man/man8/ip-link.8.in

   1 .TH IP\-LINK 8 "13 Dec 2012" "iproute2" "Linux"
   2 .SH "NAME"
   3 ip-link \- network device configuration
   4 .SH "SYNOPSIS"
   5 .sp
   6 .ad l
   7 .in +8
   8 .ti -8
   9 .B ip link
  10 .RI  " { " COMMAND " | "
  11 .BR help " }"
  12 .sp
  13
  14 .ti -8
  15 .BI "ip link add"
  16 .RB "[ " link
  17 .IR DEVICE " ]"
  18 .RB "[ " name " ]"
  19 .I NAME
  20 .br
  21 .RB "[ " txqueuelen
  22 .IR PACKETS " ]"
  23 .br
  24 .RB "[ " address
  25 .IR LLADDR " ]"
  26 .RB "[ " broadcast
  27 .IR LLADDR " ]"
  28 .br
  29 .RB "[ " mtu
  30 .IR MTU " ]"
  31 .RB "[ " index
  32 .IR IDX " ]"
  33 .br
  34 .RB "[ " numtxqueues
  35 .IR QUEUE_COUNT " ]"
  36 .RB "[ " numrxqueues
  37 .IR QUEUE_COUNT " ]"
  38 .br
  39 .BI type " TYPE"
  40 .RI "[ " ARGS " ]"
  41
  42 .ti -8
  43 .BR "ip link delete " {
  44 .IR DEVICE " | "
  45 .BI "group " GROUP
  46 }
  47 .BI type " TYPE"
  48 .RI "[ " ARGS " ]"
  49
  50 .ti -8
  51 .BR "ip link set " {
  52 .IR DEVICE " | "
  53 .BI "group " GROUP
  54 }
  55 .br
  56 .RB "[ { " up " | " down " } ]"
  57 .br
  58 .RB "[ " type
  59 .IR "ETYPE TYPE_ARGS" " ]"
  60 .br
  61 .RB "[ " arp " { " on " | " off " } ]"
  62 .br
  63 .RB "[ " dynamic " { " on " | " off " } ]"
  64 .br
  65 .RB "[ " multicast " { " on " | " off " } ]"
  66 .br
  67 .RB "[ " allmulticast " { " on " | " off " } ]"
  68 .br
  69 .RB "[ " promisc " { " on " | " off " } ]"
  70 .br
  71 .RB "[ " protodown " { " on " | " off " } ]"
  72 .br
  73 .RB "[ " trailers " { " on " | " off " } ]"
  74 .br
  75 .RB "[ " txqueuelen
  76 .IR PACKETS " ]"
  77 .br
  78 .RB "[ " name
  79 .IR NEWNAME " ]"
  80 .br
  81 .RB "[ " address
  82 .IR LLADDR " ]"
  83 .br
  84 .RB "[ " broadcast
  85 .IR LLADDR " ]"
  86 .br
  87 .RB "[ " mtu
  88 .IR MTU " ]"
  89 .br
  90 .RB "[ " netns " {"
  91 .IR PID " | " NETNSNAME " } ]"
  92 .br
  93 .RB "[ " link-netnsid
  94 .IR ID " ]"
  95 .br
  96 .RB "[ " alias
  97 .IR NAME  " ]"
  98 .br
  99 .RB "[ " vf
 100 .IR NUM " ["
 101 .B  mac
 102 .IR LLADDR " ]"
 103 .br
 104 .in +9
 105 .RI "[ " VFVLAN-LIST " ]"
 106 .br
 107 .RB "[ " rate
 108 .IR TXRATE " ]"
 109 .br
 110 .RB "[ " max_tx_rate
 111 .IR TXRATE " ]"
 112 .br
 113 .RB "[ " min_tx_rate
 114 .IR TXRATE " ]"
 115 .br
 116 .RB "[ " spoofchk " { " on " | " off " } ]"
 117 .br
 118 .RB "[ " query_rss " { " on " | " off " } ]"
 119 .br
 120 .RB "[ " state " { " auto " | " enable " | " disable " } ]"
 121 .br
 122 .RB "[ " trust " { " on " | " off " } ]"
 123 .br
 124 .RB "[ " node_guid " eui64 ]"
 125 .br
 126 .RB "[ " port_guid " eui64 ] ]"
 127 .br
 128 .in -9
 129 .RB "[ { " xdp " | " xdpgeneric  " | " xdpdrv " | " xdpoffload " } { " off " | "
 130 .br
 131 .in +8
 132 .BR object
 133 .IR FILE
 134 .RB "[ " section
 135 .IR NAME " ]"
 136 .RB "[ " verbose " ] |"
 137 .br
 138 .BR pinned
 139 .IR FILE " } ]"
 140 .br
 141 .in -8
 142 .RB "[ " master
 143 .IR DEVICE " ]"
 144 .br
 145 .RB "[ " nomaster " ]"
 146 .br
 147 .RB "[ " vrf
 148 .IR NAME " ]"
 149 .br
 150 .RB "[ " addrgenmode " { " eui64 " | " none " | " stable_secret " | " random " } ]"
 151 .br
 152 .RB "[ " macaddr " { " flush " | { " add " | " del " } "
 153 .IR MACADDR " | set [ "
 154 .IR MACADDR " [ "
 155 .IR MACADDR " [ ... ] ] ] } ]"
 156 .br
 157
 158 .ti -8
 159 .B ip link show
 160 .RI "[ " DEVICE " | "
 161 .B group
 162 .IR GROUP " ] ["
 163 .BR up " ] ["
 164 .B master
 165 .IR DEVICE " ] ["
 166 .B type
 167 .IR ETYPE " ] ["
 168 .B vrf
 169 .IR NAME " ]"
 170
 171 .ti -8
 172 .B ip link xstats
 173 .BI type " TYPE"
 174 .RI "[ " ARGS " ]"
 175
 176 .ti -8
 177 .B ip link afstats
 178 .RB "[ " dev
 179 .IR DEVICE " ]"
 180
 181 .ti -8
 182 .B ip link help
 183 .RI "[ " TYPE " ]"
 184
 185 .ti -8
 186 .IR TYPE " := [ "
 187 .BR bridge " | "
 188 .BR bond " | "
 189 .BR can " | "
 190 .BR dummy " | "
 191 .BR hsr " | "
 192 .BR ifb " | "
 193 .BR ipoib " |"
 194 .BR macvlan  " | "
 195 .BR macvtap  " | "
 196 .BR vcan " | "
 197 .BR veth " | "
 198 .BR vlan " | "
 199 .BR vxlan " |"
 200 .BR ip6tnl " |"
 201 .BR ipip " |"
 202 .BR sit " |"
 203 .BR gre " |"
 204 .BR gretap " |"
 205 .BR ip6gre " |"
 206 .BR ip6gretap " |"
 207 .BR vti " |"
 208 .BR nlmon " |"
 209 .BR ipvlan " |"
 210 .BR lowpan " |"
 211 .BR geneve " |"
 212 .BR vrf " |"
 213 .BR macsec " ]"
 214
 215 .ti -8
 216 .IR ETYPE " := [ " TYPE " |"
 217 .BR bridge_slave " | " bond_slave " ]"
 218
 219 .ti -8
 220 .IR VFVLAN-LIST " := [ "  VFVLAN-LIST " ] " VFVLAN
 221
 222 .ti -8
 223 .IR VFVLAN " := "
 224 .RB "[ " vlan
 225 .IR VLANID " [ "
 226 .B qos
 227 .IR VLAN-QOS " ] ["
 228 .B proto
 229 .IR VLAN-PROTO " ] ]"
 230
 231 .SH "DESCRIPTION"
 232 .SS ip link add - add virtual link
 233
 234 .TP
 235 .BI link " DEVICE "
 236 specifies the physical device to act operate on.
 237
 238 .I NAME
 239 specifies the name of the new virtual device.
 240
 241 .I TYPE
 242 specifies the type of the new device.
 243 .sp
 244 Link types:
 245
 246 .in +8
 247 .B bridge
 248 - Ethernet Bridge device
 249 .sp
 250 .B bond
 251 - Bonding device
 252 .B can
 253 - Controller Area Network interface
 254 .sp
 255 .B dummy
 256 - Dummy network interface
 257 .sp
 258 .B hsr
 259 - High-availability Seamless Redundancy device
 260 .sp
 261 .B ifb
 262 - Intermediate Functional Block device
 263 .sp
 264 .B ipoib
 265 - IP over Infiniband device
 266 .sp
 267 .B macvlan
 268 - Virtual interface base on link layer address (MAC)
 269 .sp
 270 .B macvtap
 271 - Virtual interface based on link layer address (MAC) and TAP.
 272 .sp
 273 .B vcan
 274 - Virtual Controller Area Network interface
 275 .sp
 276 .B veth
 277 - Virtual ethernet interface
 278 .sp
 279 .BR vlan
 280 - 802.1q tagged virtual LAN interface
 281 .sp
 282 .BR vxlan
 283 - Virtual eXtended LAN
 284 .sp
 285 .BR ip6tnl
 286 - Virtual tunnel interface IPv4|IPv6 over IPv6
 287 .sp
 288 .BR ipip
 289 - Virtual tunnel interface IPv4 over IPv4
 290 .sp
 291 .BR sit
 292 - Virtual tunnel interface IPv6 over IPv4
 293 .sp
 294 .BR gre
 295 - Virtual tunnel interface GRE over IPv4
 296 .sp
 297 .BR gretap
 298 - Virtual L2 tunnel interface GRE over IPv4
 299 .sp
 300 .BR ip6gre
 301 - Virtual tunnel interface GRE over IPv6
 302 .sp
 303 .BR ip6gretap
 304 - Virtual L2 tunnel interface GRE over IPv6
 305 .sp
 306 .BR vti
 307 - Virtual tunnel interface
 308 .sp
 309 .BR nlmon
 310 - Netlink monitoring device
 311 .sp
 312 .BR ipvlan
 313 - Interface for L3 (IPv6/IPv4) based VLANs
 314 .sp
 315 .BR lowpan
 316 - Interface for 6LoWPAN (IPv6) over IEEE 802.15.4 / Bluetooth
 317 .sp
 318 .BR geneve
 319 - GEneric NEtwork Virtualization Encapsulation
 320 .sp
 321 .BR macsec
 322 - Interface for IEEE 802.1AE MAC Security (MACsec)
 323 .sp
 324 .BR vrf
 325 - Interface for L3 VRF domains
 326 .in -8
 327
 328 .TP
 329 .BI numtxqueues " QUEUE_COUNT "
 330 specifies the number of transmit queues for new device.
 331
 332 .TP
 333 .BI numrxqueues " QUEUE_COUNT "
 334 specifies the number of receive queues for new device.
 335
 336 .TP
 337 .BI index " IDX "
 338 specifies the desired index of the new virtual device. The link creation fails, if the index is busy.
 339
 340 .TP
 341 VLAN Type Support
 342 For a link of type
 343 .I VLAN
 344 the following additional arguments are supported:
 345
 346 .BI "ip link add
 347 .BI link " DEVICE "
 348 .BI name " NAME "
 349 .B "type vlan"
 350 [
 351 .BI protocol " VLAN_PROTO "
 352 ]
 353 .BI id " VLANID "
 354 [
 355 .BR reorder_hdr " { " on " | " off " } "
 356 ]
 357 [
 358 .BR gvrp " { " on " | " off " } "
 359 ]
 360 [
 361 .BR mvrp " { " on " | " off " } "
 362 ]
 363 [
 364 .BR loose_binding " { " on " | " off " } "
 365 ]
 366 [
 367 .BI ingress-qos-map " QOS-MAP "
 368 ]
 369 [
 370 .BI egress-qos-map " QOS-MAP "
 371 ]
 372
 373 .in +8
 374 .sp
 375 .BI protocol " VLAN_PROTO "
 376 - either 802.1Q or 802.1ad.
 377
 378 .BI id " VLANID "
 379 - specifies the VLAN Identifer to use. Note that numbers with a leading " 0 " or " 0x " are interpreted as octal or hexadeimal, respectively.
 380
 381 .BR reorder_hdr " { " on " | " off " } "
 382 - specifies whether ethernet headers are reordered or not (default is
 383 .BR on ")."
 384
 385 .in +4
 386 If
 387 .BR reorder_hdr " is " on
 388 then VLAN header will be not inserted immediately but only before passing to the
 389 physical device (if this device does not support VLAN offloading), the similar
 390 on the RX direction - by default the packet will be untagged before being
 391 received by VLAN device. Reordering allows to accelerate tagging on egress and
 392 to hide VLAN header on ingress so the packet looks like regular Ethernet packet,
 393 at the same time it might be confusing for packet capture as the VLAN header
 394 does not exist within the packet.
 395
 396 VLAN offloading can be checked by
 397 .BR ethtool "(8):"
 398 .in +4
 399 .sp
 400 .B ethtool -k
 401 <phy_dev> |
 402 .RB grep " tx-vlan-offload"
 403 .sp
 404 .in -4
 405 where <phy_dev> is the physical device to which VLAN device is bound.
 406 .in -4
 407
 408 .BR gvrp " { " on " | " off " } "
 409 - specifies whether this VLAN should be registered using GARP VLAN Registration Protocol.
 410
 411 .BR mvrp " { " on " | " off " } "
 412 - specifies whether this VLAN should be registered using Multiple VLAN Registration Protocol.
 413
 414 .BR loose_binding " { " on " | " off " } "
 415 - specifies whether the VLAN device state is bound to the physical device state.
 416
 417 .BI ingress-qos-map " QOS-MAP "
 418 - defines a mapping of VLAN header prio field to the Linux internal packet
 419 priority on incoming frames. The format is FROM:TO with multiple mappings
 420 separated by spaces.
 421
 422 .BI egress-qos-map " QOS-MAP "
 423 - defines a mapping of Linux internal packet priority to VLAN header prio field
 424 but for outgoing frames. The format is the same as for ingress-qos-map.
 425 .in +4
 426
 427 Linux packet priority can be set by
 428 .BR iptables "(8)":
 429 .in +4
 430 .sp
 431 .B iptables
 432 -t mangle -A POSTROUTING [...] -j CLASSIFY --set-class 0:4
 433 .sp
 434 .in -4
 435 and this "4" priority can be used in the egress qos mapping to set VLAN prio "5":
 436 .sp
 437 .in +4
 438 .B ip
 439 link set veth0.10 type vlan egress 4:5
 440 .in -4
 441 .in -4
 442 .in -8
 443
 444 .TP
 445 VXLAN Type Support
 446 For a link of type
 447 .I VXLAN
 448 the following additional arguments are supported:
 449
 450 .BI "ip link add " DEVICE
 451 .BI type " vxlan " id " VNI"
 452 [
 453 .BI dev " PHYS_DEV "
 454 .RB " ] [ { " group " | " remote " } "
 455 .I IPADDR
 456 ] [
 457 .B local
 458 .RI "{ "IPADDR " | "any " } "
 459 ] [
 460 .BI ttl " TTL "
 461 ] [
 462 .BI tos " TOS "
 463 ] [
 464 .BI flowlabel " FLOWLABEL "
 465 ] [
 466 .BI dstport " PORT "
 467 ] [
 468 .BI srcport " MIN MAX "
 469 ] [
 470 .RB [ no ] learning
 471 ] [
 472 .RB [ no ] proxy
 473 ] [
 474 .RB [ no ] rsc
 475 ] [
 476 .RB [ no ] l2miss
 477 ] [
 478 .RB [ no ] l3miss
 479 ] [
 480 .RB [ no ] udpcsum
 481 ] [
 482 .RB [ no ] udp6zerocsumtx
 483 ] [
 484 .RB [ no ] udp6zerocsumrx
 485 ] [
 486 .BI ageing " SECONDS "
 487 ] [
 488 .BI maxaddress " NUMBER "
 489 ] [
 490 .RB [ no ] external
 491 ] [
 492 .B gbp
 493 ] [
 494 .B gpe
 495 ]
 496
 497 .in +8
 498 .sp
 499 .BI  id " VNI "
 500 - specifies the VXLAN Network Identifer (or VXLAN Segment
 501 Identifier) to use.
 502
 503 .BI dev " PHYS_DEV"
 504 - specifies the physical device to use for tunnel endpoint communication.
 505
 506 .sp
 507 .BI group " IPADDR"
 508 - specifies the multicast IP address to join.
 509 This parameter cannot be specified with the
 510 .B remote
 511 parameter.
 512
 513 .sp
 514 .BI remote " IPADDR"
 515 - specifies the unicast destination IP address to use in outgoing packets
 516 when the destination link layer address is not known in the VXLAN device
 517 forwarding database. This parameter cannot be specified with the
 518 .B group
 519 parameter.
 520
 521 .sp
 522 .BI local " IPADDR"
 523 - specifies the source IP address to use in outgoing packets.
 524
 525 .sp
 526 .BI ttl " TTL"
 527 - specifies the TTL value to use in outgoing packets.
 528
 529 .sp
 530 .BI tos " TOS"
 531 - specifies the TOS value to use in outgoing packets.
 532
 533 .sp
 534 .BI flowlabel " FLOWLABEL"
 535 - specifies the flow label to use in outgoing packets.
 536
 537 .sp
 538 .BI dstport " PORT"
 539 - specifies the UDP destination port to communicate to the remote VXLAN tunnel endpoint.
 540
 541 .sp
 542 .BI srcport " MIN MAX"
 543 - specifies the range of port numbers to use as UDP
 544 source ports to communicate to the remote VXLAN tunnel endpoint.
 545
 546 .sp
 547 .RB [ no ] learning
 548 - specifies if unknown source link layer addresses and IP addresses
 549 are entered into the VXLAN device forwarding database.
 550
 551 .sp
 552 .RB [ no ] rsc
 553 - specifies if route short circuit is turned on.
 554
 555 .sp
 556 .RB [ no ] proxy
 557 - specifies ARP proxy is turned on.
 558
 559 .sp
 560 .RB [ no ] l2miss
 561 - specifies if netlink LLADDR miss notifications are generated.
 562
 563 .sp
 564 .RB [ no ] l3miss
 565 - specifies if netlink IP ADDR miss notifications are generated.
 566
 567 .sp
 568 .RB [ no ] udpcsum
 569 - specifies if UDP checksum is calculated for transmitted packets over IPv4.
 570
 571 .sp
 572 .RB [ no ] udp6zerocsumtx
 573 - skip UDP checksum calculation for transmitted packets over IPv6.
 574
 575 .sp
 576 .RB [ no ] udp6zerocsumrx
 577 - allow incoming UDP packets over IPv6 with zero checksum field.
 578
 579 .sp
 580 .BI ageing " SECONDS"
 581 - specifies the lifetime in seconds of FDB entries learnt by the kernel.
 582
 583 .sp
 584 .BI maxaddress " NUMBER"
 585 - specifies the maximum number of FDB entries.
 586
 587 .sp
 588 .RB [ no ] external
 589 - specifies whether an external control plane
 590 .RB "(e.g. " "ip route encap" )
 591 or the internal FDB should be used.
 592
 593 .sp
 594 .B gbp
 595 - enables the Group Policy extension (VXLAN-GBP).
 596
 597 .in +4
 598 Allows to transport group policy context across VXLAN network peers.
 599 If enabled, includes the mark of a packet in the VXLAN header for outgoing
 600 packets and fills the packet mark based on the information found in the
 601 VXLAN header for incomming packets.
 602
 603 Format of upper 16 bits of packet mark (flags);
 604
 605 .in +2
 606 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 607 .br
 608 |-|-|-|-|-|-|-|-|-|D|-|-|A|-|-|-|
 609 .br
 610 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 611
 612 .B D :=
 613 Don't Learn bit. When set, this bit indicates that the egress
 614 VTEP MUST NOT learn the source address of the encapsulated frame.
 615
 616 .B A :=
 617 Indicates that the group policy has already been applied to
 618 this packet. Policies MUST NOT be applied by devices when the A bit is set.
 619 .in -2
 620
 621 Format of lower 16 bits of packet mark (policy ID):
 622
 623 .in +2
 624 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 625 .br
 626 |        Group Policy ID        |
 627 .br
 628 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 629 .in -2
 630
 631 Example:
 632   iptables -A OUTPUT [...] -j MARK --set-mark 0x800FF
 633
 634 .in -4
 635
 636 .sp
 637 .B gpe
 638 - enables the Generic Protocol extension (VXLAN-GPE). Currently, this is
 639 only supported together with the
 640 .B external
 641 keyword.
 642
 643 .in -8
 644
 645 .TP
 646 GRE, IPIP, SIT Type Support
 647 For a link of types
 648 .I GRE/IPIP/SIT
 649 the following additional arguments are supported:
 650
 651 .BI "ip link add " DEVICE
 652 .BR type " { " gre " | " ipip " | " sit " }"
 653 .BI " remote " ADDR " local " ADDR
 654 [
 655 .BR encap " { " fou " | " gue " | " none " }"
 656 ] [
 657 .BR encap-sport " { " \fIPORT " | " auto " }"
 658 ] [
 659 .BI "encap-dport " PORT
 660 ] [
 661 .RB [ no ] encap-csum
 662 ] [
 663 .I " [no]encap-remcsum "
 664 ] [
 665 .I " mode " { ip6ip | ipip | mplsip | any } "
 666 ]
 667
 668 .in +8
 669 .sp
 670 .BI  remote " ADDR "
 671 - specifies the remote address of the tunnel.
 672
 673 .sp
 674 .BI  local " ADDR "
 675 - specifies the fixed local address for tunneled packets.
 676 It must be an address on another interface on this host.
 677
 678 .sp
 679 .BR encap " { " fou " | " gue " | " none " }"
 680 - specifies type of secondary UDP encapsulation. "fou" indicates
 681 Foo-Over-UDP, "gue" indicates Generic UDP Encapsulation.
 682
 683 .sp
 684 .BR encap-sport " { " \fIPORT " | " auto " }"
 685 - specifies the source port in UDP encapsulation.
 686 .IR PORT
 687 indicates the port by number, "auto"
 688 indicates that the port number should be chosen automatically
 689 (the kernel picks a flow based on the flow hash of the
 690 encapsulated packet).
 691
 692 .sp
 693 .RB [ no ] encap-csum
 694 - specifies if UDP checksums are enabled in the secondary
 695 encapsulation.
 696
 697 .sp
 698 .RB [ no ] encap-remcsum
 699 - specifies if Remote Checksum Offload is enabled. This is only
 700 applicable for Generic UDP Encapsulation.
 701
 702 .sp
 703 .BI mode " { ip6ip | ipip | mplsip | any } "
 704 - specifies mode in which device should run. "ip6ip" indicates
 705 IPv6-Over-IPv4, "ipip" indicates "IPv4-Over-IPv4", "mplsip" indicates
 706 MPLS-Over-IPv4, "any" indicates IPv6, IPv4 or MPLS Over IPv4. Supported for
 707 SIT where the default is "ip6ip" and IPIP where the default is "ipip".
 708 IPv6-Over-IPv4 is not supported for IPIP.
 709
 710 .in -8
 711
 712 .TP
 713 IP6GRE/IP6GRETAP Type Support
 714 For a link of type
 715 .I IP6GRE/IP6GRETAP
 716 the following additional arguments are supported:
 717
 718 .BI "ip link add " DEVICE
 719 .BR type " { " ip6gre " | " ip6gretap " }"
 720 .BI remote " ADDR " local " ADDR"
 721 [
 722 .RB [ i | o ] seq
 723 ] [
 724 .RB [ i | o ] key
 725 .I KEY
 726 ] [
 727 .RB [ i | o ] csum
 728 ] [
 729 .BI hoplimit " TTL "
 730 ] [
 731 .BI encaplimit " ELIM "
 732 ] [
 733 .BI tclass " TCLASS "
 734 ] [
 735 .BI flowlabel " FLOWLABEL "
 736 ] [
 737 .BI "dscp inherit"
 738 ] [
 739 .BI dev " PHYS_DEV "
 740 ]
 741
 742 .in +8
 743 .sp
 744 .BI  remote " ADDR "
 745 - specifies the remote IPv6 address of the tunnel.
 746
 747 .sp
 748 .BI  local " ADDR "
 749 - specifies the fixed local IPv6 address for tunneled packets.
 750 It must be an address on another interface on this host.
 751
 752 .sp
 753 .RB  [ i | o ] seq
 754 - serialize packets.
 755 The
 756 .B oseq
 757 flag enables sequencing of outgoing packets.
 758 The
 759 .B iseq
 760 flag requires that all input packets are serialized.
 761
 762 .sp
 763 .RB  [ i | o ] key " \fIKEY"
 764 - use keyed GRE with key
 765 .IR KEY ". "KEY
 766 is either a number or an IPv4 address-like dotted quad.
 767 The
 768 .B key
 769 parameter specifies the same key to use in both directions.
 770 The
 771 .BR ikey " and " okey
 772 parameters specify different keys for input and output.
 773
 774 .sp
 775 .RB  [ i | o ] csum
 776 - generate/require checksums for tunneled packets.
 777 The
 778 .B ocsum
 779 flag calculates checksums for outgoing packets.
 780 The
 781 .B icsum
 782 flag requires that all input packets have the correct
 783 checksum. The
 784 .B csum
 785 flag is equivalent to the combination
 786 .BR "icsum ocsum" .
 787
 788 .sp
 789 .BI  hoplimit " TTL"
 790 - specifies Hop Limit value to use in outgoing packets.
 791
 792 .sp
 793 .BI  encaplimit " ELIM"
 794 - specifies a fixed encapsulation limit. Default is 4.
 795
 796 .sp
 797 .BI  flowlabel " FLOWLABEL"
 798 - specifies a fixed flowlabel.
 799
 800 .sp
 801 .BI  tclass " TCLASS"
 802 - specifies the traffic class field on
 803 tunneled packets, which can be specified as either a two-digit
 804 hex value (e.g. c0) or a predefined string (e.g. internet).
 805 The value
 806 .B inherit
 807 causes the field to be copied from the original IP header. The
 808 values
 809 .BI "inherit/" STRING
 810 or
 811 .BI "inherit/" 00 ".." ff
 812 will set the field to
 813 .I STRING
 814 or
 815 .IR 00 ".." ff
 816 when tunneling non-IP packets. The default value is 00.
 817
 818 .in -8
 819
 820 .TP
 821 IPoIB Type Support
 822 For a link of type
 823 .I IPoIB
 824 the following additional arguments are supported:
 825
 826 .BI "ip link add " DEVICE " name " NAME
 827 .BR "type ipoib " [ " pkey \fIPKEY" " ] [ " mode " \fIMODE \fR]"
 828
 829 .in +8
 830 .sp
 831 .BI  pkey " PKEY "
 832 - specifies the IB P-Key to use.
 833
 834 .BI  mode " MODE "
 835 - specifies the mode (datagram or connected) to use.
 836
 837 .TP
 838 GENEVE Type Support
 839 For a link of type
 840 .I GENEVE
 841 the following additional arguments are supported:
 842
 843 .BI "ip link add " DEVICE
 844 .BI type " geneve " id " VNI " remote " IPADDR"
 845 [
 846 .BI ttl " TTL "
 847 ] [
 848 .BI tos " TOS "
 849 ] [
 850 .BI flowlabel " FLOWLABEL "
 851 ] [
 852 .BI dstport " PORT"
 853 ] [
 854 .RB [ no ] external
 855 ] [
 856 .RB [ no ] udpcsum
 857 ] [
 858 .RB [ no ] udp6zerocsumtx
 859 ] [
 860 .RB [ no ] udp6zerocsumrx
 861 ]
 862
 863 .in +8
 864 .sp
 865 .BI  id " VNI "
 866 - specifies the Virtual Network Identifer to use.
 867
 868 .sp
 869 .BI remote " IPADDR"
 870 - specifies the unicast destination IP address to use in outgoing packets.
 871
 872 .sp
 873 .BI ttl " TTL"
 874 - specifies the TTL value to use in outgoing packets.
 875
 876 .sp
 877 .BI tos " TOS"
 878 - specifies the TOS value to use in outgoing packets.
 879
 880 .sp
 881 .BI flowlabel " FLOWLABEL"
 882 - specifies the flow label to use in outgoing packets.
 883
 884 .sp
 885 .BI dstport " PORT"
 886 - select a destination port other than the default of 6081.
 887
 888 .sp
 889 .RB [ no ] external
 890 - make this tunnel externally controlled (or not, which is the default). This
 891 flag is mutually exclusive with the
 892 .BR id ,
 893 .BR remote ,
 894 .BR ttl ,
 895 .BR tos " and " flowlabel
 896 options.
 897
 898 .sp
 899 .RB [ no ] udpcsum
 900 - specifies if UDP checksum is calculated for transmitted packets over IPv4.
 901
 902 .sp
 903 .RB [ no ] udp6zerocsumtx
 904 - skip UDP checksum calculation for transmitted packets over IPv6.
 905
 906 .sp
 907 .RB [ no ] udp6zerocsumrx
 908 - allow incoming UDP packets over IPv6 with zero checksum field.
 909
 910 .in -8
 911
 912 .TP
 913 MACVLAN and MACVTAP Type Support
 914 For a link of type
 915 .I MACVLAN
 916 or
 917 .I MACVTAP
 918 the following additional arguments are supported:
 919
 920 .BI "ip link add link " DEVICE " name " NAME
 921 .BR type " { " macvlan " | " macvtap " } "
 922 .BR mode " { " private " | " vepa " | " bridge " | " passthru
 923 .RB " [ " nopromisc " ] | " source " } "
 924
 925 .in +8
 926 .sp
 927 .BR type " { " macvlan " | " macvtap " } "
 928 - specifies the link type to use.
 929 .BR macvlan " creates just a virtual interface, while "
 930 .BR macvtap " in addition creates a character device "
 931 .BR /dev/tapX " to be used just like a " tuntap " device."
 932
 933 .B mode private
 934 - Do not allow communication between
 935 .B macvlan
 936 instances on the same physical interface, even if the external switch supports
 937 hairpin mode.
 938
 939 .B mode vepa
 940 - Virtual Ethernet Port Aggregator mode. Data from one
 941 .B macvlan
 942 instance to the other on the same physical interface is transmitted over the
 943 physical interface. Either the attached switch needs to support hairpin mode,
 944 or there must be a TCP/IP router forwarding the packets in order to allow
 945 communication. This is the default mode.
 946
 947 .B mode bridge
 948 - In bridge mode, all endpoints are directly connected to each other,
 949 communication is not redirected through the physical interface's peer.
 950
 951 .BR mode " " passthru " [ " nopromisc " ] "
 952 - This mode gives more power to a single endpoint, usually in
 953 .BR macvtap " mode. It is not allowed for more than one endpoint on the same "
 954 physical interface. All traffic will be forwarded to this endpoint, allowing
 955 virtio guests to change MAC address or set promiscuous mode in order to bridge
 956 the interface or create vlan interfaces on top of it. By default, this mode
 957 forces the underlying interface into promiscuous mode. Passing the
 958 .BR nopromisc " flag prevents this, so the promisc flag may be controlled "
 959 using standard tools.
 960
 961 .B mode source
 962 - allows one to set a list of allowed mac address, which is used to match
 963 against source mac address from received frames on underlying interface. This
 964 allows creating mac based VLAN associations, instead of standard port or tag
 965 based. The feature is useful to deploy 802.1x mac based behavior,
 966 where drivers of underlying interfaces doesn't allows that.
 967 .in -8
 968
 969 .TP
 970 High-availability Seamless Redundancy (HSR) Support
 971 For a link of type
 972 .I HSR
 973 the following additional arguments are supported:
 974
 975 .BI "ip link add link " DEVICE " name " NAME " type hsr"
 976 .BI slave1 " SLAVE1-IF " slave2 " SLAVE2-IF "
 977 .RB [ " supervision"
 978 .IR ADDR-BYTE " ] ["
 979 .BR version " { " 0 " | " 1 " } ]"
 980
 981 .in +8
 982 .sp
 983 .BR type " hsr "
 984 - specifies the link type to use, here HSR.
 985
 986 .BI slave1 " SLAVE1-IF "
 987 - Specifies the physical device used for the first of the two ring ports.
 988
 989 .BI slave2 " SLAVE2-IF "
 990 - Specifies the physical device used for the second of the two ring ports.
 991
 992 .BI supervision " ADDR-BYTE"
 993 - The last byte of the multicast address used for HSR supervision frames.
 994 Default option is "0", possible values 0-255.
 995
 996 .BR version " { " 0 " | " 1 " }"
 997 - Selects the protocol version of the interface. Default option is "0", which
 998 corresponds to the 2010 version of the HSR standard. Option "1" activates the
 999 2012 version.
1000 .in -8
1001
1002 .TP
1003 BRIDGE Type Support
1004 For a link of type
1005 .I BRIDGE
1006 the following additional arguments are supported:
1007
1008 .BI "ip link add " DEVICE " type bridge "
1009 [
1010 .BI ageing_time " AGEING_TIME "
1011 ] [
1012 .BI group_fwd_mask " MASK "
1013 ] [
1014 .BI group_address " ADDRESS "
1015 ] [
1016 .BI forward_delay " FORWARD_DELAY "
1017 ] [
1018 .BI hello_time " HELLO_TIME "
1019 ] [
1020 .BI max_age " MAX_AGE "
1021 ] [
1022 .BI stp_state " STP_STATE "
1023 ] [
1024 .BI priority " PRIORITY "
1025 ] [
1026 .BI vlan_filtering " VLAN_FILTERING "
1027 ] [
1028 .BI vlan_protocol " VLAN_PROTOCOL "
1029 ] [
1030 .BI vlan_default_pvid " VLAN_DEFAULT_PVID "
1031 ] [
1032 .BI vlan_stats_enabled " VLAN_STATS_ENABLED "
1033 ] [
1034 .BI mcast_snooping " MULTICAST_SNOOPING "
1035 ] [
1036 .BI mcast_router " MULTICAST_ROUTER "
1037 ] [
1038 .BI mcast_query_use_ifaddr " MCAST_QUERY_USE_IFADDR "
1039 ] [
1040 .BI mcast_querier " MULTICAST_QUERIER "
1041 ] [
1042 .BI mcast_hash_elasticity " HASH_ELASTICITY "
1043 ] [
1044 .BI mcast_hash_max " HASH_MAX "
1045 ] [
1046 .BI mcast_last_member_count " LAST_MEMBER_COUNT "
1047 ] [
1048 .BI mcast_startup_query_count " STARTUP_QUERY_COUNT "
1049 ] [
1050 .BI mcast_last_member_interval " LAST_MEMBER_INTERVAL "
1051 ] [
1052 .BI mcast_membership_interval " MEMBERSHIP_INTERVAL "
1053 ] [
1054 .BI mcast_querier_interval " QUERIER_INTERVAL "
1055 ] [
1056 .BI mcast_query_interval " QUERY_INTERVAL "
1057 ] [
1058 .BI mcast_query_response_interval " QUERY_RESPONSE_INTERVAL "
1059 ] [
1060 .BI mcast_startup_query_interval " STARTUP_QUERY_INTERVAL "
1061 ] [
1062 .BI mcast_stats_enabled " MCAST_STATS_ENABLED "
1063 ] [
1064 .BI mcast_igmp_version " IGMP_VERSION "
1065 ] [
1066 .BI mcast_mld_version " MLD_VERSION "
1067 ] [
1068 .BI nf_call_iptables " NF_CALL_IPTABLES "
1069 ] [
1070 .BI nf_call_ip6tables " NF_CALL_IP6TABLES "
1071 ] [
1072 .BI nf_call_arptables " NF_CALL_ARPTABLES "
1073 ]
1074
1075 .in +8
1076 .sp
1077 .BI ageing_time " AGEING_TIME "
1078 - configure the bridge's FDB entries ageing time, ie the number of seconds a MAC address will be kept in the FDB after a packet has been received from that address. after this time has passed, entries are cleaned up.
1079
1080 .BI group_fwd_mask " MASK "
1081 - set the group forward mask. This is the bitmask that is applied to decide whether to forward incoming frames destined to link-local addresses, ie addresses of the form 01:80:C2:00:00:0X (defaults to 0, ie the bridge does not forward any link-local frames).
1082
1083 .BI group_address " ADDRESS "
1084 - set the MAC address of the multicast group this bridge uses for STP.  The address must be a link-local address in standard Ethernet MAC address format, ie an address of the form 01:80:C2:00:00:0X, with X in [0, 4..f].
1085
1086 .BI forward_delay " FORWARD_DELAY "
1087 - set the forwarding delay in seconds, ie the time spent in LISTENING state (before moving to LEARNING) and in LEARNING state (before moving to FORWARDING). Only relevant if STP is enabled. Valid values are between 2 and 30.
1088
1089 .BI hello_time " HELLO_TIME "
1090 - set the time in seconds between hello packets sent by the bridge, when it is a root bridge or a designated bridges. Only relevant if STP is enabled. Valid values are between 1 and 10.
1091
1092 .BI max_age " MAX_AGE "
1093 - set the hello packet timeout, ie the time in seconds until another bridge in the spanning tree is assumed to be dead, after reception of its last hello message. Only relevant if STP is enabled. Valid values are between 6 and 40.
1094
1095 .BI stp_state " STP_STATE "
1096 - turn spanning tree protocol on
1097 .RI ( STP_STATE " > 0) "
1098 or off
1099 .RI ( STP_STATE " == 0). "
1100 for this bridge.
1101
1102 .BI priority " PRIORITY "
1103 - set this bridge's spanning tree priority, used during STP root bridge election.
1104 .I PRIORITY
1105 is a 16bit unsigned integer.
1106
1107 .BI vlan_filtering " VLAN_FILTERING "
1108 - turn VLAN filtering on
1109 .RI ( VLAN_FILTERING " > 0) "
1110 or off
1111 .RI ( VLAN_FILTERING " == 0). "
1112 When disabled, the bridge will not consider the VLAN tag when handling packets.
1113
1114 .BR vlan_protocol " { " 802.1Q " | " 802.1ad " } "
1115 - set the protocol used for VLAN filtering.
1116
1117 .BI vlan_default_pvid " VLAN_DEFAULT_PVID "
1118 - set the default PVID (native/untagged VLAN ID) for this bridge.
1119
1120 .BI vlan_stats_enabled " VLAN_STATS_ENABLED "
1121 - enable
1122 .RI ( VLAN_STATS_ENABLED " == 1) "
1123 or disable
1124 .RI ( VLAN_STATS_ENABLED " == 0) "
1125 per-VLAN stats accounting.
1126
1127 .BI mcast_snooping " MULTICAST_SNOOPING "
1128 - turn multicast snooping on
1129 .RI ( MULTICAST_SNOOPING " > 0) "
1130 or off
1131 .RI ( MULTICAST_SNOOPING " == 0). "
1132
1133 .BI mcast_router " MULTICAST_ROUTER "
1134 - set bridge's multicast router if IGMP snooping is enabled.
1135 .I MULTICAST_ROUTER
1136 is an integer value having the following meaning:
1137 .in +8
1138 .sp
1139 .B 0
1140 - disabled.
1141
1142 .B 1
1143 - automatic (queried).
1144
1145 .B 2
1146 - permanently enabled.
1147 .in -8
1148
1149 .BI mcast_query_use_ifaddr " MCAST_QUERY_USE_IFADDR "
1150 - whether to use the bridge's own IP address as source address for IGMP queries
1151 .RI ( MCAST_QUERY_USE_IFADDR " > 0) "
1152 or the default of 0.0.0.0
1153 .RI ( MCAST_QUERY_USE_IFADDR " == 0). "
1154
1155 .BI mcast_querier " MULTICAST_QUERIER "
1156 - enable
1157 .RI ( MULTICAST_QUERIER " > 0) "
1158 or disable
1159 .RI ( MULTICAST_QUERIER " == 0) "
1160 IGMP querier, ie sending of multicast queries by the bridge (default: disabled).
1161
1162 .BI mcast_querier_interval " QUERIER_INTERVAL "
1163 - interval between queries sent by other routers. if no queries are seen after this delay has passed, the bridge will start to send its own queries (as if
1164 .BI mcast_querier
1165 was enabled).
1166
1167 .BI mcast_hash_elasticity " HASH_ELASTICITY "
1168 - set multicast database hash elasticity, ie the maximum chain length in the multicast hash table (defaults to 4).
1169
1170 .BI mcast_hash_max " HASH_MAX "
1171 - set maximum size of multicast hash table (defaults to 512, value must be a power of 2).
1172
1173 .BI mcast_last_member_count " LAST_MEMBER_COUNT "
1174 - set multicast last member count, ie the number of queries the bridge will send before stopping forwarding a multicast group after a "leave" message has been received (defaults to 2).
1175
1176 .BI mcast_last_member_interval " LAST_MEMBER_INTERVAL "
1177 - interval between queries to find remaining members of a group, after a "leave" message is received.
1178
1179 .BI mcast_startup_query_count " STARTUP_QUERY_COUNT "
1180 - set the number of IGMP queries to send during startup phase (defaults to 2).
1181
1182 .BI mcast_startup_query_interval " STARTUP_QUERY_INTERVAL "
1183 - interval between queries in the startup phase.
1184
1185 .BI mcast_query_interval " QUERY_INTERVAL "
1186 - interval between queries sent by the bridge after the end of the startup phase.
1187
1188 .BI mcast_query_response_interval " QUERY_RESPONSE_INTERVAL "
1189 - set the Max Response Time/Maximum Response Delay for IGMP/MLD queries sent by the bridge.
1190
1191 .BI mcast_membership_interval " MEMBERSHIP_INTERVAL "
1192 - delay after which the bridge will leave a group, if no membership reports for this group are received.
1193
1194 .BI mcast_stats_enabled " MCAST_STATS_ENABLED "
1195 - enable
1196 .RI ( MCAST_STATS_ENABLED " > 0) "
1197 or disable
1198 .RI ( MCAST_STATS_ENABLED " == 0) "
1199 multicast (IGMP/MLD) stats accounting.
1200
1201 .BI mcast_igmp_version " IGMP_VERSION "
1202 - set the IGMP version.
1203
1204 .BI mcast_mld_version " MLD_VERSION "
1205 - set the MLD version.
1206
1207 .BI nf_call_iptables " NF_CALL_IPTABLES "
1208 - enable
1209 .RI ( NF_CALL_IPTABLES " > 0) "
1210 or disable
1211 .RI ( NF_CALL_IPTABLES " == 0) "
1212 iptables hooks on the bridge.
1213
1214 .BI nf_call_ip6tables " NF_CALL_IP6TABLES "
1215 - enable
1216 .RI ( NF_CALL_IP6TABLES " > 0) "
1217 or disable
1218 .RI ( NF_CALL_IP6TABLES " == 0) "
1219 ip6tables hooks on the bridge.
1220
1221 .BI nf_call_arptables " NF_CALL_ARPTABLES "
1222 - enable
1223 .RI ( NF_CALL_ARPTABLES " > 0) "
1224 or disable
1225 .RI ( NF_CALL_ARPTABLES " == 0) "
1226 arptables hooks on the bridge.
1227
1228
1229 .in-8
1230
1231 .TP
1232 MACsec Type Support
1233 For a link of type
1234 .I MACsec
1235 the following additional arguments are supported:
1236
1237 .BI "ip link add link " DEVICE " name " NAME " type macsec"
1238 [ [
1239 .BI address " <lladdr>"
1240 ]
1241 .BI port " PORT"
1242 |
1243 .BI sci " SCI"
1244 ] [
1245 .BI cipher " CIPHER_SUITE"
1246 ] [
1247 .BR icvlen " { "
1248 .IR 8..16 " } ] ["
1249 .BR encrypt " {"
1250 .BR on " | " off " } ] [ "
1251 .BR send_sci " { " on " | " off " } ] ["
1252 .BR end_station " { " on " | " off " } ] ["
1253 .BR scb " { " on " | " off " } ] ["
1254 .BR protect " { " on " | " off " } ] ["
1255 .BR replay " { " on " | " off " }"
1256 .BR window " { "
1257 .IR 0..2^32-1 " } ] ["
1258 .BR validate " { " strict " | " check " | " disabled " } ] ["
1259 .BR encodingsa " { "
1260 .IR 0..3 " } ]"
1261
1262 .in +8
1263 .sp
1264 .BI address " <lladdr> "
1265 - sets the system identifier component of secure channel for this MACsec device.
1266
1267 .sp
1268 .BI port " PORT "
1269 - sets the port number component of secure channel for this MACsec device, in a
1270 range from 1 to 65535 inclusive. Numbers with a leading " 0 " or " 0x " are
1271 interpreted as octal and hexadecimal, respectively.
1272
1273 .sp
1274 .BI sci " SCI "
1275 - sets the secure channel identifier for this MACsec device.
1276 .I SCI
1277 is a 64bit wide number in hexadecimal format.
1278
1279 .sp
1280 .BI cipher " CIPHER_SUITE "
1281 - defines the cipher suite to use.
1282
1283 .sp
1284 .BI icvlen " LENGTH "
1285 - sets the length of the Integrity Check Value (ICV).
1286
1287 .sp
1288 .BR "encrypt on " or " encrypt off"
1289 - switches between authenticated encryption, or authenticity mode only.
1290
1291 .sp
1292 .BR "send_sci on " or " send_sci off"
1293 - specifies whether the SCI is included in every packet, or only when it is necessary.
1294
1295 .sp
1296 .BR "end_station on " or " end_station off"
1297 - sets the End Station bit.
1298
1299 .sp
1300 .BR "scb on " or " scb off"
1301 - sets the Single Copy Broadcast bit.
1302
1303 .sp
1304 .BR "protect on " or " protect off"
1305 - enables MACsec protection on the device.
1306
1307 .sp
1308 .BR "replay on " or " replay off"
1309 - enables replay protection on the device.
1310
1311 .in +8
1312
1313 .sp
1314 .BI window " SIZE "
1315 - sets the size of the replay window.
1316
1317 .in -8
1318
1319 .sp
1320 .BR "validate strict " or " validate check " or " validate disabled"
1321 - sets the validation mode on the device.
1322
1323 .sp
1324 .BI encodingsa " AN "
1325 - sets the active secure association for transmission.
1326
1327 .in -8
1328
1329 .TP
1330 VRF Type Support
1331 For a link of type
1332 .I VRF
1333 the following additional arguments are supported:
1334
1335 .BI "ip link add " DEVICE " type vrf table " TABLE
1336
1337 .in +8
1338 .sp
1339 .BR table " table id associated with VRF device"
1340
1341 .in -8
1342
1343 .SS ip link delete - delete virtual link
1344
1345 .TP
1346 .BI dev " DEVICE "
1347 specifies the virtual device to act operate on.
1348
1349 .TP
1350 .BI group " GROUP "
1351 specifies the group of virtual links to delete. Group 0 is not allowed to be
1352 deleted since it is the default group.
1353
1354 .TP
1355 .BI type " TYPE "
1356 specifies the type of the device.
1357
1358 .SS ip link set - change device attributes
1359
1360 .PP
1361 .B Warning:
1362 If multiple parameter changes are requested,
1363 .B ip
1364 aborts immediately after any of the changes have failed.
1365 This is the only case when
1366 .B ip
1367 can move the system to an unpredictable state. The solution
1368 is to avoid changing several parameters with one
1369 .B ip link set
1370 call.
1371
1372 .TP
1373 .BI dev " DEVICE "
1374 .I DEVICE
1375 specifies network device to operate on. When configuring SR-IOV Virtual Function
1376 (VF) devices, this keyword should specify the associated Physical Function (PF)
1377 device.
1378
1379 .TP
1380 .BI group " GROUP "
1381 .I GROUP
1382 has a dual role: If both group and dev are present, then move the device to the
1383 specified group. If only a group is specified, then the command operates on
1384 all devices in that group.
1385
1386 .TP
1387 .BR up " and " down
1388 change the state of the device to
1389 .B UP
1390 or
1391 .BR "DOWN" .
1392
1393 .TP
1394 .BR "arp on " or " arp off"
1395 change the
1396 .B NOARP
1397 flag on the device.
1398
1399 .TP
1400 .BR "multicast on " or " multicast off"
1401 change the
1402 .B MULTICAST
1403 flag on the device.
1404
1405 .TP
1406 .BR "protodown on " or " protodown off"
1407 change the
1408 .B PROTODOWN
1409 state on the device. Indicates that a protocol error has been detected on the port. Switch drivers can react to this error by doing a phys down on the switch port.
1410
1411 .TP
1412 .BR "dynamic on " or " dynamic off"
1413 change the
1414 .B DYNAMIC
1415 flag on the device. Indicates that address can change when interface goes down (currently
1416 .B NOT
1417 used by the Linux).
1418
1419 .TP
1420 .BI name " NAME"
1421 change the name of the device. This operation is not
1422 recommended if the device is running or has some addresses
1423 already configured.
1424
1425 .TP
1426 .BI txqueuelen " NUMBER"
1427 .TP
1428 .BI txqlen " NUMBER"
1429 change the transmit queue length of the device.
1430
1431 .TP
1432 .BI mtu " NUMBER"
1433 change the
1434 .I MTU
1435 of the device.
1436
1437 .TP
1438 .BI address " LLADDRESS"
1439 change the station address of the interface.
1440
1441 .TP
1442 .BI broadcast " LLADDRESS"
1443 .TP
1444 .BI brd " LLADDRESS"
1445 .TP
1446 .BI peer " LLADDRESS"
1447 change the link layer broadcast address or the peer address when
1448 the interface is
1449 .IR "POINTOPOINT" .
1450
1451 .TP
1452 .BI netns " NETNSNAME " \fR| " PID"
1453 move the device to the network namespace associated with name
1454 .IR "NETNSNAME " or
1455 .RI process " PID".
1456
1457 Some devices are not allowed to change network namespace: loopback, bridge,
1458 ppp, wireless. These are network namespace local devices. In such case
1459 .B ip
1460 tool will return "Invalid argument" error. It is possible to find out if device is local
1461 to a single network namespace by checking
1462 .B netns-local
1463 flag in the output of the
1464 .BR ethtool ":"
1465
1466 .in +8
1467 .B ethtool -k
1468 .I DEVICE
1469 .in -8
1470
1471 To change network namespace for wireless devices the
1472 .B iw
1473 tool can be used. But it allows to change network namespace only for physical devices and by process
1474 .IR PID .
1475
1476 .TP
1477 .BI alias " NAME"
1478 give the device a symbolic name for easy reference.
1479
1480 .TP
1481 .BI group " GROUP"
1482 specify the group the device belongs to.
1483 The available groups are listed in file
1484 .BR "@SYSCONFDIR@/group" .
1485
1486 .TP
1487 .BI vf " NUM"
1488 specify a Virtual Function device to be configured. The associated PF device
1489 must be specified using the
1490 .B dev
1491 parameter.
1492
1493 .in +8
1494 .BI mac " LLADDRESS"
1495 - change the station address for the specified VF. The
1496 .B vf
1497 parameter must be specified.
1498
1499 .sp
1500 .BI vlan " VLANID"
1501 - change the assigned VLAN for the specified VF. When specified, all traffic
1502 sent from the VF will be tagged with the specified VLAN ID. Incoming traffic
1503 will be filtered for the specified VLAN ID, and will have all VLAN tags
1504 stripped before being passed to the VF. Setting this parameter to 0 disables
1505 VLAN tagging and filtering. The
1506 .B vf
1507 parameter must be specified.
1508
1509 .sp
1510 .BI qos " VLAN-QOS"
1511 - assign VLAN QOS (priority) bits for the VLAN tag. When specified, all VLAN
1512 tags transmitted by the VF will include the specified priority bits in the
1513 VLAN tag. If not specified, the value is assumed to be 0. Both the
1514 .B vf
1515 and
1516 .B vlan
1517 parameters must be specified. Setting both
1518 .B vlan
1519 and
1520 .B qos
1521 as 0 disables VLAN tagging and filtering for the VF.
1522
1523 .sp
1524 .BI proto " VLAN-PROTO"
1525 - assign VLAN PROTOCOL for the VLAN tag, either 802.1Q or 802.1ad.
1526 Setting to 802.1ad, all traffic sent from the VF will be tagged with VLAN S-Tag.
1527 Incoming traffic will have VLAN S-Tags stripped before being passed to the VF.
1528 Setting to 802.1ad also enables an option to concatenate another VLAN tag, so both
1529 S-TAG and C-TAG will be inserted/stripped for outgoing/incoming traffic, respectively.
1530 If not specified, the value is assumed to be 802.1Q. Both the
1531 .B vf
1532 and
1533 .B vlan
1534 parameters must be specified.
1535
1536 .sp
1537 .BI rate " TXRATE"
1538 -- change the allowed transmit bandwidth, in Mbps, for the specified VF.
1539 Setting this parameter to 0 disables rate limiting.
1540 .B vf
1541 parameter must be specified.
1542 Please use new API
1543 .B "max_tx_rate"
1544 option instead.
1545
1546 .sp
1547 .BI max_tx_rate " TXRATE"
1548 - change the allowed maximum transmit bandwidth, in Mbps, for the specified VF.
1549 .B vf
1550 parameter must be specified.
1551
1552 .sp
1553 .BI min_tx_rate " TXRATE"
1554 - change the allowed minimum transmit bandwidth, in Mbps, for the specified VF.
1555 Minimum TXRATE should be always <= Maximum TXRATE.
1556 .B vf
1557 parameter must be specified.
1558
1559 .sp
1560 .BI spoofchk " on|off"
1561 - turn packet spoof checking on or off for the specified VF.
1562 .sp
1563 .BI query_rss " on|off"
1564 - toggle the ability of querying the RSS configuration of a specific VF. VF RSS information like RSS hash key may be considered sensitive on some devices where this information is shared between VF and PF and thus its querying may be prohibited by default.
1565 .sp
1566 .BI state " auto|enable|disable"
1567 - set the virtual link state as seen by the specified VF. Setting to auto means a
1568 reflection of the PF link state, enable lets the VF to communicate with other VFs on
1569 this host even if the PF link state is down, disable causes the HW to drop any packets
1570 sent by the VF.
1571 .sp
1572 .BI trust " on|off"
1573 - trust the specified VF user. This enables that VF user can set a specific feature
1574 which may impact security and/or performance. (e.g. VF multicast promiscuous mode)
1575 .sp
1576 .BI node_guid " eui64"
1577 - configure node GUID for Infiniband VFs.
1578 .sp
1579 .BI port_guid " eui64"
1580 - configure port GUID for Infiniband VFs.
1581 .in -8
1582
1583 .TP
1584 .B xdp object "|" pinned "|" off
1585 set (or unset) a XDP ("eXpress Data Path") BPF program to run on every
1586 packet at driver level.
1587 .B ip link
1588 output will indicate a
1589 .B xdp
1590 flag for the networking device. If the driver does not have native XDP
1591 support, the kernel will fall back to a slower, driver-independent "generic"
1592 XDP variant. The
1593 .B ip link
1594 output will in that case indicate
1595 .B xdpgeneric
1596 instead of
1597 .B xdp
1598 only. If the driver does have native XDP support, but the program is
1599 loaded under
1600 .B xdpgeneric object "|" pinned
1601 then the kernel will use the generic XDP variant instead of the native one.
1602 .B xdpdrv
1603 has the opposite effect of requestsing that the automatic fallback to the
1604 generic XDP variant be disabled and in case driver is not XDP-capable error
1605 should be returned.
1606 .B xdpdrv
1607 also disables hardware offloads.
1608 .B xdpoffload
1609 in ip link output indicates that the program has been offloaded to hardware
1610 and can also be used to request the "offload" mode, much like
1611 .B xdpgeneric
1612 it forces program to be installed specifically in HW/FW of the apater.
1613
1614 .B off
1615 (or
1616 .B none
1617 )
1618 - Detaches any currently attached XDP/BPF program from the given device.
1619
1620 .BI object " FILE "
1621 - Attaches a XDP/BPF program to the given device. The
1622 .I FILE
1623 points to a BPF ELF file (f.e. generated by LLVM) that contains the BPF
1624 program code, map specifications, etc. If a XDP/BPF program is already
1625 attached to the given device, an error will be thrown. If no XDP/BPF
1626 program is currently attached, the device supports XDP and the program
1627 from the BPF ELF file passes the kernel verifier, then it will be attached
1628 to the device. If the option
1629 .I -force
1630 is passed to
1631 .B ip
1632 then any prior attached XDP/BPF program will be atomically overridden and
1633 no error will be thrown in this case. If no
1634 .B section
1635 option is passed, then the default section name ("prog") will be assumed,
1636 otherwise the provided section name will be used. If no
1637 .B verbose
1638 option is passed, then a verifier log will only be dumped on load error.
1639 See also
1640 .B EXAMPLES
1641 section for usage examples.
1642
1643 .BI section " NAME "
1644 - Specifies a section name that contains the BPF program code. If no section
1645 name is specified, the default one ("prog") will be used. This option is
1646 to be passed with the
1647 .B object
1648 option.
1649
1650 .BI verbose
1651 - Act in verbose mode. For example, even in case of success, this will
1652 print the verifier log in case a program was loaded from a BPF ELF file.
1653
1654 .BI pinned " FILE "
1655 - Attaches a XDP/BPF program to the given device. The
1656 .I FILE
1657 points to an already pinned BPF program in the BPF file system. The option
1658 .B section
1659 doesn't apply here, but otherwise semantics are the same as with the option
1660 .B object
1661 described already.
1662
1663 .TP
1664 .BI master " DEVICE"
1665 set master device of the device (enslave device).
1666
1667 .TP
1668 .BI nomaster
1669 unset master device of the device (release device).
1670
1671 .TP
1672 .BI addrgenmode " eui64|none|stable_secret|random"
1673 set the IPv6 address generation mode
1674
1675 .I eui64
1676 - use a Modified EUI-64 format interface identifier
1677
1678 .I none
1679 - disable automatic address generation
1680
1681 .I stable_secret
1682 - generate the interface identifier based on a preset /proc/sys/net/ipv6/conf/{default,DEVICE}/stable_secret
1683
1684 .I random
1685 - like stable_secret, but auto-generate a new random secret if none is set
1686
1687 .TP
1688 .BR "link-netnsid "
1689 set peer netnsid for a cross-netns interface
1690
1691 .TP
1692 .BI type " ETYPE TYPE_ARGS"
1693 Change type-specific settings. For a list of supported types and arguments refer
1694 to the description of
1695 .B "ip link add"
1696 above. In addition to that, it is possible to manipulate settings to slave
1697 devices:
1698
1699 .TP
1700 Bridge Slave Support
1701 For a link with master
1702 .B bridge
1703 the following additional arguments are supported:
1704
1705 .B "ip link set type bridge_slave"
1706 [
1707 .B fdb_flush
1708 ] [
1709 .BI state " STATE"
1710 ] [
1711 .BI priority " PRIO"
1712 ] [
1713 .BI cost " COST"
1714 ] [
1715 .BR guard " { " on " | " off " }"
1716 ] [
1717 .BR hairpin " { " on " | " off " }"
1718 ] [
1719 .BR fastleave " { " on " | " off " }"
1720 ] [
1721 .BR root_block " { " on " | " off " }"
1722 ] [
1723 .BR learning " { " on " | " off " }"
1724 ] [
1725 .BR flood " { " on " | " off " }"
1726 ] [
1727 .BR proxy_arp " { " on " | " off " }"
1728 ] [
1729 .BR proxy_arp_wifi " { " on " | " off " }"
1730 ] [
1731 .BI mcast_router " MULTICAST_ROUTER"
1732 ] [
1733 .BR mcast_fast_leave " { " on " | " off "}"
1734 ] [
1735 .BR mcast_flood " { " on " | " off " } ]"
1736
1737 .in +8
1738 .sp
1739 .B fdb_flush
1740 - flush bridge slave's fdb dynamic entries.
1741
1742 .BI state " STATE"
1743 - Set port state.
1744 .I STATE
1745 is a number representing the following states:
1746 .BR 0 " (disabled),"
1747 .BR 1 " (listening),"
1748 .BR 2 " (learning),"
1749 .BR 3 " (forwarding),"
1750 .BR 4 " (blocking)."
1751
1752 .BI priority " PRIO"
1753 - set port priority (allowed values are between 0 and 63, inclusively).
1754
1755 .BI cost " COST"
1756 - set port cost (allowed values are between 1 and 65535, inclusively).
1757
1758 .BR guard " { " on " | " off " }"
1759 - block incoming BPDU packets on this port.
1760
1761 .BR hairpin " { " on " | " off " }"
1762 - enable hairpin mode on this port. This will allow incoming packets on this
1763 port to be reflected back.
1764
1765 .BR fastleave " { " on " | " off " }"
1766 - enable multicast fast leave on this port.
1767
1768 .BR root_block " { " on " | " off " }"
1769 - block this port from becoming the bridge's root port.
1770
1771 .BR learning " { " on " | " off " }"
1772 - allow MAC address learning on this port.
1773
1774 .BR flood " { " on " | " off " }"
1775 - open the flood gates on this port, i.e. forward all unicast frames to this
1776 port also. Requires
1777 .BR proxy_arp " and " proxy_arp_wifi
1778 to be turned off.
1779
1780 .BR proxy_arp " { " on " | " off " }"
1781 - enable proxy ARP on this port.
1782
1783 .BR proxy_arp_wifi " { " on " | " off " }"
1784 - enable proxy ARP on this port which meets extended requirements by IEEE
1785 802.11 and Hotspot 2.0 specifications.
1786
1787 .BI mcast_router " MULTICAST_ROUTER"
1788 - configure this port for having multicast routers attached. A port with a
1789 multicast router will receive all multicast traffic.
1790 .I MULTICAST_ROUTER
1791 may be either
1792 .B 0
1793 to disable multicast routers on this port,
1794 .B 1
1795 to let the system detect the presence of of routers (this is the default),
1796 .B 2
1797 to permanently enable multicast traffic forwarding on this port or
1798 .B 3
1799 to enable multicast routers temporarily on this port, not depending on incoming
1800 queries.
1801
1802 .BR mcast_fast_leave " { " on " | " off " }"
1803 - this is a synonym to the
1804 .B fastleave
1805 option above.
1806
1807 .BR mcast_flood " { " on " | " off " }"
1808 - controls whether a given port will be flooded with multicast traffic for which there is no MDB entry.
1809
1810 .in -8
1811
1812 .TP
1813 Bonding Slave Support
1814 For a link with master
1815 .B bond
1816 the following additional arguments are supported:
1817
1818 .B "ip link set type bond_slave"
1819 [
1820 .BI queue_id " ID"
1821 ]
1822
1823 .in +8
1824 .sp
1825 .BI queue_id " ID"
1826 - set the slave's queue ID (a 16bit unsigned value).
1827
1828 .in -8
1829
1830 .TP
1831 MACVLAN and MACVTAP Support
1832 Modify list of allowed macaddr for link in source mode.
1833
1834 .B "ip link set type { macvlan | macvap } "
1835 [
1836 .BI macaddr " " "" COMMAND " " MACADDR " ..."
1837 ]
1838
1839 Commands:
1840 .in +8
1841 .B add
1842 - add MACADDR to allowed list
1843 .sp
1844 .B set
1845 - replace allowed list
1846 .sp
1847 .B del
1848 - remove MACADDR from allowed list
1849 .sp
1850 .B flush
1851 - flush whole allowed list
1852 .sp
1853 .in -8
1854
1855
1856 .SS  ip link show - display device attributes
1857
1858 .TP
1859 .BI dev " NAME " (default)
1860 .I NAME
1861 specifies the network device to show.
1862 If this argument is omitted all devices in the default group are listed.
1863
1864 .TP
1865 .BI group " GROUP "
1866 .I GROUP
1867 specifies what group of devices to show.
1868
1869 .TP
1870 .B up
1871 only display running interfaces.
1872
1873 .TP
1874 .BI master " DEVICE "
1875 .I DEVICE
1876 specifies the master device which enslaves devices to show.
1877
1878 .TP
1879 .BI vrf " NAME "
1880 .I NAME
1881 speficies the VRF which enslaves devices to show.
1882
1883 .TP
1884 .BI type " TYPE "
1885 .I TYPE
1886 specifies the type of devices to show.
1887
1888 Note that the type name is not checked against the list of supported types -
1889 instead it is sent as-is to the kernel. Later it is used to filter the returned
1890 interface list by comparing it with the relevant attribute in case the kernel
1891 didn't filter already. Therefore any string is accepted, but may lead to empty
1892 output.
1893
1894 .SS  ip link xstats - display extended statistics
1895
1896 .TP
1897 .BI type " TYPE "
1898 .I TYPE
1899 specifies the type of devices to display extended statistics for.
1900
1901 .SS  ip link afstats - display address-family specific statistics
1902
1903 .TP
1904 .BI dev " DEVICE "
1905 .I DEVICE
1906 specifies the device to display address-family statistics for.
1907
1908 .SS  ip link help - display help
1909
1910 .PP
1911 .I "TYPE"
1912 specifies which help of link type to dislpay.
1913
1914 .SS
1915 .I GROUP
1916 may be a number or a string from the file
1917 .B @SYSCONFDIR@/group
1918 which can be manually filled.
1919
1920 .SH "EXAMPLES"
1921 .PP
1922 ip link show
1923 .RS 4
1924 Shows the state of all network interfaces on the system.
1925 .RE
1926 .PP
1927 ip link show type bridge
1928 .RS 4
1929 Shows the bridge devices.
1930 .RE
1931 .PP
1932 ip link show type vlan
1933 .RS 4
1934 Shows the vlan devices.
1935 .RE
1936 .PP
1937 ip link show master br0
1938 .RS 4
1939 Shows devices enslaved by br0
1940 .RE
1941 .PP
1942 ip link set dev ppp0 mtu 1400
1943 .RS 4
1944 Change the MTU the ppp0 device.
1945 .RE
1946 .PP
1947 ip link add link eth0 name eth0.10 type vlan id 10
1948 .RS 4
1949 Creates a new vlan device eth0.10 on device eth0.
1950 .RE
1951 .PP
1952 ip link delete dev eth0.10
1953 .RS 4
1954 Removes vlan device.
1955 .RE
1956
1957 ip link help gre
1958 .RS 4
1959 Display help for the gre link type.
1960 .RE
1961 .PP
1962 ip link add name tun1 type ipip remote 192.168.1.1
1963 local 192.168.1.2 ttl 225 encap gue encap-sport auto
1964 encap-dport 5555 encap-csum encap-remcsum
1965 .RS 4
1966 Creates an IPIP that is encapsulated with Generic UDP Encapsulation,
1967 and the outer UDP checksum and remote checksum offload are enabled.
1968 .RE
1969 .PP
1970 ip link set dev eth0 xdp obj prog.o
1971 .RS 4
1972 Attaches a XDP/BPF program to device eth0, where the program is
1973 located in prog.o, section "prog" (default section). In case a
1974 XDP/BPF program is already attached, throw an error.
1975 .RE
1976 .PP
1977 ip -force link set dev eth0 xdp obj prog.o sec foo
1978 .RS 4
1979 Attaches a XDP/BPF program to device eth0, where the program is
1980 located in prog.o, section "foo". In case a XDP/BPF program is
1981 already attached, it will be overridden by the new one.
1982 .RE
1983 .PP
1984 ip -force link set dev eth0 xdp pinned /sys/fs/bpf/foo
1985 .RS 4
1986 Attaches a XDP/BPF program to device eth0, where the program was
1987 previously pinned as an object node into BPF file system under
1988 name foo.
1989 .RE
1990 .PP
1991 ip link set dev eth0 xdp off
1992 .RS 4
1993 If a XDP/BPF program is attached on device eth0, detach it and
1994 effectively turn off XDP for device eth0.
1995 .RE
1996 .PP
1997 ip link add link wpan0 lowpan0 type lowpan
1998 .RS 4
1999 Creates a 6LoWPAN interface named lowpan0 on the underlying
2000 IEEE 802.15.4 device wpan0.
2001 .RE
2002
2003 .SH SEE ALSO
2004 .br
2005 .BR ip (8),
2006 .BR ip-netns (8),
2007 .BR ethtool (8),
2008 .BR iptables (8)
2009
2010 .SH AUTHOR
2011 Original Manpage by Michail Litvak <mci@owl.openwall.com>