
1516 Setting to 802.1ad, all traffic sent from the VF will be tagged with VLAN S-Tag.
1517 Incoming traffic will have VLAN S-Tags stripped before being passed to the VF.
1518 Setting to 802.1ad also enables an option to concatenate another VLAN tag, so both
1519 S-TAG and C-TAG will be inserted/stripped for outgoing/incoming traffic, respectively.
1520 If not specified, the value is assumed to be 802.1Q. Both the
1521 .B vf
1522 and
1523 .B vlan
1524 parameters must be specified.
1525
1526 .sp
1527 .BI rate " TXRATE"
1528 -- change the allowed transmit bandwidth, in Mbps, for the specified VF.
1529 Setting this parameter to 0 disables rate limiting.
1530 .B vf
1531 parameter must be specified.
1532 Please use new API
1533 .B "max_tx_rate"
1534 option instead.
1535
1536 .sp
1537 .BI max_tx_rate " TXRATE"
1538 - change the allowed maximum transmit bandwidth, in Mbps, for the specified VF.
1539 .B vf
1540 parameter must be specified.
1541
1542 .sp
1543 .BI min_tx_rate " TXRATE"
1544 - change the allowed minimum transmit bandwidth, in Mbps, for the specified VF.
1545 Minimum TXRATE should be always <= Maximum TXRATE.
1546 .B vf
1547 parameter must be specified.
1548
1549 .sp
1550 .BI spoofchk " on|off"
1551 - turn packet spoof checking on or off for the specified VF.
1552 .sp
1553 .BI query_rss " on|off"
1554 - toggle the ability of querying the RSS configuration of a specific VF. VF RSS information like RSS hash key may be considered sensitive on some devices where this information is shared between VF and PF and thus its querying may be prohibited by default.
1555 .sp
1556 .BI state " auto|enable|disable"
1557 - set the virtual link state as seen by the specified VF. Setting to auto means a
1558 reflection of the PF link state, enable lets the VF to communicate with other VFs on
1559 this host even if the PF link state is down, disable causes the HW to drop any packets
1560 sent by the VF.
1561 .sp
1562 .BI trust " on|off"
1563 - trust the specified VF user. This enables that VF user can set a specific feature
1564 which may impact security and/or performance. (e.g. VF multicast promiscuous mode)
1565 .sp
1566 .BI node_guid " eui64"
1567 - configure node GUID for Infiniband VFs.
1568 .sp
1569 .BI port_guid " eui64"
1570 - configure port GUID for Infiniband VFs.
1571 .in -8
1572
1573 .TP
1574 .B xdp object "|" pinned "|" off
1575 set (or unset) a XDP ("eXpress Data Path") BPF program to run on every
1576 packet at driver level.
1577 .B ip link
1578 output will indicate a
1579 .B xdp
1580 flag for the networking device. If the driver does not have native XDP
1581 support, the kernel will fall back to a slower, driver-independent "generic"
1582 XDP variant. The
1583 .B ip link
1584 output will in that case indicate
1585 .B xdpgeneric
1586 instead of
1587 .B xdp
1588 only. If the driver does have native XDP support, but the program is
1589 loaded under
1590 .B xdpgeneric object "|" pinned
1591 then the kernel will use the generic XDP variant instead of the native one.
1592 .B xdpdrv
1593 has the opposite effect of requestsing that the automatic fallback to the
1594 generic XDP variant be disabled and in case driver is not XDP-capable error
1595 should be returned.
1596 .B xdpdrv
1597 also disables hardware offloads.
1598
1599 .B off
1600 (or
1601 .B none
1602 )
1603 - Detaches any currently attached XDP/BPF program from the given device.
1604
1605 .BI object " FILE "
1606 - Attaches a XDP/BPF program to the given device. The
1607 .I FILE
1608 points to a BPF ELF file (f.e. generated by LLVM) that contains the BPF
1609 program code, map specifications, etc. If a XDP/BPF program is already
1610 attached to the given device, an error will be thrown. If no XDP/BPF
1611 program is currently attached, the device supports XDP and the program
1612 from the BPF ELF file passes the kernel verifier, then it will be attached
1613 to the device. If the option
1614 .I -force
1615 is passed to
1616 .B ip
1617 then any prior attached XDP/BPF program will be atomically overridden and
1618 no error will be thrown in this case. If no
1619 .B section
1620 option is passed, then the default section name ("prog") will be assumed,
1621 otherwise the provided section name will be used. If no
1622 .B verbose
1623 option is passed, then a verifier log will only be dumped on load error.
1624 See also
1625 .B EXAMPLES
1626 section for usage examples.
1627
1628 .BI section " NAME "
1629 - Specifies a section name that contains the BPF program code. If no section
1630 name is specified, the default one ("prog") will be used. This option is
1631 to be passed with the
1632 .B object
1633 option.
1634
1635 .BI verbose
1636 - Act in verbose mode. For example, even in case of success, this will
1637 print the verifier log in case a program was loaded from a BPF ELF file.
1638
1639 .BI pinned " FILE "
1640 - Attaches a XDP/BPF program to the given device. The
1641 .I FILE
1642 points to an already pinned BPF program in the BPF file system. The option
1643 .B section
1644 doesn't apply here, but otherwise semantics are the same as with the option
1645 .B object
1646 described already.
1647
1648 .TP
1649 .BI master " DEVICE"
1650 set master device of the device (enslave device).
1651
1652 .TP
1653 .BI nomaster
1654 unset master device of the device (release device).
1655
1656 .TP
1657 .BI addrgenmode " eui64|none|stable_secret|random"
1658 set the IPv6 address generation mode
1659
1660 .I eui64
1661 - use a Modified EUI-64 format interface identifier
1662
1663 .I none
1664 - disable automatic address generation
1665
1666 .I stable_secret
1667 - generate the interface identifier based on a preset /proc/sys/net/ipv6/conf/{default,DEVICE}/stable_secret
1668
1669 .I random
1670 - like stable_secret, but auto-generate a new random secret if none is set
1671
1672 .TP
1673 .BR "link-netnsid "
1674 set peer netnsid for a cross-netns interface
1675
1676 .TP
1677 .BI type " ETYPE TYPE_ARGS"
1678 Change type-specific settings. For a list of supported types and arguments refer
1679 to the description of
1680 .B "ip link add"
1681 above. In addition to that, it is possible to manipulate settings to slave
1682 devices:
1683
1684 .TP
1685 Bridge Slave Support
1686 For a link with master
1687 .B bridge
1688 the following additional arguments are supported:
1689
1690 .B "ip link set type bridge_slave"
1691 [
1692 .B fdb_flush
1693 ] [
1694 .BI state " STATE"
1695 ] [
1696 .BI priority " PRIO"
1697 ] [
1698 .BI cost " COST"
1699 ] [
1700 .BR guard " { " on " | " off " }"
1701 ] [
1702 .BR hairpin " { " on " | " off " }"
1703 ] [
1704 .BR fastleave " { " on " | " off " }"
1705 ] [
1706 .BR root_block " { " on " | " off " }"
1707 ] [
1708 .BR learning " { " on " | " off " }"
1709 ] [
1710 .BR flood " { " on " | " off " }"
1711 ] [
1712 .BR proxy_arp " { " on " | " off " }"
1713 ] [
1714 .BR proxy_arp_wifi " { " on " | " off " }"
1715 ] [
1716 .BI mcast_router " MULTICAST_ROUTER"
1717 ] [
1718 .BR mcast_fast_leave " { " on " | " off "}"
1719 ] [
1720 .BR mcast_flood " { " on " | " off " } ]"
1721
1722 .in +8
1723 .sp
1724 .B fdb_flush
1725 - flush bridge slave's fdb dynamic entries.
1726
1727 .BI state " STATE"
1728 - Set port state.
1729 .I STATE
1730 is a number representing the following states:
1731 .BR 0 " (disabled),"
1732 .BR 1 " (listening),"
1733 .BR 2 " (learning),"
1734 .BR 3 " (forwarding),"
1735 .BR 4 " (blocking)."
1736
1737 .BI priority " PRIO"
1738 - set port priority (allowed values are between 0 and 63, inclusively).
1739
1740 .BI cost " COST"
1741 - set port cost (allowed values are between 1 and 65535, inclusively).
1742
1743 .BR guard " { " on " | " off " }"
1744 - block incoming BPDU packets on this port.
1745
1746 .BR hairpin " { " on " | " off " }"
1747 - enable hairpin mode on this port. This will allow incoming packets on this
1748 port to be reflected back.
1749
1750 .BR fastleave " { " on " | " off " }"
1751 - enable multicast fast leave on this port.
1752
1753 .BR root_block " { " on " | " off " }"
1754 - block this port from becoming the bridge's root port.
1755
1756 .BR learning " { " on " | " off " }"
1757 - allow MAC address learning on this port.
1758
1759 .BR flood " { " on " | " off " }"
1760 - open the flood gates on this port, i.e. forward all unicast frames to this
1761 port also. Requires
1762 .BR proxy_arp " and " proxy_arp_wifi
1763 to be turned off.
1764
1765 .BR proxy_arp " { " on " | " off " }"
1766 - enable proxy ARP on this port.
1767
1768 .BR proxy_arp_wifi " { " on " | " off " }"
1769 - enable proxy ARP on this port which meets extended requirements by IEEE
1770 802.11 and Hotspot 2.0 specifications.
1771
1772 .BI mcast_router " MULTICAST_ROUTER"
1773 - configure this port for having multicast routers attached. A port with a
1774 multicast router will receive all multicast traffic.
1775 .I MULTICAST_ROUTER
1776 may be either
1777 .B 0
1778 to disable multicast routers on this port,
1779 .B 1
1780 to let the system detect the presence of of routers (this is the default),
1781 .B 2
1782 to permanently enable multicast traffic forwarding on this port or
1783 .B 3
1784 to enable multicast routers temporarily on this port, not depending on incoming
1785 queries.
1786
1787 .BR mcast_fast_leave " { " on " | " off " }"
1788 - this is a synonym to the
1789 .B fastleave
1790 option above.
1791
1792 .BR mcast_flood " { " on " | " off " }"
1793 - controls whether a given port will be flooded with multicast traffic for which there is no MDB entry.
1794
1795 .in -8
1796
1797 .TP
1798 Bonding Slave Support
1799 For a link with master
1800 .B bond
1801 the following additional arguments are supported:
1802
1803 .B "ip link set type bond_slave"
1804 [
1805 .BI queue_id " ID"
1806 ]
1807
1808 .in +8
1809 .sp
1810 .BI queue_id " ID"
1811 - set the slave's queue ID (a 16bit unsigned value).
1812
1813 .in -8
1814
1815 .TP
1816 MACVLAN and MACVTAP Support
1817 Modify list of allowed macaddr for link in source mode.
1818
1819 .B "ip link set type { macvlan | macvap } "
1820 [
1821 .BI macaddr " " "" COMMAND " " MACADDR " ..."
1822 ]
1823
1824 Commands:
1825 .in +8
1826 .B add
1827 - add MACADDR to allowed list
1828 .sp
1829 .B set
1830 - replace allowed list
1831 .sp
1832 .B del
1833 - remove MACADDR from allowed list
1834 .sp
1835 .B flush
1836 - flush whole allowed list
1837 .sp
1838 .in -8
1839
1840
1841 .SS  ip link show - display device attributes
1842
1843 .TP
1844 .BI dev " NAME " (default)
1845 .I NAME
1846 specifies the network device to show.
1847 If this argument is omitted all devices in the default group are listed.
1848
1849 .TP
1850 .BI group " GROUP "
1851 .I GROUP
1852 specifies what group of devices to show.
1853
1854 .TP
1855 .B up
1856 only display running interfaces.
1857
1858 .TP
1859 .BI master " DEVICE "
1860 .I DEVICE
1861 specifies the master device which enslaves devices to show.
1862
1863 .TP
1864 .BI vrf " NAME "
1865 .I NAME
1866 speficies the VRF which enslaves devices to show.
1867
1868 .TP
1869 .BI type " TYPE "
1870 .I TYPE
1871 specifies the type of devices to show.
1872
1873 Note that the type name is not checked against the list of supported types -
1874 instead it is sent as-is to the kernel. Later it is used to filter the returned
1875 interface list by comparing it with the relevant attribute in case the kernel
1876 didn't filter already. Therefore any string is accepted, but may lead to empty
1877 output.
1878
1879 .SS  ip link xstats - display extended statistics
1880
1881 .TP
1882 .BI type " TYPE "
1883 .I TYPE
1884 specifies the type of devices to display extended statistics for.
1885
1886 .SS  ip link afstats - display address-family specific statistics
1887
1888 .TP
1889 .BI dev " DEVICE "
1890 .I DEVICE
1891 specifies the device to display address-family statistics for.
1892
1893 .SS  ip link help - display help
1894
1895 .PP
1896 .I "TYPE"
1897 specifies which help of link type to dislpay.
1898
1899 .SS
1900 .I GROUP
1901 may be a number or a string from the file
1902 .B @SYSCONFDIR@/group
1903 which can be manually filled.
1904
1905 .SH "EXAMPLES"
1906 .PP
1907 ip link show
1908 .RS 4
1909 Shows the state of all network interfaces on the system.
1910 .RE
1911 .PP
1912 ip link show type bridge
1913 .RS 4
1914 Shows the bridge devices.
1915 .RE
1916 .PP
1917 ip link show type vlan
1918 .RS 4
1919 Shows the vlan devices.
1920 .RE
1921 .PP
1922 ip link show master br0
1923 .RS 4
1924 Shows devices enslaved by br0
1925 .RE
1926 .PP
1927 ip link set dev ppp0 mtu 1400
1928 .RS 4
1929 Change the MTU the ppp0 device.
1930 .RE
1931 .PP
1932 ip link add link eth0 name eth0.10 type vlan id 10
1933 .RS 4
1934 Creates a new vlan device eth0.10 on device eth0.
1935 .RE
1936 .PP
1937 ip link delete dev eth0.10
1938 .RS 4
1939 Removes vlan device.
1940 .RE
1941
1942 ip link help gre
1943 .RS 4
1944 Display help for the gre link type.
1945 .RE
1946 .PP
1947 ip link add name tun1 type ipip remote 192.168.1.1
1948 local 192.168.1.2 ttl 225 encap gue encap-sport auto
1949 encap-dport 5555 encap-csum encap-remcsum
1950 .RS 4
1951 Creates an IPIP that is encapsulated with Generic UDP Encapsulation,
1952 and the outer UDP checksum and remote checksum offload are enabled.
1953 .RE
1954 .PP
1955 ip link set dev eth0 xdp obj prog.o
1956 .RS 4
1957 Attaches a XDP/BPF program to device eth0, where the program is
1958 located in prog.o, section "prog" (default section). In case a
1959 XDP/BPF program is already attached, throw an error.
1960 .RE
1961 .PP
1962 ip -force link set dev eth0 xdp obj prog.o sec foo
1963 .RS 4
1964 Attaches a XDP/BPF program to device eth0, where the program is
1965 located in prog.o, section "foo". In case a XDP/BPF program is
1966 already attached, it will be overridden by the new one.
1967 .RE
1968 .PP
1969 ip -force link set dev eth0 xdp pinned /sys/fs/bpf/foo
1970 .RS 4
1971 Attaches a XDP/BPF program to device eth0, where the program was
1972 previously pinned as an object node into BPF file system under
1973 name foo.
1974 .RE
1975 .PP
1976 ip link set dev eth0 xdp off
1977 .RS 4
1978 If a XDP/BPF program is attached on device eth0, detach it and
1979 effectively turn off XDP for device eth0.
1980 .RE
1981 .PP
1982 ip link add link wpan0 lowpan0 type lowpan
1983 .RS 4
1984 Creates a 6LoWPAN interface named lowpan0 on the underlying
1985 IEEE 802.15.4 device wpan0.
1986 .RE
1987
1988 .SH SEE ALSO
1989 .br
1990 .BR ip (8),
1991 .BR ip-netns (8),
1992 .BR ethtool (8),
1993 .BR iptables (8)
1994
1995 .SH AUTHOR
1996 Original Manpage by Michail Litvak <mci@owl.openwall.com>