man/man8/ip-link.8.in

   1 .TH IP\-LINK 8 "13 Dec 2012" "iproute2" "Linux"
   2 .SH "NAME"
   3 ip-link \- network device configuration
   4 .SH "SYNOPSIS"
   5 .sp
   6 .ad l
   7 .in +8
   8 .ti -8
   9 .B ip link
  10 .RI  " { " COMMAND " | "
  11 .BR help " }"
  12 .sp
  13
  14 .ti -8
  15 .BI "ip link add"
  16 .RB "[ " link
  17 .IR DEVICE " ]"
  18 .RB "[ " name " ]"
  19 .I NAME
  20 .br
  21 .RB "[ " txqueuelen
  22 .IR PACKETS " ]"
  23 .br
  24 .RB "[ " address
  25 .IR LLADDR " ]"
  26 .RB "[ " broadcast
  27 .IR LLADDR " ]"
  28 .br
  29 .RB "[ " mtu
  30 .IR MTU " ]"
  31 .RB "[ " index
  32 .IR IDX " ]"
  33 .br
  34 .RB "[ " numtxqueues
  35 .IR QUEUE_COUNT " ]"
  36 .RB "[ " numrxqueues
  37 .IR QUEUE_COUNT " ]"
  38 .br
  39 .BI type " TYPE"
  40 .RI "[ " ARGS " ]"
  41
  42 .ti -8
  43 .IR TYPE " := [ "
  44 .BR bridge " | "
  45 .BR bond " | "
  46 .BR can " | "
  47 .BR dummy " | "
  48 .BR hsr " | "
  49 .BR ifb " | "
  50 .BR ipoib " |"
  51 .BR macvlan  " | "
  52 .BR macvtap  " | "
  53 .BR vcan " | "
  54 .BR veth " | "
  55 .BR vlan " | "
  56 .BR vxlan " |"
  57 .BR ip6tnl " |"
  58 .BR ipip " |"
  59 .BR sit " |"
  60 .BR gre " |"
  61 .BR gretap " |"
  62 .BR ip6gre " |"
  63 .BR ip6gretap " |"
  64 .BR vti " |"
  65 .BR nlmon " |"
  66 .BR ipvlan " |"
  67 .BR lowpan " |"
  68 .BR geneve " |"
  69 .BR vrf " ]"
  70
  71 .ti -8
  72 .BR "ip link delete " {
  73 .IR DEVICE " | "
  74 .BI "group " GROUP
  75 }
  76 .BI type " TYPE"
  77 .RI "[ " ARGS " ]"
  78
  79 .ti -8
  80 .BR "ip link set " {
  81 .IR DEVICE " | "
  82 .BI "group " GROUP
  83 .RB "} [ { " up " | " down " } ]"
  84 .br
  85 .RB "[ " arp " { " on " | " off " } ]"
  86 .br
  87 .RB "[ " dynamic " { " on " | " off " } ]"
  88 .br
  89 .RB "[ " multicast " { " on " | " off " } ]"
  90 .br
  91 .RB "[ " allmulticast " { " on " | " off " } ]"
  92 .br
  93 .RB "[ " promisc " { " on " | " off " } ]"
  94 .br
  95 .RB "[ " protodown " { " on " | " off " } ]"
  96 .br
  97 .RB "[ " trailers " { " on " | " off " } ]"
  98 .br
  99 .RB "[ " txqueuelen
 100 .IR PACKETS " ]"
 101 .br
 102 .RB "[ " name
 103 .IR NEWNAME " ]"
 104 .br
 105 .RB "[ " address
 106 .IR LLADDR " ]"
 107 .br
 108 .RB "[ " broadcast
 109 .IR LLADDR " ]"
 110 .br
 111 .RB "[ " mtu
 112 .IR MTU " ]"
 113 .br
 114 .RB "[ " netns " {"
 115 .IR PID " | " NETNSNAME " } ]"
 116 .br
 117 .RB "[ " link-netnsid
 118 .IR ID " ]"
 119 .br
 120 .RB "[ " alias
 121 .IR NAME  " ]"
 122 .br
 123 .RB "[ " vf
 124 .IR NUM " ["
 125 .B  mac
 126 .IR LLADDR " ]"
 127 .br
 128 .in +9
 129 .RB "[ " vlan
 130 .IR VLANID " [ "
 131 .B qos
 132 .IR VLAN-QOS " ] ]"
 133 .br
 134 .RB "[ " rate
 135 .IR TXRATE " ]"
 136 .br
 137 .RB "[ " max_tx_rate
 138 .IR TXRATE " ]"
 139 .br
 140 .RB "[ " min_tx_rate
 141 .IR TXRATE " ]"
 142 .br
 143 .RB "[ " spoofchk " { " on " | " off " } ]"
 144 .br
 145 .RB "[ " query_rss " { " on " | " off " } ]"
 146 .br
 147 .RB "[ " state " { " auto " | " enable " | " disable " } ]"
 148 .br
 149 .RB "[ " trust " { " on " | " off " } ] ]"
 150 .br
 151 .in -9
 152 .RB "[ " master
 153 .IR DEVICE " ]"
 154 .br
 155 .RB "[ " nomaster " ]"
 156 .br
 157 .RB "[ " vrf
 158 .IR NAME " ]"
 159 .br
 160 .RB "[ " addrgenmode " { " eui64 " | " none " | " stable_secret " | " random " } ]"
 161
 162
 163 .ti -8
 164 .B ip link show
 165 .RI "[ " DEVICE " | "
 166 .B group
 167 .IR GROUP " ] ["
 168 .BR up " ] ["
 169 .B master
 170 .IR DEVICE " ] ["
 171 .B type
 172 .IR TYPE " ]"
 173 .B vrf
 174 .IR NAME " ]"
 175
 176 .ti -8
 177 .B ip link help
 178 .RI "[ " TYPE " ]"
 179
 180 .SH "DESCRIPTION"
 181 .SS ip link add - add virtual link
 182
 183 .TP
 184 .BI link " DEVICE "
 185 specifies the physical device to act operate on.
 186
 187 .I NAME
 188 specifies the name of the new virtual device.
 189
 190 .I TYPE
 191 specifies the type of the new device.
 192 .sp
 193 Link types:
 194
 195 .in +8
 196 .B bridge
 197 - Ethernet Bridge device
 198 .sp
 199 .B bond
 200 - Bonding device
 201 .B can
 202 - Controller Area Network interface
 203 .sp
 204 .B dummy
 205 - Dummy network interface
 206 .sp
 207 .B hsr
 208 - High-availability Seamless Redundancy device
 209 .sp
 210 .B ifb
 211 - Intermediate Functional Block device
 212 .sp
 213 .B ipoib
 214 - IP over Infiniband device
 215 .sp
 216 .B macvlan
 217 - Virtual interface base on link layer address (MAC)
 218 .sp
 219 .B macvtap
 220 - Virtual interface based on link layer address (MAC) and TAP.
 221 .sp
 222 .B vcan
 223 - Virtual Controller Area Network interface
 224 .sp
 225 .B veth
 226 - Virtual ethernet interface
 227 .sp
 228 .BR vlan
 229 - 802.1q tagged virtual LAN interface
 230 .sp
 231 .BR vxlan
 232 - Virtual eXtended LAN
 233 .sp
 234 .BR ip6tnl
 235 - Virtual tunnel interface IPv4|IPv6 over IPv6
 236 .sp
 237 .BR ipip
 238 - Virtual tunnel interface IPv4 over IPv4
 239 .sp
 240 .BR sit
 241 - Virtual tunnel interface IPv6 over IPv4
 242 .sp
 243 .BR gre
 244 - Virtual tunnel interface GRE over IPv4
 245 .sp
 246 .BR gretap
 247 - Virtual L2 tunnel interface GRE over IPv4
 248 .sp
 249 .BR ip6gre
 250 - Virtual tunnel interface GRE over IPv6
 251 .sp
 252 .BR ip6gretap
 253 - Virtual L2 tunnel interface GRE over IPv6
 254 .sp
 255 .BR vti
 256 - Virtual tunnel interface
 257 .sp
 258 .BR nlmon
 259 - Netlink monitoring device
 260 .sp
 261 .BR ipvlan
 262 - Interface for L3 (IPv6/IPv4) based VLANs
 263 .sp
 264 .BR lowpan
 265 - Interface for 6LoWPAN (IPv6) over IEEE 802.15.4 / Bluetooth
 266 .sp
 267 .BR geneve
 268 - GEneric NEtwork Virtualization Encapsulation
 269 .sp
 270 .BR macsec
 271 - Interface for IEEE 802.1AE MAC Security (MACsec)
 272 .sp
 273 .BR vrf
 274 - Interface for L3 VRF domains
 275 .in -8
 276
 277 .TP
 278 .BI numtxqueues " QUEUE_COUNT "
 279 specifies the number of transmit queues for new device.
 280
 281 .TP
 282 .BI numrxqueues " QUEUE_COUNT "
 283 specifies the number of receive queues for new device.
 284
 285 .TP
 286 .BI index " IDX "
 287 specifies the desired index of the new virtual device. The link creation fails, if the index is busy.
 288
 289 .TP
 290 VLAN Type Support
 291 For a link of type
 292 .I VLAN
 293 the following additional arguments are supported:
 294
 295 .BI "ip link add
 296 .BI link " DEVICE "
 297 .BI name " NAME "
 298 .BI type " vlan "
 299 [
 300 .BI protocol " VLAN_PROTO "
 301 ]
 302 .BI id " VLANID "
 303 [
 304 .BR reorder_hdr " { " on " | " off " } "
 305 ]
 306 [
 307 .BR gvrp " { " on " | " off " } "
 308 ]
 309 [
 310 .BR mvrp " { " on " | " off " } "
 311 ]
 312 [
 313 .BR loose_binding " { " on " | " off " } "
 314 ]
 315 [
 316 .BI ingress-qos-map " QOS-MAP "
 317 ]
 318 [
 319 .BI egress-qos-map " QOS-MAP "
 320 ]
 321
 322 .in +8
 323 .sp
 324 .BI protocol " VLAN_PROTO "
 325 - either 802.1Q or 802.1ad.
 326
 327 .BI id " VLANID "
 328 - specifies the VLAN Identifer to use. Note that numbers with a leading " 0 " or " 0x " are interpreted as octal or hexadeimal, respectively.
 329
 330 .BR reorder_hdr " { " on " | " off " } "
 331 - specifies whether ethernet headers are reordered or not (default is
 332 .BR on ")."
 333
 334 .in +4
 335 If
 336 .BR reorder_hdr " is " on
 337 then VLAN header will be not inserted immediately but only before passing to the
 338 physical device (if this device does not support VLAN offloading), the similar
 339 on the RX direction - by default the packet will be untagged before being
 340 received by VLAN device. Reordering allows to accelerate tagging on egress and
 341 to hide VLAN header on ingress so the packet looks like regular Ethernet packet,
 342 at the same time it might be confusing for packet capture as the VLAN header
 343 does not exist within the packet.
 344
 345 VLAN offloading can be checked by
 346 .BR ethtool "(8):"
 347 .in +4
 348 .sp
 349 .B ethtool -k
 350 <phy_dev> |
 351 .RB grep " tx-vlan-offload"
 352 .sp
 353 .in -4
 354 where <phy_dev> is the physical device to which VLAN device is bound.
 355 .in -4
 356
 357 .BR gvrp " { " on " | " off " } "
 358 - specifies whether this VLAN should be registered using GARP VLAN Registration Protocol.
 359
 360 .BR mvrp " { " on " | " off " } "
 361 - specifies whether this VLAN should be registered using Multiple VLAN Registration Protocol.
 362
 363 .BR loose_binding " { " on " | " off " } "
 364 - specifies whether the VLAN device state is bound to the physical device state.
 365
 366 .BI ingress-qos-map " QOS-MAP "
 367 - defines a mapping of VLAN header prio field to the Linux internal packet
 368 priority on incoming frames. The format is FROM:TO with multiple mappings
 369 separated by spaces.
 370
 371 .BI egress-qos-map " QOS-MAP "
 372 - defines a mapping of Linux internal packet priority to VLAN header prio field
 373 but for outgoing frames. The format is the same as for ingress-qos-map.
 374 .in +4
 375
 376 Linux packet priority can be set by
 377 .BR iptables "(8)":
 378 .in +4
 379 .sp
 380 .B iptables
 381 -t mangle -A POSTROUTING [...] -j CLASSIFY --set-class 0:4
 382 .sp
 383 .in -4
 384 and this "4" priority can be used in the egress qos mapping to set VLAN prio "5":
 385 .sp
 386 .in +4
 387 .B ip
 388 link set veth0.10 type vlan egress 4:5
 389 .in -4
 390 .in -4
 391 .in -8
 392
 393 .TP
 394 VXLAN Type Support
 395 For a link of type
 396 .I VXLAN
 397 the following additional arguments are supported:
 398
 399 .BI "ip link add " DEVICE
 400 .BI type " vxlan " id " ID"
 401 [
 402 .BI dev " PHYS_DEV "
 403 .RB " ] [ { " group " | " remote " } "
 404 .I IPADDR
 405 ] [
 406 .B local
 407 .RI "{ "IPADDR " | "any " } "
 408 ] [
 409 .BI ttl " TTL "
 410 ] [
 411 .BI tos " TOS "
 412 ] [
 413 .BI flowlabel " FLOWLABEL "
 414 ] [
 415 .BI dstport " PORT "
 416 ] [
 417 .BI srcport " MIN MAX "
 418 ] [
 419 .I "[no]learning "
 420 ] [
 421 .I "[no]proxy "
 422 ] [
 423 .I "[no]rsc "
 424 ] [
 425 .I "[no]l2miss "
 426 ] [
 427 .I "[no]l3miss "
 428 ] [
 429 .I "[no]udpcsum "
 430 ] [
 431 .I "[no]udp6zerocsumtx "
 432 ] [
 433 .I "[no]udp6zerocsumrx "
 434 ] [
 435 .BI ageing " SECONDS "
 436 ] [
 437 .BI maxaddress " NUMBER "
 438 ] [
 439 .RI "[no]external "
 440 ] [
 441 .B gbp
 442 ] [
 443 .B gpe
 444 ]
 445
 446 .in +8
 447 .sp
 448 .BI  id " VNI "
 449 - specifies the VXLAN Network Identifer (or VXLAN Segment
 450 Identifier) to use.
 451
 452 .BI dev " PHYS_DEV"
 453 - specifies the physical device to use for tunnel endpoint communication.
 454
 455 .sp
 456 .BI group " IPADDR"
 457 - specifies the multicast IP address to join.
 458 This parameter cannot be specified with the
 459 .B remote
 460 parameter.
 461
 462 .sp
 463 .BI remote " IPADDR"
 464 - specifies the unicast destination IP address to use in outgoing packets
 465 when the destination link layer address is not known in the VXLAN device
 466 forwarding database. This parameter cannot be specified with the
 467 .B group
 468 parameter.
 469
 470 .sp
 471 .BI local " IPADDR"
 472 - specifies the source IP address to use in outgoing packets.
 473
 474 .sp
 475 .BI ttl " TTL"
 476 - specifies the TTL value to use in outgoing packets.
 477
 478 .sp
 479 .BI tos " TOS"
 480 - specifies the TOS value to use in outgoing packets.
 481
 482 .sp
 483 .BI flowlabel " FLOWLABEL"
 484 - specifies the flow label to use in outgoing packets.
 485
 486 .sp
 487 .BI dstport " PORT"
 488 - specifies the UDP destination port to communicate to the remote VXLAN tunnel endpoint.
 489
 490 .sp
 491 .BI srcport " MIN MAX"
 492 - specifies the range of port numbers to use as UDP
 493 source ports to communicate to the remote VXLAN tunnel endpoint.
 494
 495 .sp
 496 .I [no]learning
 497 - specifies if unknown source link layer addresses and IP addresses
 498 are entered into the VXLAN device forwarding database.
 499
 500 .sp
 501 .I [no]rsc
 502 - specifies if route short circuit is turned on.
 503
 504 .sp
 505 .I [no]proxy
 506 - specifies ARP proxy is turned on.
 507
 508 .sp
 509 .I [no]l2miss
 510 - specifies if netlink LLADDR miss notifications are generated.
 511
 512 .sp
 513 .I [no]l3miss
 514 - specifies if netlink IP ADDR miss notifications are generated.
 515
 516 .sp
 517 .I [no]udpcsum
 518 - specifies if UDP checksum is calculated for transmitted packets over IPv4.
 519
 520 .sp
 521 .I [no]udp6zerocsumtx
 522 - skip UDP checksum calculation for transmitted packets over IPv6.
 523
 524 .sp
 525 .I [no]udp6zerocsumrx
 526 - allow incoming UDP packets over IPv6 with zero checksum field.
 527
 528 .sp
 529 .BI ageing " SECONDS"
 530 - specifies the lifetime in seconds of FDB entries learnt by the kernel.
 531
 532 .sp
 533 .BI maxaddress " NUMBER"
 534 - specifies the maximum number of FDB entries.
 535
 536 .sp
 537 .I [no]external
 538 - specifies whether an external control plane
 539 .RB "(e.g. " "ip route encap" )
 540 or the internal FDB should be used.
 541
 542 .sp
 543 .B gbp
 544 - enables the Group Policy extension (VXLAN-GBP).
 545
 546 .in +4
 547 Allows to transport group policy context across VXLAN network peers.
 548 If enabled, includes the mark of a packet in the VXLAN header for outgoing
 549 packets and fills the packet mark based on the information found in the
 550 VXLAN header for incomming packets.
 551
 552 Format of upper 16 bits of packet mark (flags);
 553
 554 .in +2
 555 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 556 .br
 557 |-|-|-|-|-|-|-|-|-|D|-|-|A|-|-|-|
 558 .br
 559 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 560
 561 .B D :=
 562 Don't Learn bit. When set, this bit indicates that the egress
 563 VTEP MUST NOT learn the source address of the encapsulated frame.
 564
 565 .B A :=
 566 Indicates that the group policy has already been applied to
 567 this packet. Policies MUST NOT be applied by devices when the A bit is set.
 568 .in -2
 569
 570 Format of lower 16 bits of packet mark (policy ID):
 571
 572 .in +2
 573 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 574 .br
 575 |        Group Policy ID        |
 576 .br
 577 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 578 .in -2
 579
 580 Example:
 581   iptables -A OUTPUT [...] -j MARK --set-mark 0x800FF
 582
 583 .in -4
 584
 585 .sp
 586 .B gpe
 587 - enables the Generic Protocol extension (VXLAN-GPE). Currently, this is
 588 only supported together with the
 589 .B external
 590 keyword.
 591
 592 .in -8
 593
 594 .TP
 595 GRE, IPIP, SIT Type Support
 596 For a link of types
 597 .I GRE/IPIP/SIT
 598 the following additional arguments are supported:
 599
 600 .BI "ip link add " DEVICE
 601 .BR type " { gre | ipip | sit } "
 602 .BI " remote " ADDR " local " ADDR
 603 [
 604 .BR encap " { fou | gue | none } "
 605 ] [
 606 .BI "encap-sport { " PORT " | auto } "
 607 ] [
 608 .BI "encap-dport " PORT
 609 ] [
 610 .I " [no]encap-csum "
 611 ] [
 612 .I " [no]encap-remcsum "
 613 ]
 614
 615 .in +8
 616 .sp
 617 .BI  remote " ADDR "
 618 - specifies the remote address of the tunnel.
 619
 620 .sp
 621 .BI  local " ADDR "
 622 - specifies the fixed local address for tunneled packets.
 623 It must be an address on another interface on this host.
 624
 625 .sp
 626 .BR encap " { fou | gue | none } "
 627 - specifies type of secondary UDP encapsulation. "fou" indicates
 628 Foo-Over-UDP, "gue" indicates Generic UDP Encapsulation.
 629
 630 .sp
 631 .BI "encap-sport { " PORT " | auto } "
 632 - specifies the source port in UDP encapsulation.
 633 .IR PORT
 634 indicates the port by number, "auto"
 635 indicates that the port number should be chosen automatically
 636 (the kernel picks a flow based on the flow hash of the
 637 encapsulated packet).
 638
 639 .sp
 640 .I [no]encap-csum
 641 - specifies if UDP checksums are enabled in the secondary
 642 encapsulation.
 643
 644 .sp
 645 .I [no]encap-remcsum
 646 - specifies if Remote Checksum Offload is enabled. This is only
 647 applicable for Generic UDP Encapsulation.
 648
 649 .in -8
 650
 651 .TP
 652 IP6GRE/IP6GRETAP Type Support
 653 For a link of type
 654 .I IP6GRE/IP6GRETAP
 655 the following additional arguments are supported:
 656
 657 .BI "ip link add " DEVICE
 658 .BI type " { ip6gre | ip6gretap }  " remote " ADDR " local " ADDR
 659 [
 660 .I "[i|o]seq]"
 661 ] [
 662 .I "[i|o]key" KEY
 663 ] [
 664 .I " [i|o]csum "
 665 ] [
 666 .BI hoplimit " TTL "
 667 ] [
 668 .BI encaplimit " ELIM "
 669 ] [
 670 .BI tclass " TCLASS "
 671 ] [
 672 .BI flowlabel " FLOWLABEL "
 673 ] [
 674 .BI "dscp inherit"
 675 ] [
 676 .BI dev " PHYS_DEV "
 677 ]
 678
 679 .in +8
 680 .sp
 681 .BI  remote " ADDR "
 682 - specifies the remote IPv6 address of the tunnel.
 683
 684 .sp
 685 .BI  local " ADDR "
 686 - specifies the fixed local IPv6 address for tunneled packets.
 687 It must be an address on another interface on this host.
 688
 689 .sp
 690 .BI  [i|o]seq
 691 - serialize packets.
 692 The
 693 .B oseq
 694 flag enables sequencing of outgoing packets.
 695 The
 696 .B iseq
 697 flag requires that all input packets are serialized.
 698
 699 .sp
 700 .BI  [i|o]key " KEY"
 701 - use keyed GRE with key
 702 .IR KEY ". "KEY
 703 is either a number or an IPv4 address-like dotted quad.
 704 The
 705 .B key
 706 parameter specifies the same key to use in both directions.
 707 The
 708 .BR ikey " and " okey
 709 parameters specify different keys for input and output.
 710
 711 .sp
 712 .BI  [i|o]csum
 713 - generate/require checksums for tunneled packets.
 714 The
 715 .B ocsum
 716 flag calculates checksums for outgoing packets.
 717 The
 718 .B icsum
 719 flag requires that all input packets have the correct
 720 checksum. The
 721 .B csum
 722 flag is equivalent to the combination
 723 .BR "icsum ocsum" .
 724
 725 .sp
 726 .BI  hoplimit " TTL"
 727 - specifies Hop Limit value to use in outgoing packets.
 728
 729 .sp
 730 .BI  encaplimit " ELIM"
 731 - specifies a fixed encapsulation limit. Default is 4.
 732
 733 .sp
 734 .BI  flowlabel " FLOWLABEL"
 735 - specifies a fixed flowlabel.
 736
 737 .sp
 738 .BI  tclass " TCLASS"
 739 - specifies the traffic class field on
 740 tunneled packets, which can be specified as either a two-digit
 741 hex value (e.g. c0) or a predefined string (e.g. internet).
 742 The value
 743 .B inherit
 744 causes the field to be copied from the original IP header. The
 745 values
 746 .BI "inherit/" STRING
 747 or
 748 .BI "inherit/" 00 ".." ff
 749 will set the field to
 750 .I STRING
 751 or
 752 .IR 00 ".." ff
 753 when tunneling non-IP packets. The default value is 00.
 754
 755 .in -8
 756
 757 .TP
 758 IPoIB Type Support
 759 For a link of type
 760 .I IPoIB
 761 the following additional arguments are supported:
 762
 763 .BI "ip link add " DEVICE " name " NAME
 764 .BI type " ipoib [ " pkey " PKEY ] [" mode " MODE " ]
 765
 766 .in +8
 767 .sp
 768 .BI  pkey " PKEY "
 769 - specifies the IB P-Key to use.
 770
 771 .BI  mode " MODE "
 772 - specifies the mode (datagram or connected) to use.
 773
 774 .TP
 775 GENEVE Type Support
 776 For a link of type
 777 .I GENEVE
 778 the following additional arguments are supported:
 779
 780 .BI "ip link add " DEVICE
 781 .BI type " geneve " id " ID " remote " IPADDR"
 782 [
 783 .BI ttl " TTL "
 784 ] [
 785 .BI tos " TOS "
 786 ] [
 787 .BI flowlabel " FLOWLABEL "
 788 ]
 789
 790 .in +8
 791 .sp
 792 .BI  id " VNI "
 793 - specifies the Virtual Network Identifer to use.
 794
 795 .sp
 796 .BI remote " IPADDR"
 797 - specifies the unicast destination IP address to use in outgoing packets.
 798
 799 .sp
 800 .BI ttl " TTL"
 801 - specifies the TTL value to use in outgoing packets.
 802
 803 .sp
 804 .BI tos " TOS"
 805 - specifies the TOS value to use in outgoing packets.
 806
 807 .sp
 808 .BI flowlabel " FLOWLABEL"
 809 - specifies the flow label to use in outgoing packets.
 810
 811 .in -8
 812
 813 .TP
 814 MACVLAN and MACVTAP Type Support
 815 For a link of type
 816 .I MACVLAN
 817 or
 818 .I MACVTAP
 819 the following additional arguments are supported:
 820
 821 .BI "ip link add link " DEVICE " name " NAME
 822 .BR type " { " macvlan " | " macvtap " } "
 823 .BR mode " { " private " | " vepa " | " bridge " | " passthru
 824 .BR " [ " nopromisc " ] } "
 825
 826 .in +8
 827 .sp
 828 .BR type " { " macvlan " | " macvtap " } "
 829 - specifies the link type to use.
 830 .BR macvlan " creates just a virtual interface, while "
 831 .BR macvtap " in addition creates a character device "
 832 .BR /dev/tapX " to be used just like a " tuntap " device."
 833
 834 .B mode private
 835 - Do not allow communication between
 836 .B macvlan
 837 instances on the same physical interface, even if the external switch supports
 838 hairpin mode.
 839
 840 .B mode vepa
 841 - Virtual Ethernet Port Aggregator mode. Data from one
 842 .B macvlan
 843 instance to the other on the same physical interface is transmitted over the
 844 physical interface. Either the attached switch needs to support hairpin mode,
 845 or there must be a TCP/IP router forwarding the packets in order to allow
 846 communication. This is the default mode.
 847
 848 .B mode bridge
 849 - In bridge mode, all endpoints are directly connected to each other,
 850 communication is not redirected through the physical interface's peer.
 851
 852 .BR mode " " passthru " [ " nopromisc " ] "
 853 - This mode gives more power to a single endpoint, usually in
 854 .BR macvtap " mode. It is not allowed for more than one endpoint on the same "
 855 physical interface. All traffic will be forwarded to this endpoint, allowing
 856 virtio guests to change MAC address or set promiscuous mode in order to bridge
 857 the interface or create vlan interfaces on top of it. By default, this mode
 858 forces the underlying interface into promiscuous mode. Passing the
 859 .BR nopromisc " flag prevents this, so the promisc flag may be controlled "
 860 using standard tools.
 861 .in -8
 862
 863 .TP
 864 High-availability Seamless Redundancy (HSR) Support
 865 For a link of type
 866 .I HSR
 867 the following additional arguments are supported:
 868
 869 .BI "ip link add link " DEVICE " name " NAME
 870 .BI type " hsr "
 871 .BI slave1 " SLAVE1-IF " slave2 " SLAVE2-IF "
 872 .BR " [ supervision " ADDR-BYTE "  ] "
 873 .BR " [ version  { " 0 " | " 1 " } ] "
 874
 875 .in +8
 876 .sp
 877 .BR type " hsr "
 878 - specifies the link type to use, here HSR.
 879
 880 .BI slave1 " SLAVE1-IF "
 881 - Specifies the physical device used for the first of the two ring ports.
 882
 883 .BI slave2 " SLAVE2-IF "
 884 - Specifies the physical device used for the second of the two ring ports.
 885
 886 .BR "supervision ADDR-BYTE "
 887 - The last byte of the multicast address used for HSR supervision frames.
 888 Default option is "0", possible values 0-255.
 889
 890 .BR "version { 0 | 1 }"
 891 - Selects the protocol version of the interface. Default option is "0", which
 892 corresponds to the 2010 version of the HSR standard. Option "1" activates the
 893 2012 version.
 894 .in -8
 895
 896 .TP
 897 MACsec Type Support
 898 For a link of type
 899 .I MACsec
 900 the following additional arguments are supported:
 901
 902 .BI "ip link add link " DEVICE " name " NAME " type macsec"
 903 [
 904 .BI port " PORT"
 905 |
 906 .BI sci " SCI"
 907 ] [
 908 .BI cipher " CIPHER_SUITE"
 909 ] [
 910 .BR encrypt " {"
 911 .BR on " | " off " } ] [ "
 912 .BR send_sci " { " on " | " off " } ] ["
 913 .BR es " { " on " | " off " } ] ["
 914 .BR scb " { " on " | " off " } ] ["
 915 .BR protect " { " on " | " off " } ] ["
 916 .BR replay " { " on " | " off " }"
 917 .BR window " { "
 918 .IR 0..2^32-1 " } ] ["
 919 .BR validate " { " strict " | " check " | " disabled " } ] ["
 920 .BR encoding " { "
 921 .IR 0..3 " } ]"
 922
 923 .in +8
 924 .sp
 925 .BI  port " PORT "
 926 - sets the port number for this MACsec device.
 927
 928 .sp
 929 .BI sci " SCI "
 930 - sets the SCI for this MACsec device.
 931
 932 .sp
 933 .BI cipher " CIPHER_SUITE "
 934 - defines the cipher suite to use.
 935
 936 .sp
 937 .BR "encrypt on " or " encrypt off"
 938 - switches between authenticated encryption, or authenticity mode only.
 939
 940 .sp
 941 .BR "send_sci on " or " send_sci off"
 942 - specifies whether the SCI is included in every packet, or only when it is necessary.
 943
 944 .sp
 945 .BR "es on " or " es off"
 946 - sets the End Station bit.
 947
 948 .sp
 949 .BR "scb on " or " scb off"
 950 - sets the Single Copy Broadcast bit.
 951
 952 .sp
 953 .BR "protect on " or " protect off"
 954 - enables MACsec protection on the device.
 955
 956 .sp
 957 .BR "replay on " or " replay off"
 958 - enables replay protection on the device.
 959
 960 .in +8
 961
 962 .sp
 963 .BI window " SIZE "
 964 - sets the size of the replay window.
 965
 966 .in -8
 967
 968 .sp
 969 .BR "validate strict " or " validate check " or " validate disabled"
 970 - sets the validation mode on the device.
 971
 972 .sp
 973 .BI encoding " AN "
 974 - sets the active secure association for transmission.
 975
 976 .in -8
 977
 978 .TP
 979 VRF Type Support
 980 For a link of type
 981 .I VRF
 982 the following additional arguments are supported:
 983
 984 .BI "ip link add " DEVICE " type vrf table " TABLE
 985
 986 .in +8
 987 .sp
 988 .BR table " table id associated with VRF device"
 989
 990 .in -8
 991
 992 .SS ip link delete - delete virtual link
 993
 994 .TP
 995 .BI dev " DEVICE "
 996 specifies the virtual device to act operate on.
 997
 998 .TP
 999 .BI group " GROUP "
1000 specifies the group of virtual links to delete. Group 0 is not allowed to be
1001 deleted since it is the default group.
1002
1003 .TP
1004 .BI type " TYPE "
1005 specifies the type of the device.
1006
1007 .SS ip link set - change device attributes
1008
1009 .TP
1010 .BI dev " DEVICE "
1011 .I DEVICE
1012 specifies network device to operate on. When configuring SR-IOV Virtual Function
1013 (VF) devices, this keyword should specify the associated Physical Function (PF)
1014 device.
1015
1016 .TP
1017 .BI group " GROUP "
1018 .I GROUP
1019 has a dual role: If both group and dev are present, then move the device to the
1020 specified group. If only a group is specified, then the command operates on
1021 all devices in that group.
1022
1023 .TP
1024 .BR up " and " down
1025 change the state of the device to
1026 .B UP
1027 or
1028 .BR "DOWN" .
1029
1030 .TP
1031 .BR "arp on " or " arp off"
1032 change the
1033 .B NOARP
1034 flag on the device.
1035
1036 .TP
1037 .BR "multicast on " or " multicast off"
1038 change the
1039 .B MULTICAST
1040 flag on the device.
1041
1042 .TP
1043 .BR "protodown on " or " protodown off"
1044 change the
1045 .B PROTODOWN
1046 state on the device. Indicates that a protocol error has been detected on the port. Switch drivers can react to this error by doing a phys down on the switch port.
1047
1048 .TP
1049 .BR "dynamic on " or " dynamic off"
1050 change the
1051 .B DYNAMIC
1052 flag on the device. Indicates that address can change when interface goes down (currently
1053 .B NOT
1054 used by the Linux).
1055
1056 .TP
1057 .BI name " NAME"
1058 change the name of the device. This operation is not
1059 recommended if the device is running or has some addresses
1060 already configured.
1061
1062 .TP
1063 .BI txqueuelen " NUMBER"
1064 .TP
1065 .BI txqlen " NUMBER"
1066 change the transmit queue length of the device.
1067
1068 .TP
1069 .BI mtu " NUMBER"
1070 change the
1071 .I MTU
1072 of the device.
1073
1074 .TP
1075 .BI address " LLADDRESS"
1076 change the station address of the interface.
1077
1078 .TP
1079 .BI broadcast " LLADDRESS"
1080 .TP
1081 .BI brd " LLADDRESS"
1082 .TP
1083 .BI peer " LLADDRESS"
1084 change the link layer broadcast address or the peer address when
1085 the interface is
1086 .IR "POINTOPOINT" .
1087
1088 .TP
1089 .BI netns " NETNSNAME " \fR| " PID"
1090 move the device to the network namespace associated with name
1091 .IR "NETNSNAME " or
1092 .RI process " PID".
1093
1094 Some devices are not allowed to change network namespace: loopback, bridge,
1095 ppp, wireless. These are network namespace local devices. In such case
1096 .B ip
1097 tool will return "Invalid argument" error. It is possible to find out if device is local
1098 to a single network namespace by checking
1099 .B netns-local
1100 flag in the output of the
1101 .BR ethtool ":"
1102
1103 .in +8
1104 .B ethtool -k
1105 .I DEVICE
1106 .in -8
1107
1108 To change network namespace for wireless devices the
1109 .B iw
1110 tool can be used. But it allows to change network namespace only for physical devices and by process
1111 .IR PID .
1112
1113 .TP
1114 .BI alias " NAME"
1115 give the device a symbolic name for easy reference.
1116
1117 .TP
1118 .BI group " GROUP"
1119 specify the group the device belongs to.
1120 The available groups are listed in file
1121 .BR "@SYSCONFDIR@/group" .
1122
1123 .TP
1124 .BI vf " NUM"
1125 specify a Virtual Function device to be configured. The associated PF device
1126 must be specified using the
1127 .B dev
1128 parameter.
1129
1130 .in +8
1131 .BI mac " LLADDRESS"
1132 - change the station address for the specified VF. The
1133 .B vf
1134 parameter must be specified.
1135
1136 .sp
1137 .BI vlan " VLANID"
1138 - change the assigned VLAN for the specified VF. When specified, all traffic
1139 sent from the VF will be tagged with the specified VLAN ID. Incoming traffic
1140 will be filtered for the specified VLAN ID, and will have all VLAN tags
1141 stripped before being passed to the VF. Setting this parameter to 0 disables
1142 VLAN tagging and filtering. The
1143 .B vf
1144 parameter must be specified.
1145
1146 .sp
1147 .BI qos " VLAN-QOS"
1148 - assign VLAN QOS (priority) bits for the VLAN tag. When specified, all VLAN
1149 tags transmitted by the VF will include the specified priority bits in the
1150 VLAN tag. If not specified, the value is assumed to be 0. Both the
1151 .B vf
1152 and
1153 .B vlan
1154 parameters must be specified. Setting both
1155 .B vlan
1156 and
1157 .B qos
1158 as 0 disables VLAN tagging and filtering for the VF.
1159
1160 .sp
1161 .BI rate " TXRATE"
1162 -- change the allowed transmit bandwidth, in Mbps, for the specified VF.
1163 Setting this parameter to 0 disables rate limiting.
1164 .B vf
1165 parameter must be specified.
1166 Please use new API
1167 .B "max_tx_rate"
1168 option instead.
1169
1170 .sp
1171 .BI max_tx_rate " TXRATE"
1172 - change the allowed maximum transmit bandwidth, in Mbps, for the specified VF.
1173 .B vf
1174 parameter must be specified.
1175
1176 .sp
1177 .BI min_tx_rate " TXRATE"
1178 - change the allowed minimum transmit bandwidth, in Mbps, for the specified VF.
1179 Minimum TXRATE should be always <= Maximum TXRATE.
1180 .B vf
1181 parameter must be specified.
1182
1183 .sp
1184 .BI spoofchk " on|off"
1185 - turn packet spoof checking on or off for the specified VF.
1186 .sp
1187 .BI query_rss " on|off"
1188 - toggle the ability of querying the RSS configuration of a specific VF. VF RSS information like RSS hash key may be considered sensitive on some devices where this information is shared between VF and PF and thus its querying may be prohibited by default.
1189 .sp
1190 .BI state " auto|enable|disable"
1191 - set the virtual link state as seen by the specified VF. Setting to auto means a
1192 reflection of the PF link state, enable lets the VF to communicate with other VFs on
1193 this host even if the PF link state is down, disable causes the HW to drop any packets
1194 sent by the VF.
1195 .sp
1196 .BI trust " on|off"
1197 - trust the specified VF user. This enables that VF user can set a specific feature
1198 which may impact security and/or performance. (e.g. VF multicast promiscuous mode)
1199 .in -8
1200
1201 .TP
1202 .BI master " DEVICE"
1203 set master device of the device (enslave device).
1204
1205 .TP
1206 .BI nomaster
1207 unset master device of the device (release device).
1208
1209 .TP
1210 .BI addrgenmode " eui64|none|stable_secret|random"
1211 set the IPv6 address generation mode
1212
1213 .I eui64
1214 - use a Modified EUI-64 format interface identifier
1215
1216 .I none
1217 - disable automatic address generation
1218
1219 .I stable_secret
1220 - generate the interface identifier based on a preset /proc/sys/net/ipv6/conf/{default,DEVICE}/stable_secret
1221
1222 .I random
1223 - like stable_secret, but auto-generate a new random secret if none is set
1224
1225 .TP
1226 .BR "link-netnsid "
1227 set peer netnsid for a cross-netns interface
1228
1229 .PP
1230 .B Warning:
1231 If multiple parameter changes are requested,
1232 .B ip
1233 aborts immediately after any of the changes have failed.
1234 This is the only case when
1235 .B ip
1236 can move the system to an unpredictable state. The solution
1237 is to avoid changing several parameters with one
1238 .B ip link set
1239 call.
1240
1241 .SS  ip link show - display device attributes
1242
1243 .TP
1244 .BI dev " NAME " (default)
1245 .I NAME
1246 specifies the network device to show.
1247 If this argument is omitted all devices in the default group are listed.
1248
1249 .TP
1250 .BI group " GROUP "
1251 .I GROUP
1252 specifies what group of devices to show.
1253
1254 .TP
1255 .B up
1256 only display running interfaces.
1257
1258 .TP
1259 .BI master " DEVICE "
1260 .I DEVICE
1261 specifies the master device which enslaves devices to show.
1262
1263 .TP
1264 .BI vrf " NAME "
1265 .I NAME
1266 speficies the VRF which enslaves devices to show.
1267
1268 .TP
1269 .BI type " TYPE "
1270 .I TYPE
1271 specifies the type of devices to show.
1272
1273 Note that the type name is not checked against the list of supported types -
1274 instead it is sent as-is to the kernel. Later it is used to filter the returned
1275 interface list by comparing it with the relevant attribute in case the kernel
1276 didn't filter already. Therefore any string is accepted, but may lead to empty
1277 output.
1278
1279 .SS  ip link help - display help
1280
1281 .PP
1282 .I "TYPE"
1283 specifies which help of link type to dislpay.
1284
1285 .SS
1286 .I GROUP
1287 may be a number or a string from the file
1288 .B @SYSCONFDIR@/group
1289 which can be manually filled.
1290
1291 .SH "EXAMPLES"
1292 .PP
1293 ip link show
1294 .RS 4
1295 Shows the state of all network interfaces on the system.
1296 .RE
1297 .PP
1298 ip link show type bridge
1299 .RS 4
1300 Shows the bridge devices.
1301 .RE
1302 .PP
1303 ip link show type vlan
1304 .RS 4
1305 Shows the vlan devices.
1306 .RE
1307 .PP
1308 ip link show master br0
1309 .RS 4
1310 Shows devices enslaved by br0
1311 .RE
1312 .PP
1313 ip link set dev ppp0 mtu 1400
1314 .RS 4
1315 Change the MTU the ppp0 device.
1316 .RE
1317 .PP
1318 ip link add link eth0 name eth0.10 type vlan id 10
1319 .RS 4
1320 Creates a new vlan device eth0.10 on device eth0.
1321 .RE
1322 .PP
1323 ip link delete dev eth0.10
1324 .RS 4
1325 Removes vlan device.
1326 .RE
1327
1328 ip link help gre
1329 .RS 4
1330 Display help for the gre link type.
1331 .RE
1332 .PP
1333 ip link add name tun1 type ipip remote 192.168.1.1
1334 local 192.168.1.2 ttl 225 encap gue encap-sport auto
1335 encap-dport 5555 encap-csum encap-remcsum
1336 .RS 4
1337 Creates an IPIP that is encapsulated with Generic UDP Encapsulation,
1338 and the outer UDP checksum and remote checksum offload are enabled.
1339
1340 .RE
1341 .PP
1342 ip link add link wpan0 lowpan0 type lowpan
1343 .RS 4
1344 Creates a 6LoWPAN interface named lowpan0 on the underlying
1345 IEEE 802.15.4 device wpan0.
1346 .RE
1347
1348 .SH SEE ALSO
1349 .br
1350 .BR ip (8),
1351 .BR ip-netns (8),
1352 .BR ethtool (8),
1353 .BR iptables (8)
1354
1355 .SH AUTHOR
1356 Original Manpage by Michail Litvak <mci@owl.openwall.com>