man/man8/ip.8

   1 .TH IP 8 "17 January 2002" "iproute2" "Linux"
   2 .SH NAME
   3 ip \- show / manipulate routing, devices, policy routing and tunnels
   4 .SH SYNOPSIS
   5
   6 .ad l
   7 .in +8
   8 .ti -8
   9 .B ip
  10 .RI "[ " OPTIONS " ] " OBJECT " { " COMMAND " | "
  11 .BR help " }"
  12 .sp
  13
  14 .ti -8
  15 .IR OBJECT " := { "
  16 .BR link " | " addr " | " addrlabel " | " route " | " rule " | " neigh " | "\
  17  tunnel " | " maddr " | "  mroute " | " monitor " }"
  18 .sp
  19
  20 .ti -8
  21 .IR OPTIONS " := { "
  22 \fB\-V\fR[\fIersion\fR] |
  23 \fB\-s\fR[\fItatistics\fR] |
  24 \fB\-r\fR[\fIesolve\fR] |
  25 \fB\-f\fR[\fIamily\fR] {
  26 .BR inet " | " inet6 " | " ipx " | " dnet " | " link " } | "
  27 \fB\-o\fR[\fIneline\fR] }
  28
  29 .ti -8
  30 .BI "ip link add link " DEVICE
  31 .RB "[ " name " ]"
  32 .I NAME
  33 .br
  34 .RB "[ " txqueuelen
  35 .IR PACKETS " ]"
  36 .br
  37 .RB "[ " address
  38 .IR LLADDR " ]"
  39 .RB "[ " broadcast
  40 .IR LLADDR " ]"
  41 .br
  42 .RB "[ " mtu
  43 .IR MTU " ]"
  44 .br
  45 .BR type TYPE
  46 .RI "[ " ARGS " ]"
  47
  48 .ti -8
  49 .IR TYPE " := [ "
  50 .BR vlan " | " maclan " | " can " ]"
  51
  52 .ti -8
  53 .BI "ip link delete " DEVICE
  54 .BI type TYPE
  55 .RI "[ " ARGS " ]"
  56
  57 .ti -8
  58 .BI "ip link set " DEVICE
  59 .RB "{ " up " | " down " | " arp " { " on " | " off " } |"
  60 .br
  61 .BR promisc " { " on " | " off " } |"
  62 .br
  63 .BR allmulticast " { " on " | " off " } |"
  64 .br
  65 .BR dynamic " { " on " | " off " } |"
  66 .br
  67 .BR multicast " { " on " | " off " } |"
  68 .br
  69 .B  txqueuelen
  70 .IR PACKETS " |"
  71 .br
  72 .B  name
  73 .IR NEWNAME " |"
  74 .br
  75 .B  address
  76 .IR LLADDR " |"
  77 .B  broadcast
  78 .IR LLADDR " |"
  79 .br
  80 .B  mtu
  81 .IR MTU " |"
  82 .br
  83 .B  netns
  84 .IR PID " |"
  85 .br
  86 .B alias
  87 .IR NAME  " |"
  88 .br
  89 .B vf
  90 .IR NUM " ["
  91 .B  mac
  92 .IR LLADDR " ] ["
  93 .B vlan
  94 .IR VLANID " [ "
  95 .B qos
  96 .IR VLAN-QOS " ] ] ["
  97 .B rate
  98 .IR TXRATE " ]"
  99
 100 .ti -8
 101 .B ip link show
 102 .RI "[ " DEVICE " ]"
 103
 104 .ti -8
 105 .BR "ip addr" " { " add " | " del " } "
 106 .IB IFADDR " dev " STRING
 107
 108 .ti -8
 109 .BR "ip addr" " { " show " | " flush " } [ " dev
 110 .IR STRING " ] [ "
 111 .B  scope
 112 .IR SCOPE-ID " ] [ "
 113 .B  to
 114 .IR PREFIX " ] [ " FLAG-LIST " ] [ "
 115 .B  label
 116 .IR PATTERN " ]"
 117
 118 .ti -8
 119 .IR IFADDR " := " PREFIX " | " ADDR
 120 .B  peer
 121 .IR PREFIX " [ "
 122 .B  broadcast
 123 .IR ADDR " ] [ "
 124 .B  anycast
 125 .IR ADDR " ] [ "
 126 .B  label
 127 .IR STRING " ] [ "
 128 .B  scope
 129 .IR SCOPE-ID " ]"
 130
 131 .ti -8
 132 .IR SCOPE-ID " := "
 133 .RB "[ " host " | " link " | " global " | "
 134 .IR NUMBER " ]"
 135
 136 .ti -8
 137 .IR FLAG-LIST " := [ "  FLAG-LIST " ] " FLAG
 138
 139 .ti -8
 140 .IR FLAG " := "
 141 .RB "[ " permanent " | " dynamic " | " secondary " | " primary " | "\
 142 tentative " | " deprecated " | " dadfailed " | " temporary " ]"
 143
 144 .ti -8
 145 .BR "ip addrlabel" " { " add " | " del " } " prefix
 146 .BR PREFIX " [ "
 147 .B dev
 148 .IR DEV " ] [ "
 149 .B label
 150 .IR NUMBER " ]"
 151
 152 .ti -8
 153 .BR "ip addrlabel" " { " list " | " flush " }"
 154
 155 .ti -8
 156 .BR "ip route" " { "
 157 .BR list " | " flush " } "
 158 .I  SELECTOR
 159
 160 .ti -8
 161 .B  ip route get
 162 .IR ADDRESS " [ "
 163 .BI from " ADDRESS " iif " STRING"
 164 .RB " ] [ " oif
 165 .IR STRING " ] [ "
 166 .B  tos
 167 .IR TOS " ]"
 168
 169 .ti -8
 170 .BR "ip route" " { " add " | " del " | " change " | " append " | "\
 171 replace " | " monitor " } "
 172 .I  ROUTE
 173
 174 .ti -8
 175 .IR SELECTOR " := "
 176 .RB "[ " root
 177 .IR PREFIX " ] [ "
 178 .B  match
 179 .IR PREFIX " ] [ "
 180 .B  exact
 181 .IR PREFIX " ] [ "
 182 .B  table
 183 .IR TABLE_ID " ] [ "
 184 .B  proto
 185 .IR RTPROTO " ] [ "
 186 .B  type
 187 .IR TYPE " ] [ "
 188 .B  scope
 189 .IR SCOPE " ]"
 190
 191 .ti -8
 192 .IR ROUTE " := " NODE_SPEC " [ " INFO_SPEC " ]"
 193
 194 .ti -8
 195 .IR NODE_SPEC " := [ " TYPE " ] " PREFIX " ["
 196 .B  tos
 197 .IR TOS " ] [ "
 198 .B  table
 199 .IR TABLE_ID " ] [ "
 200 .B  proto
 201 .IR RTPROTO " ] [ "
 202 .B  scope
 203 .IR SCOPE " ] [ "
 204 .B  metric
 205 .IR METRIC " ]"
 206
 207 .ti -8
 208 .IR INFO_SPEC " := " "NH OPTIONS FLAGS" " ["
 209 .B  nexthop
 210 .IR NH " ] ..."
 211
 212 .ti -8
 213 .IR NH " := [ "
 214 .B  via
 215 .IR ADDRESS " ] [ "
 216 .B  dev
 217 .IR STRING " ] [ "
 218 .B  weight
 219 .IR NUMBER " ] " NHFLAGS
 220
 221 .ti -8
 222 .IR OPTIONS " := " FLAGS " [ "
 223 .B  mtu
 224 .IR NUMBER " ] [ "
 225 .B  advmss
 226 .IR NUMBER " ] [ "
 227 .B  rtt
 228 .IR TIME " ] [ "
 229 .B  rttvar
 230 .IR TIME " ] [ "
 231 .B  window
 232 .IR NUMBER " ] [ "
 233 .B  cwnd
 234 .IR NUMBER " ] [ "
 235 .B  ssthresh
 236 .IR REALM " ] [ "
 237 .B  realms
 238 .IR REALM " ] [ "
 239 .B  rto_min
 240 .IR TIME " ]"
 241
 242 .ti -8
 243 .IR TYPE " := [ "
 244 .BR unicast " | " local " | " broadcast " | " multicast " | "\
 245 throw " | " unreachable " | " prohibit " | " blackhole " | " nat " ]"
 246
 247 .ti -8
 248 .IR TABLE_ID " := [ "
 249 .BR local "| " main " | " default " | " all " |"
 250 .IR NUMBER " ]"
 251
 252 .ti -8
 253 .IR SCOPE " := [ "
 254 .BR host " | " link " | " global " |"
 255 .IR NUMBER " ]"
 256
 257 .ti -8
 258 .IR NHFLAGS " := [ "
 259 .BR onlink " | " pervasive " ]"
 260
 261 .ti -8
 262 .IR RTPROTO " := [ "
 263 .BR kernel " | " boot " | " static " |"
 264 .IR NUMBER " ]"
 265
 266 .ti -8
 267 .B  ip rule
 268 .RB " [ " list " | " add " | " del " | " flush " ]"
 269 .I  SELECTOR ACTION
 270
 271 .ti -8
 272 .IR SELECTOR " := [ "
 273 .B  from
 274 .IR PREFIX " ] [ "
 275 .B  to
 276 .IR PREFIX " ] [ "
 277 .B  tos
 278 .IR TOS " ] [ "
 279 .B  fwmark
 280 .IR FWMARK[/MASK] " ] [ "
 281 .B  iif
 282 .IR STRING " ] [ "
 283 .B  oif
 284 .IR STRING " ] [ "
 285 .B  pref
 286 .IR NUMBER " ]"
 287
 288 .ti -8
 289 .IR ACTION " := [ "
 290 .B  table
 291 .IR TABLE_ID " ] [ "
 292 .B  nat
 293 .IR ADDRESS " ] [ "
 294 .BR prohibit " | " reject " | " unreachable " ] [ " realms
 295 .RI "[" SRCREALM "/]" DSTREALM " ]"
 296
 297 .ti -8
 298 .IR TABLE_ID " := [ "
 299 .BR local " | " main " | " default " |"
 300 .IR NUMBER " ]"
 301
 302 .ti -8
 303 .BR "ip neigh" " { " add " | " del " | " change " | " replace " } { "
 304 .IR ADDR " [ "
 305 .B  lladdr
 306 .IR LLADDR " ] [ "
 307 .BR nud " { " permanent " | " noarp " | " stale " | " reachable " } ] | " proxy
 308 .IR ADDR " } [ "
 309 .B  dev
 310 .IR DEV " ]"
 311
 312 .ti -8
 313 .BR "ip neigh" " { " show " | " flush " } [ " to
 314 .IR PREFIX " ] [ "
 315 .B  dev
 316 .IR DEV " ] [ "
 317 .B  nud
 318 .IR STATE " ]"
 319
 320 .ti -8
 321 .BR "ip tunnel" " { " add " | " change " | " del " | " show " | " prl " }"
 322 .RI "[ " NAME " ]"
 323 .br
 324 .RB "[ " mode
 325 .IR MODE " ] [ "
 326 .B remote
 327 .IR ADDR " ] [ "
 328 .B  local
 329 .IR ADDR " ]"
 330 .br
 331 .RB "[ [" i "|" o "]" seq " ] [ [" i "|" o "]" key
 332 .IR KEY " ] [ "
 333 .RB "[" i "|" o "]" csum " ] ]"
 334 .br
 335 .RB "[ " encaplimit
 336 .IR ELIM " ]"
 337 .RB "[ " ttl
 338 .IR TTL " ]"
 339 .br
 340 .RB "[ " tos
 341 .IR TOS " ] [ "
 342 .B flowlabel
 343 .IR FLOWLABEL " ]"
 344 .br
 345 .RB "[ " prl-default
 346 .IR ADDR " ] [ "
 347 .B prl-nodefault
 348 .IR ADDR " ] [ "
 349 .B prl-delete
 350 .IR ADDR " ]"
 351 .br
 352 .RB "[ [" no "]" pmtudisc " ]"
 353 .RB "[ " dev
 354 .IR PHYS_DEV " ]"
 355 .RB "[ " "dscp inherit" " ]"
 356
 357 .ti -8
 358 .IR MODE " := "
 359 .RB " { " ipip " | " gre " | " sit " | " isatap " | " ip6ip6 " | " ipip6 " | " any " }"
 360
 361 .ti -8
 362 .IR ADDR " := { " IP_ADDRESS " |"
 363 .BR any " }"
 364
 365 .ti -8
 366 .IR TOS " := { " NUMBER " |"
 367 .BR inherit " }"
 368
 369 .ti -8
 370 .IR ELIM " := {
 371 .BR none " | "
 372 .IR 0 ".." 255 " }"
 373
 374 .ti -8
 375 .ti -8
 376 .IR TTL " := { " 1 ".." 255 " | "
 377 .BR inherit " }"
 378
 379 .ti -8
 380 .IR KEY " := { " DOTTED_QUAD " | " NUMBER " }"
 381
 382 .ti -8
 383 .IR TIME " := " NUMBER "[s|ms|us|ns|j]"
 384
 385 .ti -8
 386 .BR "ip maddr" " [ " add " | " del " ]"
 387 .IB MULTIADDR " dev " STRING
 388
 389 .ti -8
 390 .BR "ip maddr show" " [ " dev
 391 .IR STRING " ]"
 392
 393 .ti -8
 394 .BR "ip mroute show" " ["
 395 .IR PREFIX " ] [ "
 396 .B  from
 397 .IR PREFIX " ] [ "
 398 .B  iif
 399 .IR DEVICE " ]"
 400
 401 .ti -8
 402 .BR "ip monitor" " [ " all " |"
 403 .IR LISTofOBJECTS " ]"
 404
 405 .ti -8
 406 .BR "ip xfrm"
 407 .IR XFRM_OBJECT " { " COMMAND " }"
 408
 409 .ti -8
 410 .IR XFRM_OBJECT " := { " state " | " policy " | " monitor " } "
 411
 412 .ti -8
 413 .BR "ip xfrm state " { " add " | " update " } "
 414 .IR ID " [ "
 415 .IR XFRM_OPT " ] "
 416 .RB " [ " mode
 417 .IR MODE " ] "
 418 .br
 419 .RB " [ " reqid
 420 .IR REQID " ] "
 421 .RB " [ " seq
 422 .IR SEQ " ] "
 423 .RB " [ " replay-window
 424 .IR SIZE " ] "
 425 .br
 426 .RB " [ " flag
 427 .IR FLAG-LIST " ] "
 428 .RB " [ " encap
 429 .IR ENCAP " ] "
 430 .RB " [ " sel
 431 .IR SELECTOR " ] "
 432 .br
 433 .RB " [ "
 434 .IR LIMIT-LIST " ] "
 435
 436 .ti -8
 437 .BR "ip xfrm state allocspi "
 438 .IR ID
 439 .RB " [ " mode
 440 .IR MODE " ] "
 441 .RB " [ " reqid
 442 .IR REQID " ] "
 443 .RB " [ " seq
 444 .IR SEQ " ] "
 445 .RB " [ " min
 446 .IR SPI
 447 .B max
 448 .IR SPI " ] "
 449
 450 .ti -8
 451 .BR "ip xfrm state" " { " delete " | " get " } "
 452 .IR ID
 453
 454 .ti -8
 455 .BR "ip xfrm state" " { " deleteall " | " list " } [ "
 456 .IR ID " ] "
 457 .RB " [ " mode
 458 .IR MODE " ] "
 459 .br
 460 .RB " [ " reqid
 461 .IR REQID " ] "
 462 .RB " [ " flag
 463 .IR FLAG_LIST " ] "
 464
 465 .ti -8
 466 .BR "ip xfrm state flush" " [ " proto
 467 .IR XFRM_PROTO " ] "
 468
 469 .ti -8
 470 .BR "ip xfrm state count"
 471
 472 .ti -8
 473 .IR ID " := "
 474 .RB " [ " src
 475 .IR ADDR " ] "
 476 .RB " [ " dst
 477 .IR ADDR " ] "
 478 .RB " [ " proto
 479 .IR XFRM_PROTO " ] "
 480 .RB " [ " spi
 481 .IR SPI " ] "
 482
 483 .ti -8
 484 .IR XFRM_PROTO " := "
 485 .RB " [ " esp " | " ah " | " comp " | " route2 " | " hao " ] "
 486
 487 .ti -8
 488 .IR MODE " := "
 489 .RB " [ " transport " | " tunnel " | " ro " | " beet " ] "
 490 .B (default=transport)
 491
 492 .ti -8
 493 .IR FLAG-LIST " := "
 494 .RI " [ " FLAG-LIST " ] " FLAG
 495
 496 .ti -8
 497 .IR FLAG " := "
 498 .RB " [ " noecn " | " decap-dscp " | " wildrecv " ] "
 499
 500 .ti -8
 501 .IR ENCAP " := " ENCAP-TYPE " " SPORT " " DPORT " " OADDR
 502
 503 .ti -8
 504 .IR ENCAP-TYPE " := "
 505 .B espinudp
 506 .RB " | "
 507 .B espinudp-nonike
 508
 509 .ti -8
 510 .IR ALGO-LIST " := [ "
 511 .IR ALGO-LIST " ] | [ "
 512 .IR ALGO " ] "
 513
 514 .ti -8
 515 .IR ALGO " := "
 516 .IR ALGO_TYPE
 517 .IR ALGO_NAME
 518 .IR ALGO_KEY
 519
 520 .ti -8
 521 .IR ALGO_TYPE " := "
 522 .RB " [ " enc " | " auth " | " comp " ] "
 523
 524 .ti -8
 525 .IR SELECTOR " := "
 526 .B src
 527 .IR ADDR "[/" PLEN "]"
 528 .B dst
 529 .IR ADDR "[/" PLEN "]"
 530 .RI " [ " UPSPEC " ] "
 531 .RB " [ " dev
 532 .IR DEV " ] "
 533
 534 .ti -8
 535 .IR UPSPEC " := "
 536 .B proto
 537 .IR PROTO " [[ "
 538 .B sport
 539 .IR PORT " ] "
 540 .RB " [ " dport
 541 .IR PORT " ] | "
 542 .br
 543 .RB " [ " type
 544 .IR NUMBER " ] "
 545 .RB " [ " code
 546 .IR NUMBER " ]] "
 547
 548 .ti -8
 549 .IR LIMIT-LIST " := [ " LIMIT-LIST " ] |"
 550 .RB " [ "limit
 551 .IR LIMIT " ] "
 552
 553 .ti -8
 554 .IR LIMIT " := "
 555 .RB " [ [" time-soft "|" time-hard "|" time-use-soft "|" time-use-hard "]"
 556 .IR SECONDS " ] | "
 557 .RB "[ ["byte-soft "|" byte-hard "]"
 558 .IR SIZE " ] | "
 559 .br
 560 .RB " [ ["packet-soft "|" packet-hard "]"
 561 .IR COUNT " ] "
 562
 563 .ti -8
 564 .BR "ip xfrm policy" " { " add " | " update " } " " dir "
 565 .IR DIR
 566 .IR SELECTOR " [ "
 567 .BR index
 568 .IR INDEX " ] "
 569 .br
 570 .RB " [ " ptype
 571 .IR PTYPE " ] "
 572 .RB " [ " action
 573 .IR ACTION " ] "
 574 .RB " [ " priority
 575 .IR PRIORITY " ] "
 576 .br
 577 .RI " [ " LIMIT-LIST " ] [ "
 578 .IR TMPL-LIST " ] "
 579
 580 .ti -8
 581 .BR "ip xfrm policy" " { " delete " | " get " } " " dir "
 582 .IR DIR " [ " SELECTOR " | "
 583 .BR index
 584 .IR INDEX
 585 .RB " ] "
 586 .br
 587 .RB " [ " ptype
 588 .IR PTYPE " ] "
 589
 590 .ti -8
 591 .BR "ip xfrm policy" " { " deleteall " | " list " } "
 592 .RB " [ " dir
 593 .IR DIR " ] [ "
 594 .IR SELECTOR " ] "
 595 .br
 596 .RB " [ " index
 597 .IR INDEX " ] "
 598 .RB " [ " action
 599 .IR ACTION " ] "
 600 .RB " [ " priority
 601 .IR PRIORITY " ] "
 602
 603 .ti -8
 604 .B "ip xfrm policy flush"
 605 .RB " [ " ptype
 606 .IR PTYPE " ] "
 607
 608 .ti -8
 609 .B "ip xfrm count"
 610
 611 .ti -8
 612 .IR PTYPE " := "
 613 .RB " [ " main " | " sub " ] "
 614 .B (default=main)
 615
 616 .ti -8
 617 .IR DIR " := "
 618 .RB " [ " in " | " out " | " fwd " ] "
 619
 620 .ti -8
 621 .IR SELECTOR " := "
 622 .B src
 623 .IR ADDR "[/" PLEN "]"
 624 .B dst
 625 .IR ADDR "[/" PLEN] " [ " UPSPEC
 626 .RB " ] [ " dev
 627 .IR DEV " ] "
 628
 629 .ti -8
 630 .IR UPSPEC " := "
 631 .B proto
 632 .IR PROTO " [ "
 633 .RB " [ " sport
 634 .IR PORT " ] "
 635 .RB " [ " dport
 636 .IR PORT " ] | "
 637 .br
 638 .RB " [ " type
 639 .IR NUMBER " ] "
 640 .RB " [ " code
 641 .IR NUMBER " ] ] "
 642
 643 .ti -8
 644 .IR ACTION " := "
 645 .RB " [ " allow " | " block " ]"
 646 .B (default=allow)
 647
 648 .ti -8
 649 .IR LIMIT-LIST " := "
 650 .RB " [ "
 651 .IR LIMIT-LIST " ] | "
 652 .RB " [ " limit
 653 .IR LIMIT " ] "
 654
 655 .ti -8
 656 .IR LIMIT " := "
 657 .RB " [ [" time-soft "|" time-hard "|" time-use-soft "|" time-use-hard "]"
 658 .IR SECONDS " ] | "
 659 .RB " [ [" byte-soft "|" byte-hard "]"
 660 .IR SIZE " ] | "
 661 .br [ "
 662 .RB "[" packet-soft "|" packet-hard "]"
 663 .IR NUMBER " ] "
 664
 665 .ti -8
 666 .IR TMPL-LIST " := "
 667 .B " [ "
 668 .IR TMPL-LIST " ] | "
 669 .RB " [ " tmpl
 670 .IR TMPL " ] "
 671
 672 .ti -8
 673 .IR TMPL " := "
 674 .IR ID " [ "
 675 .B mode
 676 .IR MODE " ] "
 677 .RB " [ " reqid
 678 .IR REQID " ] "
 679 .RB " [ " level
 680 .IR LEVEL " ] "
 681
 682 .ti -8
 683 .IR ID " := "
 684 .RB " [ " src
 685 .IR ADDR " ] "
 686 .RB " [ " dst
 687 .IR ADDR " ] "
 688 .RB " [ " proto
 689 .IR XFRM_PROTO " ] "
 690 .RB " [ " spi
 691 .IR SPI " ] "
 692
 693 .ti -8
 694 .IR XFRM_PROTO " := "
 695 .RB " [ " esp " | " ah " | " comp " | " route2 " | " hao " ] "
 696
 697 .ti -8
 698 .IR MODE " := "
 699 .RB " [ " transport " | " tunnel " | " beet " ] "
 700 .B (default=transport)
 701
 702 .ti -8
 703 .IR LEVEL " := "
 704 .RB " [ " required " | " use " ] "
 705 .B (default=required)
 706
 707 .ti -8
 708 .BR "ip xfrm monitor" " [ " all " | "
 709 .IR LISTofOBJECTS " ] "
 710
 711 .in -8
 712 .ad b
 713
 714 .SH OPTIONS
 715
 716 .TP
 717 .BR "\-V" , " -Version"
 718 print the version of the
 719 .B ip
 720 utility and exit.
 721
 722 .TP
 723 .BR "\-s" , " \-stats", " \-statistics"
 724 output more information.  If the option
 725 appears twice or more, the amount of information increases.
 726 As a rule, the information is statistics or some time values.
 727
 728 .TP
 729 .BR "\-f" , " \-family"
 730 followed by protocol family identifier:
 731 .BR "inet" , " inet6"
 732 or
 733 .B link
 734 ,enforce the protocol family to use.  If the option is not present,
 735 the protocol family is guessed from other arguments.  If the rest
 736 of the command line does not give enough information to guess the
 737 family,
 738 .B ip
 739 falls back to the default one, usually
 740 .B inet
 741 or
 742 .BR "any" .
 743 .B link
 744 is a special family identifier meaning that no networking protocol
 745 is involved.
 746
 747 .TP
 748 .B \-4
 749 shortcut for
 750 .BR "-family inet" .
 751
 752 .TP
 753 .B \-6
 754 shortcut for
 755 .BR "\-family inet6" .
 756
 757 .TP
 758 .B \-0
 759 shortcut for
 760 .BR "\-family link" .
 761
 762 .TP
 763 .BR "\-o" , " \-oneline"
 764 output each record on a single line, replacing line feeds
 765 with the
 766 .B '\e\'
 767 character. This is convenient when you want to count records
 768 with
 769 .BR wc (1)
 770  or to
 771 .BR grep (1)
 772 the output.
 773
 774 .TP
 775 .BR "\-r" , " \-resolve"
 776 use the system's name resolver to print DNS names instead of
 777 host addresses.
 778
 779 .SH IP - COMMAND SYNTAX
 780
 781 .SS
 782 .I OBJECT
 783
 784 .TP
 785 .B link
 786 - network device.
 787
 788 .TP
 789 .B address
 790 - protocol (IP or IPv6) address on a device.
 791
 792 .TP
 793 .B addrlabel
 794 - label configuration for protocol address selection.
 795
 796 .TP
 797 .B neighbour
 798 - ARP or NDISC cache entry.
 799
 800 .TP
 801 .B route
 802 - routing table entry.
 803
 804 .TP
 805 .B rule
 806 - rule in routing policy database.
 807
 808 .TP
 809 .B maddress
 810 - multicast address.
 811
 812 .TP
 813 .B mroute
 814 - multicast routing cache entry.
 815
 816 .TP
 817 .B tunnel
 818 - tunnel over IP.
 819
 820 .TP
 821 .B xfrm
 822 - framework for IPsec protocol.
 823
 824 .PP
 825 The names of all objects may be written in full or
 826 abbreviated form, f.e.
 827 .B address
 828 is abbreviated as
 829 .B addr
 830 or just
 831 .B a.
 832
 833 .SS
 834 .I COMMAND
 835
 836 Specifies the action to perform on the object.
 837 The set of possible actions depends on the object type.
 838 As a rule, it is possible to
 839 .BR "add" , " delete"
 840 and
 841 .B show
 842 (or
 843 .B list
 844 ) objects, but some objects do not allow all of these operations
 845 or have some additional commands.  The
 846 .B help
 847 command is available for all objects.  It prints
 848 out a list of available commands and argument syntax conventions.
 849 .sp
 850 If no command is given, some default command is assumed.
 851 Usually it is
 852 .B list
 853 or, if the objects of this class cannot be listed,
 854 .BR "help" .
 855
 856 .SH ip link - network device configuration
 857
 858 .B link
 859 is a network device and the corresponding commands
 860 display and change the state of devices.
 861
 862 .SS ip link add - add virtual link
 863
 864 .TP
 865 .BI link " DEVICE "
 866 specifies the physical device to act operate on.
 867
 868 .I NAME
 869 specifies the name of the new virtual device.
 870
 871 .I TYPE
 872 specifies the type of the new device.
 873 .sp
 874 Link types:
 875
 876 .in +8
 877 .B vlan
 878 - 802.1q tagged virrtual LAN interface
 879 .sp
 880 .B macvlan
 881 - virtual interface base on link layer address (MAC)
 882 .sp
 883 .B can
 884 - Controller Area Network interface
 885 .in -8
 886
 887 .SS ip link delete - delete virtual link
 888 .I DEVICE
 889 specifies the virtual  device to act operate on.
 890 .I TYPE
 891 specifies the type of the device.
 892
 893
 894 .TP
 895 .BI dev " DEVICE "
 896 specifies the physical device to act operate on.
 897
 898 .SS ip link set - change device attributes
 899
 900 .TP
 901 .BI dev " DEVICE "
 902 .I DEVICE
 903 specifies network device to operate on. When configuring SR-IOV Virtual Fuction
 904 (VF) devices, this keyword should specify the associated Physical Function (PF)
 905 device.
 906
 907 .TP
 908 .BR up " and " down
 909 change the state of the device to
 910 .B UP
 911 or
 912 .BR "DOWN" .
 913
 914 .TP
 915 .BR "arp on " or " arp off"
 916 change the
 917 .B NOARP
 918 flag on the device.
 919
 920 .TP
 921 .BR "multicast on " or " multicast off"
 922 change the
 923 .B MULTICAST
 924 flag on the device.
 925
 926 .TP
 927 .BR "dynamic on " or " dynamic off"
 928 change the
 929 .B DYNAMIC
 930 flag on the device.
 931
 932 .TP
 933 .BI name " NAME"
 934 change the name of the device.  This operation is not
 935 recommended if the device is running or has some addresses
 936 already configured.
 937
 938 .TP
 939 .BI txqueuelen " NUMBER"
 940 .TP
 941 .BI txqlen " NUMBER"
 942 change the transmit queue length of the device.
 943
 944 .TP
 945 .BI mtu " NUMBER"
 946 change the
 947 .I MTU
 948 of the device.
 949
 950 .TP
 951 .BI address " LLADDRESS"
 952 change the station address of the interface.
 953
 954 .TP
 955 .BI broadcast " LLADDRESS"
 956 .TP
 957 .BI brd " LLADDRESS"
 958 .TP
 959 .BI peer " LLADDRESS"
 960 change the link layer broadcast address or the peer address when
 961 the interface is
 962 .IR "POINTOPOINT" .
 963
 964 .TP
 965 .BI netns " PID"
 966 move the device to the network namespace associated with the process
 967 .IR "PID".
 968
 969 .TP
 970 .BI alias " NAME"
 971 give the device a symbolic name for easy reference.
 972
 973 .TP
 974 .BI vf " NUM"
 975 specify a Virtual Function device to be configured. The associated PF device
 976 must be specified using the
 977 .B dev
 978 parameter.
 979
 980 .in +8
 981 .BI mac " LLADDRESS"
 982 - change the station address for the specified VF. The
 983 .B vf
 984 parameter must be specified.
 985
 986 .sp
 987 .BI vlan " VLANID"
 988 - change the assigned VLAN for the specified VF. When specified, all traffic
 989 sent from the VF will be tagged with the specified VLAN ID. Incoming traffic
 990 will be filtered for the specified VLAN ID, and will have all VLAN tags
 991 stripped before being passed to the VF. Setting this parameter to 0 disables
 992 VLAN tagging and filtering. The
 993 .B vf
 994 parameter must be specified.
 995
 996 .sp
 997 .BI qos " VLAN-QOS"
 998 - assign VLAN QOS (priority) bits for the VLAN tag. When specified, all VLAN
 999 tags transmitted by the VF will include the specified priority bits in the
1000 VLAN tag. If not specified, the value is assumed to be 0. Both the
1001 .B vf
1002 and
1003 .B vlan
1004 parameters must be specified. Setting both
1005 .B vlan
1006 and
1007 .B qos
1008 as 0 disables VLAN tagging and filtering for the VF.
1009
1010 .sp
1011 .BI rate " TXRATE"
1012 - change the allowed transmit bandwidth, in Mbps, for the specified VF.
1013 Setting this parameter to 0 disables rate limiting. The
1014 .B vf
1015 parameter must be specified.
1016 .in -8
1017
1018 .PP
1019 .B Warning:
1020 If multiple parameter changes are requested,
1021 .B ip
1022 aborts immediately after any of the changes have failed.
1023 This is the only case when
1024 .B ip
1025 can move the system to an unpredictable state.  The solution
1026 is to avoid changing several parameters with one
1027 .B ip link set
1028 call.
1029
1030 .SS  ip link show - display device attributes
1031
1032 .TP
1033 .BI dev " NAME " (default)
1034 .I NAME
1035 specifies the network device to show.
1036 If this argument is omitted all devices are listed.
1037
1038 .TP
1039 .B up
1040 only display running interfaces.
1041
1042 .SH ip address - protocol address management.
1043
1044 The
1045 .B address
1046 is a protocol (IP or IPv6) address attached
1047 to a network device.  Each device must have at least one address
1048 to use the corresponding protocol.  It is possible to have several
1049 different addresses attached to one device.  These addresses are not
1050 discriminated, so that the term
1051 .B alias
1052 is not quite appropriate for them and we do not use it in this document.
1053 .sp
1054 The
1055 .B ip addr
1056 command displays addresses and their properties, adds new addresses
1057 and deletes old ones.
1058
1059 .SS ip address add - add new protocol address.
1060
1061 .TP
1062 .BI dev " NAME"
1063 the name of the device to add the address to.
1064
1065 .TP
1066 .BI local " ADDRESS " (default)
1067 the address of the interface. The format of the address depends
1068 on the protocol. It is a dotted quad for IP and a sequence of
1069 hexadecimal halfwords separated by colons for IPv6.  The
1070 .I ADDRESS
1071 may be followed by a slash and a decimal number which encodes
1072 the network prefix length.
1073
1074 .TP
1075 .BI peer " ADDRESS"
1076 the address of the remote endpoint for pointopoint interfaces.
1077 Again, the
1078 .I ADDRESS
1079 may be followed by a slash and a decimal number, encoding the network
1080 prefix length.  If a peer address is specified, the local address
1081 cannot have a prefix length.  The network prefix is associated
1082 with the peer rather than with the local address.
1083
1084 .TP
1085 .BI broadcast " ADDRESS"
1086 the broadcast address on the interface.
1087 .sp
1088 It is possible to use the special symbols
1089 .B '+'
1090 and
1091 .B '-'
1092 instead of the broadcast address.  In this case, the broadcast address
1093 is derived by setting/resetting the host bits of the interface prefix.
1094
1095 .TP
1096 .BI label " NAME"
1097 Each address may be tagged with a label string.
1098 In order to preserve compatibility with Linux-2.0 net aliases,
1099 this string must coincide with the name of the device or must be prefixed
1100 with the device name followed by colon.
1101
1102 .TP
1103 .BI scope " SCOPE_VALUE"
1104 the scope of the area where this address is valid.
1105 The available scopes are listed in file
1106 .BR "/etc/iproute2/rt_scopes" .
1107 Predefined scope values are:
1108
1109 .in +8
1110 .B global
1111 - the address is globally valid.
1112 .sp
1113 .B site
1114 - (IPv6 only) the address is site local, i.e. it is
1115 valid inside this site.
1116 .sp
1117 .B link
1118 - the address is link local, i.e. it is valid only on this device.
1119 .sp
1120 .B host
1121 - the address is valid only inside this host.
1122 .in -8
1123
1124 .SS ip address delete - delete protocol address
1125 .B Arguments:
1126 coincide with the arguments of
1127 .B ip addr add.
1128 The device name is a required argument.  The rest are optional.
1129 If no arguments are given, the first address is deleted.
1130
1131 .SS ip address show - look at protocol addresses
1132
1133 .TP
1134 .BI dev " NAME " (default)
1135 name of device.
1136
1137 .TP
1138 .BI scope " SCOPE_VAL"
1139 only list addresses with this scope.
1140
1141 .TP
1142 .BI to " PREFIX"
1143 only list addresses matching this prefix.
1144
1145 .TP
1146 .BI label " PATTERN"
1147 only list addresses with labels matching the
1148 .IR "PATTERN" .
1149 .I PATTERN
1150 is a usual shell style pattern.
1151
1152 .TP
1153 .BR dynamic " and " permanent
1154 (IPv6 only) only list addresses installed due to stateless
1155 address configuration or only list permanent (not dynamic)
1156 addresses.
1157
1158 .TP
1159 .B tentative
1160 (IPv6 only) only list addresses which have not yet passed duplicate
1161 address detection.
1162
1163 .TP
1164 .B deprecated
1165 (IPv6 only) only list deprecated addresses.
1166
1167 .TP
1168 .B dadfailed
1169 (IPv6 only) only list addresses which have failed duplicate
1170 address detection.
1171
1172 .TP
1173 .B temporary
1174 (IPv6 only) only list temporary addresses.
1175
1176 .TP
1177 .BR primary " and " secondary
1178 only list primary (or secondary) addresses.
1179
1180 .SS ip address flush - flush protocol addresses
1181 This command flushes the protocol addresses selected by some criteria.
1182
1183 .PP
1184 This command has the same arguments as
1185 .B show.
1186 The difference is that it does not run when no arguments are given.
1187
1188 .PP
1189 .B Warning:
1190 This command (and other
1191 .B flush
1192 commands described below) is pretty dangerous.  If you make a mistake,
1193 it will not forgive it, but will cruelly purge all the addresses.
1194
1195 .PP
1196 With the
1197 .B -statistics
1198 option, the command becomes verbose. It prints out the number of deleted
1199 addresses and the number of rounds made to flush the address list.  If
1200 this option is given twice,
1201 .B ip addr flush
1202 also dumps all the deleted addresses in the format described in the
1203 previous subsection.
1204
1205 .SH ip addrlabel - protocol address label management.
1206
1207 IPv6 address label is used for address selection
1208 described in RFC 3484.  Precedence is managed by userspace,
1209 and only label is stored in kernel.
1210
1211 .SS ip addrlabel add - add an address label
1212 the command adds an address label entry to the kernel.
1213 .TP
1214 .BI prefix " PREFIX"
1215 .TP
1216 .BI dev " DEV"
1217 the outgoing interface.
1218 .TP
1219 .BI label " NUMBER"
1220 the label for the prefix.
1221 0xffffffff is reserved.
1222 .SS ip addrlabel del - delete an address label
1223 the command deletes an address label entry in the kernel.
1224 .B Arguments:
1225 coincide with the arguments of
1226 .B ip addrlabel add
1227 but label is not required.
1228 .SS ip addrlabel list - list address labels
1229 the command show contents of address labels.
1230 .SS ip addrlabel flush - flush address labels
1231 the command flushes the contents of address labels and it does not restore default settings.
1232 .SH ip neighbour - neighbour/arp tables management.
1233
1234 .B neighbour
1235 objects establish bindings between protocol addresses and
1236 link layer addresses for hosts sharing the same link.
1237 Neighbour entries are organized into tables. The IPv4 neighbour table
1238 is known by another name - the ARP table.
1239
1240 .P
1241 The corresponding commands display neighbour bindings
1242 and their properties, add new neighbour entries and delete old ones.
1243
1244 .SS ip neighbour add - add a new neighbour entry
1245 .SS ip neighbour change - change an existing entry
1246 .SS ip neighbour replace - add a new entry or change an existing one
1247
1248 These commands create new neighbour records or update existing ones.
1249
1250 .TP
1251 .BI to " ADDRESS " (default)
1252 the protocol address of the neighbour. It is either an IPv4 or IPv6 address.
1253
1254 .TP
1255 .BI dev " NAME"
1256 the interface to which this neighbour is attached.
1257
1258 .TP
1259 .BI lladdr " LLADDRESS"
1260 the link layer address of the neighbour.
1261 .I LLADDRESS
1262 can also be
1263 .BR "null" .
1264
1265 .TP
1266 .BI nud " NUD_STATE"
1267 the state of the neighbour entry.
1268 .B nud
1269 is an abbreviation for 'Neigh bour Unreachability Detection'.
1270 The state can take one of the following values:
1271
1272 .in +8
1273 .B permanent
1274 - the neighbour entry is valid forever and can be only
1275 be removed administratively.
1276 .sp
1277
1278 .B noarp
1279 - the neighbour entry is valid. No attempts to validate
1280 this entry will be made but it can be removed when its lifetime expires.
1281 .sp
1282
1283 .B reachable
1284 - the neighbour entry is valid until the reachability
1285 timeout expires.
1286 .sp
1287
1288 .B stale
1289 - the neighbour entry is valid but suspicious.
1290 This option to
1291 .B ip neigh
1292 does not change the neighbour state if it was valid and the address
1293 is not changed by this command.
1294 .in -8
1295
1296 .SS ip neighbour delete - delete a neighbour entry
1297 This command invalidates a neighbour entry.
1298
1299 .PP
1300 The arguments are the same as with
1301 .BR "ip neigh add" ,
1302 except that
1303 .B lladdr
1304 and
1305 .B nud
1306 are ignored.
1307
1308 .PP
1309 .B Warning:
1310 Attempts to delete or manually change a
1311 .B noarp
1312 entry created by the kernel may result in unpredictable behaviour.
1313 Particularly, the kernel may try to resolve this address even
1314 on a
1315 .B NOARP
1316 interface or if the address is multicast or broadcast.
1317
1318 .SS ip neighbour show - list neighbour entries
1319
1320 This commands displays neighbour tables.
1321
1322 .TP
1323 .BI to " ADDRESS " (default)
1324 the prefix selecting the neighbours to list.
1325
1326 .TP
1327 .BI dev " NAME"
1328 only list the neighbours attached to this device.
1329
1330 .TP
1331 .B unused
1332 only list neighbours which are not currently in use.
1333
1334 .TP
1335 .BI nud " NUD_STATE"
1336 only list neighbour entries in this state.
1337 .I NUD_STATE
1338 takes values listed below or the special value
1339 .B all
1340 which means all states.  This option may occur more than once.
1341 If this option is absent,
1342 .B ip
1343 lists all entries except for
1344 .B none
1345 and
1346 .BR "noarp" .
1347
1348 .SS ip neighbour flush - flush neighbour entries
1349 This command flushes neighbour tables, selecting
1350 entries to flush by some criteria.
1351
1352 .PP
1353 This command has the same arguments as
1354 .B show.
1355 The differences are that it does not run when no arguments are given,
1356 and that the default neighbour states to be flushed do not include
1357 .B permanent
1358 and
1359 .BR "noarp" .
1360
1361 .PP
1362 With the
1363 .B -statistics
1364 option, the command becomes verbose.  It prints out the number of
1365 deleted neighbours and the number of rounds made to flush the
1366 neighbour table.  If the option is given
1367 twice,
1368 .B ip neigh flush
1369 also dumps all the deleted neighbours.
1370
1371 .SH ip route - routing table management
1372 Manipulate route entries in the kernel routing tables keep
1373 information about paths to other networked nodes.
1374 .sp
1375 .B Route types:
1376
1377 .in +8
1378 .B unicast
1379 - the route entry describes real paths to the destinations covered
1380 by the route prefix.
1381
1382 .sp
1383 .B unreachable
1384 - these destinations are unreachable.  Packets are discarded and the
1385 ICMP message
1386 .I host unreachable
1387 is generated.
1388 The local senders get an
1389 .I EHOSTUNREACH
1390 error.
1391
1392 .sp
1393 .B blackhole
1394 - these destinations are unreachable.  Packets are discarded silently.
1395 The local senders get an
1396 .I EINVAL
1397 error.
1398
1399 .sp
1400 .B prohibit
1401 - these destinations are unreachable.  Packets are discarded and the
1402 ICMP message
1403 .I communication administratively prohibited
1404 is generated.  The local senders get an
1405 .I EACCES
1406 error.
1407
1408 .sp
1409 .B local
1410 - the destinations are assigned to this host.  The packets are looped
1411 back and delivered locally.
1412
1413 .sp
1414 .B broadcast
1415 - the destinations are broadcast addresses.  The packets are sent as
1416 link broadcasts.
1417
1418 .sp
1419 .B throw
1420 - a special control route used together with policy rules. If such a
1421 route is selected, lookup in this table is terminated pretending that
1422 no route was found.  Without policy routing it is equivalent to the
1423 absence of the route in the routing table.  The packets are dropped
1424 and the ICMP message
1425 .I net unreachable
1426 is generated.  The local senders get an
1427 .I ENETUNREACH
1428 error.
1429
1430 .sp
1431 .B nat
1432 - a special NAT route.  Destinations covered by the prefix
1433 are considered to be dummy (or external) addresses which require translation
1434 to real (or internal) ones before forwarding.  The addresses to translate to
1435 are selected with the attribute
1436 .B Warning:
1437 Route NAT is no longer supported in Linux 2.6.
1438
1439
1440 .BR "via" .
1441 .sp
1442 .B anycast
1443 .RI "- " "not implemented"
1444 the destinations are
1445 .I anycast
1446 addresses assigned to this host.  They are mainly equivalent
1447 to
1448 .B local
1449 with one difference: such addresses are invalid when used
1450 as the source address of any packet.
1451
1452 .sp
1453 .B multicast
1454 - a special type used for multicast routing.  It is not present in
1455 normal routing tables.
1456 .in -8
1457
1458 .P
1459 .B Route tables:
1460 Linux-2.x can pack routes into several routing tables identified
1461 by a number in the range from 1 to 2^31 or by name from the file
1462 .B /etc/iproute2/rt_tables
1463 By default all normal routes are inserted into the
1464 .B main
1465 table (ID 254) and the kernel only uses this table when calculating routes.
1466 Values (0, 253, 254, and 255) are reserved for built-in use.
1467
1468 .sp
1469 Actually, one other table always exists, which is invisible but
1470 even more important.  It is the
1471 .B local
1472 table (ID 255).  This table
1473 consists of routes for local and broadcast addresses.  The kernel maintains
1474 this table automatically and the administrator usually need not modify it
1475 or even look at it.
1476
1477 The multiple routing tables enter the game when
1478 .I policy routing
1479 is used.
1480
1481 .SS ip route add - add new route
1482 .SS ip route change - change route
1483 .SS ip route replace - change or add new one
1484
1485 .TP
1486 .BI to " TYPE PREFIX " (default)
1487 the destination prefix of the route.  If
1488 .I TYPE
1489 is omitted,
1490 .B ip
1491 assumes type
1492 .BR "unicast" .
1493 Other values of
1494 .I TYPE
1495 are listed above.
1496 .I PREFIX
1497 is an IP or IPv6 address optionally followed by a slash and the
1498 prefix length.  If the length of the prefix is missing,
1499 .B ip
1500 assumes a full-length host route.  There is also a special
1501 .I PREFIX
1502 .B default
1503 - which is equivalent to IP
1504 .B 0/0
1505 or to IPv6
1506 .BR "::/0" .
1507
1508 .TP
1509 .BI tos " TOS"
1510 .TP
1511 .BI dsfield " TOS"
1512 the Type Of Service (TOS) key.  This key has no associated mask and
1513 the longest match is understood as: First, compare the TOS
1514 of the route and of the packet.  If they are not equal, then the packet
1515 may still match a route with a zero TOS.
1516 .I TOS
1517 is either an 8 bit hexadecimal number or an identifier
1518 from
1519 .BR "/etc/iproute2/rt_dsfield" .
1520
1521 .TP
1522 .BI metric " NUMBER"
1523 .TP
1524 .BI preference " NUMBER"
1525 the preference value of the route.
1526 .I NUMBER
1527 is an arbitrary 32bit number.
1528
1529 .TP
1530 .BI table " TABLEID"
1531 the table to add this route to.
1532 .I TABLEID
1533 may be a number or a string from the file
1534 .BR "/etc/iproute2/rt_tables" .
1535 If this parameter is omitted,
1536 .B ip
1537 assumes the
1538 .B main
1539 table, with the exception of
1540 .BR local " , " broadcast " and " nat
1541 routes, which are put into the
1542 .B local
1543 table by default.
1544
1545 .TP
1546 .BI dev " NAME"
1547 the output device name.
1548
1549 .TP
1550 .BI via " ADDRESS"
1551 the address of the nexthop router.  Actually, the sense of this field
1552 depends on the route type.  For normal
1553 .B unicast
1554 routes it is either the true next hop router or, if it is a direct
1555 route installed in BSD compatibility mode, it can be a local address
1556 of the interface.  For NAT routes it is the first address of the block
1557 of translated IP destinations.
1558
1559 .TP
1560 .BI src " ADDRESS"
1561 the source address to prefer when sending to the destinations
1562 covered by the route prefix.
1563
1564 .TP
1565 .BI realm " REALMID"
1566 the realm to which this route is assigned.
1567 .I REALMID
1568 may be a number or a string from the file
1569 .BR "/etc/iproute2/rt_realms" .
1570
1571 .TP
1572 .BI mtu " MTU"
1573 .TP
1574 .BI "mtu lock" " MTU"
1575 the MTU along the path to the destination.  If the modifier
1576 .B lock
1577 is not used, the MTU may be updated by the kernel due to
1578 Path MTU Discovery.  If the modifier
1579 .B lock
1580 is used, no path MTU discovery will be tried, all packets
1581 will be sent without the DF bit in IPv4 case or fragmented
1582 to MTU for IPv6.
1583
1584 .TP
1585 .BI window " NUMBER"
1586 the maximal window for TCP to advertise to these destinations,
1587 measured in bytes.  It limits maximal data bursts that our TCP
1588 peers are allowed to send to us.
1589
1590 .TP
1591 .BI rtt " TIME"
1592 the initial RTT ('Round Trip Time') estimate. If no suffix is
1593 specified the units are raw values passed directly to the
1594 routing code to maintain compatability with previous releases.
1595 Otherwise if a suffix of s, sec or secs is used to specify
1596 seconds; ms, msec or msecs to specify milliseconds; us, usec
1597 or usecs to specify microseconds; ns, nsec or nsecs to specify
1598 nanoseconds; j, hz or jiffies to specify jiffies, the value is
1599 converted to what the routing code expects.
1600
1601
1602 .TP
1603 .BI rttvar " TIME " "(2.3.15+ only)"
1604 the initial RTT variance estimate. Values are specified as with
1605 .BI rtt
1606 above.
1607
1608 .TP
1609 .BI rto_min " TIME " "(2.6.23+ only)"
1610 the minimum TCP Retransmission TimeOut to use when communicating with this
1611 destination.  Values are specified as with
1612 .BI rtt
1613 above.
1614
1615 .TP
1616 .BI ssthresh " NUMBER " "(2.3.15+ only)"
1617 an estimate for the initial slow start threshold.
1618
1619 .TP
1620 .BI cwnd " NUMBER " "(2.3.15+ only)"
1621 the clamp for congestion window.  It is ignored if the
1622 .B lock
1623 flag is not used.
1624
1625 .TP
1626 .BI advmss " NUMBER " "(2.3.15+ only)"
1627 the MSS ('Maximal Segment Size') to advertise to these
1628 destinations when establishing TCP connections.  If it is not given,
1629 Linux uses a default value calculated from the first hop device MTU.
1630 (If the path to these destination is asymmetric, this guess may be wrong.)
1631
1632 .TP
1633 .BI reordering " NUMBER " "(2.3.15+ only)"
1634 Maximal reordering on the path to this destination.
1635 If it is not given, Linux uses the value selected with
1636 .B sysctl
1637 variable
1638 .BR "net/ipv4/tcp_reordering" .
1639
1640 .TP
1641 .BI nexthop " NEXTHOP"
1642 the nexthop of a multipath route.
1643 .I NEXTHOP
1644 is a complex value with its own syntax similar to the top level
1645 argument lists:
1646
1647 .in +8
1648 .BI via " ADDRESS"
1649 - is the nexthop router.
1650 .sp
1651
1652 .BI dev " NAME"
1653 - is the output device.
1654 .sp
1655
1656 .BI weight " NUMBER"
1657 - is a weight for this element of a multipath
1658 route reflecting its relative bandwidth or quality.
1659 .in -8
1660
1661 .TP
1662 .BI scope " SCOPE_VAL"
1663 the scope of the destinations covered by the route prefix.
1664 .I SCOPE_VAL
1665 may be a number or a string from the file
1666 .BR "/etc/iproute2/rt_scopes" .
1667 If this parameter is omitted,
1668 .B ip
1669 assumes scope
1670 .B global
1671 for all gatewayed
1672 .B unicast
1673 routes, scope
1674 .B link
1675 for direct
1676 .BR unicast " and " broadcast
1677 routes and scope
1678 .BR host " for " local
1679 routes.
1680
1681 .TP
1682 .BI protocol " RTPROTO"
1683 the routing protocol identifier of this route.
1684 .I RTPROTO
1685 may be a number or a string from the file
1686 .BR "/etc/iproute2/rt_protos" .
1687 If the routing protocol ID is not given,
1688 .B ip assumes protocol
1689 .B boot
1690 (i.e. it assumes the route was added by someone who doesn't
1691 understand what they are doing).  Several protocol values have
1692 a fixed interpretation.
1693 Namely:
1694
1695 .in +8
1696 .B redirect
1697 - the route was installed due to an ICMP redirect.
1698 .sp
1699
1700 .B kernel
1701 - the route was installed by the kernel during autoconfiguration.
1702 .sp
1703
1704 .B boot
1705 - the route was installed during the bootup sequence.
1706 If a routing daemon starts, it will purge all of them.
1707 .sp
1708
1709 .B static
1710 - the route was installed by the administrator
1711 to override dynamic routing. Routing daemon will respect them
1712 and, probably, even advertise them to its peers.
1713 .sp
1714
1715 .B ra
1716 - the route was installed by Router Discovery protocol.
1717 .in -8
1718
1719 .sp
1720 The rest of the values are not reserved and the administrator is free
1721 to assign (or not to assign) protocol tags.
1722
1723 .TP
1724 .B onlink
1725 pretend that the nexthop is directly attached to this link,
1726 even if it does not match any interface prefix.
1727
1728 .SS ip route delete - delete route
1729
1730 .B ip route del
1731 has the same arguments as
1732 .BR "ip route add" ,
1733 but their semantics are a bit different.
1734
1735 Key values
1736 .RB "(" to ", " tos ", " preference " and " table ")"
1737 select the route to delete.  If optional attributes are present,
1738 .B ip
1739 verifies that they coincide with the attributes of the route to delete.
1740 If no route with the given key and attributes was found,
1741 .B ip route del
1742 fails.
1743
1744 .SS ip route show - list routes
1745 the command displays the contents of the routing tables or the route(s)
1746 selected by some criteria.
1747
1748 .TP
1749 .BI to " SELECTOR " (default)
1750 only select routes from the given range of destinations.
1751 .I SELECTOR
1752 consists of an optional modifier
1753 .RB "(" root ", " match " or " exact ")"
1754 and a prefix.
1755 .BI root " PREFIX"
1756 selects routes with prefixes not shorter than
1757 .IR PREFIX "."
1758 F.e.
1759 .BI root " 0/0"
1760 selects the entire routing table.
1761 .BI match " PREFIX"
1762 selects routes with prefixes not longer than
1763 .IR PREFIX "."
1764 F.e.
1765 .BI match " 10.0/16"
1766 selects
1767 .IR 10.0/16 ","
1768 .IR 10/8 " and " 0/0 ,
1769 but it does not select
1770 .IR 10.1/16 " and " 10.0.0/24 .
1771 And
1772 .BI exact " PREFIX"
1773 (or just
1774 .IR PREFIX ")"
1775 selects routes with this exact prefix. If neither of these options
1776 are present,
1777 .B ip
1778 assumes
1779 .BI root " 0/0"
1780 i.e. it lists the entire table.
1781
1782 .TP
1783 .BI tos " TOS"
1784 .BI dsfield " TOS"
1785 only select routes with the given TOS.
1786
1787 .TP
1788 .BI table " TABLEID"
1789 show the routes from this table(s).  The default setting is to show
1790 .BR table main "."
1791 .I TABLEID
1792 may either be the ID of a real table or one of the special values:
1793 .sp
1794 .in +8
1795 .B all
1796 - list all of the tables.
1797 .sp
1798 .B cache
1799 - dump the routing cache.
1800 .in -8
1801
1802 .TP
1803 .B cloned
1804 .TP
1805 .B cached
1806 list cloned routes i.e. routes which were dynamically forked from
1807 other routes because some route attribute (f.e. MTU) was updated.
1808 Actually, it is equivalent to
1809 .BR "table cache" "."
1810
1811 .TP
1812 .BI from " SELECTOR"
1813 the same syntax as for
1814 .BR to ","
1815 but it binds the source address range rather than destinations.
1816 Note that the
1817 .B from
1818 option only works with cloned routes.
1819
1820 .TP
1821 .BI protocol " RTPROTO"
1822 only list routes of this protocol.
1823
1824 .TP
1825 .BI scope " SCOPE_VAL"
1826 only list routes with this scope.
1827
1828 .TP
1829 .BI type " TYPE"
1830 only list routes of this type.
1831
1832 .TP
1833 .BI dev " NAME"
1834 only list routes going via this device.
1835
1836 .TP
1837 .BI via " PREFIX"
1838 only list routes going via the nexthop routers selected by
1839 .IR PREFIX "."
1840
1841 .TP
1842 .BI src " PREFIX"
1843 only list routes with preferred source addresses selected
1844 by
1845 .IR PREFIX "."
1846
1847 .TP
1848 .BI realm " REALMID"
1849 .TP
1850 .BI realms " FROMREALM/TOREALM"
1851 only list routes with these realms.
1852
1853 .SS ip route flush - flush routing tables
1854 this command flushes routes selected by some criteria.
1855
1856 .sp
1857 The arguments have the same syntax and semantics as the arguments of
1858 .BR "ip route show" ,
1859 but routing tables are not listed but purged.  The only difference is
1860 the default action:
1861 .B show
1862 dumps all the IP main routing table but
1863 .B flush
1864 prints the helper page.
1865
1866 .sp
1867 With the
1868 .B -statistics
1869 option, the command becomes verbose. It prints out the number of
1870 deleted routes and the number of rounds made to flush the routing
1871 table. If the option is given
1872 twice,
1873 .B ip route flush
1874 also dumps all the deleted routes in the format described in the
1875 previous subsection.
1876
1877 .SS ip route get - get a single route
1878 this command gets a single route to a destination and prints its
1879 contents exactly as the kernel sees it.
1880
1881 .TP
1882 .BI to " ADDRESS " (default)
1883 the destination address.
1884
1885 .TP
1886 .BI from " ADDRESS"
1887 the source address.
1888
1889 .TP
1890 .BI tos " TOS"
1891 .TP
1892 .BI dsfield " TOS"
1893 the Type Of Service.
1894
1895 .TP
1896 .BI iif " NAME"
1897 the device from which this packet is expected to arrive.
1898
1899 .TP
1900 .BI oif " NAME"
1901 force the output device on which this packet will be routed.
1902
1903 .TP
1904 .B connected
1905 if no source address
1906 .RB "(option " from ")"
1907 was given, relookup the route with the source set to the preferred
1908 address received from the first lookup.
1909 If policy routing is used, it may be a different route.
1910
1911 .P
1912 Note that this operation is not equivalent to
1913 .BR "ip route show" .
1914 .B show
1915 shows existing routes.
1916 .B get
1917 resolves them and creates new clones if necessary.  Essentially,
1918 .B get
1919 is equivalent to sending a packet along this path.
1920 If the
1921 .B iif
1922 argument is not given, the kernel creates a route
1923 to output packets towards the requested destination.
1924 This is equivalent to pinging the destination
1925 with a subsequent
1926 .BR "ip route ls cache" ,
1927 however, no packets are actually sent.  With the
1928 .B iif
1929 argument, the kernel pretends that a packet arrived from this interface
1930 and searches for a path to forward the packet.
1931
1932 .SH ip rule - routing policy database management
1933
1934 .BR "Rule" s
1935 in the routing policy database control the route selection algorithm.
1936
1937 .P
1938 Classic routing algorithms used in the Internet make routing decisions
1939 based only on the destination address of packets (and in theory,
1940 but not in practice, on the TOS field).
1941
1942 .P
1943 In some circumstances we want to route packets differently depending not only
1944 on destination addresses, but also on other packet fields: source address,
1945 IP protocol, transport protocol ports or even packet payload.
1946 This task is called 'policy routing'.
1947
1948 .P
1949 To solve this task, the conventional destination based routing table, ordered
1950 according to the longest match rule, is replaced with a 'routing policy
1951 database' (or RPDB), which selects routes by executing some set of rules.
1952
1953 .P
1954 Each policy routing rule consists of a
1955 .B selector
1956 and an
1957 .B action predicate.
1958 The RPDB is scanned in the order of increasing priority. The selector
1959 of each rule is applied to {source address, destination address, incoming
1960 interface, tos, fwmark} and, if the selector matches the packet,
1961 the action is performed.  The action predicate may return with success.
1962 In this case, it will either give a route or failure indication
1963 and the RPDB lookup is terminated. Otherwise, the RPDB program
1964 continues on the next rule.
1965
1966 .P
1967 Semantically, natural action is to select the nexthop and the output device.
1968
1969 .P
1970 At startup time the kernel configures the default RPDB consisting of three
1971 rules:
1972
1973 .TP
1974 1.
1975 Priority: 0, Selector: match anything, Action: lookup routing
1976 table
1977 .B local
1978 (ID 255).
1979 The
1980 .B local
1981 table is a special routing table containing
1982 high priority control routes for local and broadcast addresses.
1983 .sp
1984 Rule 0 is special. It cannot be deleted or overridden.
1985
1986 .TP
1987 2.
1988 Priority: 32766, Selector: match anything, Action: lookup routing
1989 table
1990 .B main
1991 (ID 254).
1992 The
1993 .B main
1994 table is the normal routing table containing all non-policy
1995 routes. This rule may be deleted and/or overridden with other
1996 ones by the administrator.
1997
1998 .TP
1999 3.
2000 Priority: 32767, Selector: match anything, Action: lookup routing
2001 table
2002 .B default
2003 (ID 253).
2004 The
2005 .B default
2006 table is empty.  It is reserved for some post-processing if no previous
2007 default rules selected the packet.
2008 This rule may also be deleted.
2009
2010 .P
2011 Each RPDB entry has additional
2012 attributes.  F.e. each rule has a pointer to some routing
2013 table.  NAT and masquerading rules have an attribute to select new IP
2014 address to translate/masquerade.  Besides that, rules have some
2015 optional attributes, which routes have, namely
2016 .BR "realms" .
2017 These values do not override those contained in the routing tables.  They
2018 are only used if the route did not select any attributes.
2019
2020 .sp
2021 The RPDB may contain rules of the following types:
2022
2023 .in +8
2024 .B unicast
2025 - the rule prescribes to return the route found
2026 in the routing table referenced by the rule.
2027
2028 .B blackhole
2029 - the rule prescribes to silently drop the packet.
2030
2031 .B unreachable
2032 - the rule prescribes to generate a 'Network is unreachable' error.
2033
2034 .B prohibit
2035 - the rule prescribes to generate 'Communication is administratively
2036 prohibited' error.
2037
2038 .B nat
2039 - the rule prescribes to translate the source address
2040 of the IP packet into some other value.
2041 .in -8
2042
2043 .SS ip rule add - insert a new rule
2044 .SS ip rule delete - delete a rule
2045
2046 .TP
2047 .BI type " TYPE " (default)
2048 the type of this rule.  The list of valid types was given in the previous
2049 subsection.
2050
2051 .TP
2052 .BI from " PREFIX"
2053 select the source prefix to match.
2054
2055 .TP
2056 .BI to " PREFIX"
2057 select the destination prefix to match.
2058
2059 .TP
2060 .BI iif " NAME"
2061 select the incoming device to match.  If the interface is loopback,
2062 the rule only matches packets originating from this host.  This means
2063 that you may create separate routing tables for forwarded and local
2064 packets and, hence, completely segregate them.
2065
2066 .TP
2067 .BI oif " NAME"
2068 select the outgoing device to match.  The outgoing interface is only
2069 available for packets originating from local sockets that are bound to
2070 a device.
2071
2072 .TP
2073 .BI tos " TOS"
2074 .TP
2075 .BI dsfield " TOS"
2076 select the TOS value to match.
2077
2078 .TP
2079 .BI fwmark " MARK"
2080 select the
2081 .B fwmark
2082 value to match.
2083
2084 .TP
2085 .BI priority " PREFERENCE"
2086 the priority of this rule.  Each rule should have an explicitly
2087 set
2088 .I unique
2089 priority value.
2090 The options preference and order are synonyms with priority.
2091
2092 .TP
2093 .BI table " TABLEID"
2094 the routing table identifier to lookup if the rule selector matches.
2095 It is also possible to use lookup instead of table.
2096
2097 .TP
2098 .BI realms " FROM/TO"
2099 Realms to select if the rule matched and the routing table lookup
2100 succeeded.  Realm
2101 .I TO
2102 is only used if the route did not select any realm.
2103
2104 .TP
2105 .BI nat " ADDRESS"
2106 The base of the IP address block to translate (for source addresses).
2107 The
2108 .I ADDRESS
2109 may be either the start of the block of NAT addresses (selected by NAT
2110 routes) or a local host address (or even zero).
2111 In the last case the router does not translate the packets, but
2112 masquerades them to this address.
2113 Using map-to instead of nat means the same thing.
2114
2115 .B Warning:
2116 Changes to the RPDB made with these commands do not become active
2117 immediately.  It is assumed that after a script finishes a batch of
2118 updates, it flushes the routing cache with
2119 .BR "ip route flush cache" .
2120
2121 .SS ip rule flush - also dumps all the deleted rules.
2122 This command has no arguments.
2123
2124 .SS ip rule show - list rules
2125 This command has no arguments.
2126 The options list or lst are synonyms with show.
2127
2128 .SH ip maddress - multicast addresses management
2129
2130 .B maddress
2131 objects are multicast addresses.
2132
2133 .SS ip maddress show - list multicast addresses
2134
2135 .TP
2136 .BI dev " NAME " (default)
2137 the device name.
2138
2139 .SS ip maddress add - add a multicast address
2140 .SS ip maddress delete - delete a multicast address
2141 these commands attach/detach a static link layer multicast address
2142 to listen on the interface.
2143 Note that it is impossible to join protocol multicast groups
2144 statically.  This command only manages link layer addresses.
2145
2146 .TP
2147 .BI address " LLADDRESS " (default)
2148 the link layer multicast address.
2149
2150 .TP
2151 .BI dev " NAME"
2152 the device to join/leave this multicast address.
2153
2154 .SH ip mroute - multicast routing cache management
2155 .B mroute
2156 objects are multicast routing cache entries created by a user level
2157 mrouting daemon (f.e.
2158 .B pimd
2159 or
2160 .B mrouted
2161 ).
2162
2163 Due to the limitations of the current interface to the multicast routing
2164 engine, it is impossible to change
2165 .B mroute
2166 objects administratively, so we may only display them.  This limitation
2167 will be removed in the future.
2168
2169 .SS ip mroute show - list mroute cache entries
2170
2171 .TP
2172 .BI to " PREFIX " (default)
2173 the prefix selecting the destination multicast addresses to list.
2174
2175 .TP
2176 .BI iif " NAME"
2177 the interface on which multicast packets are received.
2178
2179 .TP
2180 .BI from " PREFIX"
2181 the prefix selecting the IP source addresses of the multicast route.
2182
2183 .SH ip tunnel - tunnel configuration
2184 .B tunnel
2185 objects are tunnels, encapsulating packets in IP packets and then
2186 sending them over the IP infrastructure.
2187 The encapulating (or outer) address family is specified by the
2188 .B -f
2189 option.  The default is IPv4.
2190
2191 .SS ip tunnel add - add a new tunnel
2192 .SS ip tunnel change - change an existing tunnel
2193 .SS ip tunnel delete - destroy a tunnel
2194
2195 .TP
2196 .BI name " NAME " (default)
2197 select the tunnel device name.
2198
2199 .TP
2200 .BI mode " MODE"
2201 set the tunnel mode. Available modes depend on the encapsulating address family.
2202 .br
2203 Modes for IPv4 encapsulation available:
2204 .BR ipip ", " sit ", " isatap " and " gre "."
2205 .br
2206 Modes for IPv6 encapsulation available:
2207 .BR ip6ip6 ", " ipip6 " and " any "."
2208
2209 .TP
2210 .BI remote " ADDRESS"
2211 set the remote endpoint of the tunnel.
2212
2213 .TP
2214 .BI local " ADDRESS"
2215 set the fixed local address for tunneled packets.
2216 It must be an address on another interface of this host.
2217
2218 .TP
2219 .BI ttl " N"
2220 set a fixed TTL
2221 .I N
2222 on tunneled packets.
2223 .I N
2224 is a number in the range 1--255. 0 is a special value
2225 meaning that packets inherit the TTL value.
2226 The default value for IPv4 tunnels is:
2227 .BR "inherit" .
2228 The default value for IPv6 tunnels is:
2229 .BR "64" .
2230
2231
2232 .TP
2233 .BI tos " T"
2234 .TP
2235 .BI dsfield " T"
2236 .TP
2237 .BI tclass " T"
2238 set a fixed TOS (or traffic class in IPv6)
2239 .I T
2240 on tunneled packets.
2241 The default value is:
2242 .BR "inherit" .
2243
2244 .TP
2245 .BI dev " NAME"
2246 bind the tunnel to the device
2247 .I NAME
2248 so that tunneled packets will only be routed via this device and will
2249 not be able to escape to another device when the route to endpoint
2250 changes.
2251
2252 .TP
2253 .B nopmtudisc
2254 disable Path MTU Discovery on this tunnel.
2255 It is enabled by default.  Note that a fixed ttl is incompatible
2256 with this option: tunnelling with a fixed ttl always makes pmtu
2257 discovery.
2258
2259 .TP
2260 .BI key " K"
2261 .TP
2262 .BI ikey " K"
2263 .TP
2264 .BI okey " K"
2265 .RB ( " only GRE tunnels " )
2266 use keyed GRE with key
2267 .IR K ". " K
2268 is either a number or an IP address-like dotted quad.
2269 The
2270 .B key
2271 parameter sets the key to use in both directions.
2272 The
2273 .BR ikey " and " okey
2274 parameters set different keys for input and output.
2275
2276 .TP
2277 .BR csum ", " icsum ", " ocsum
2278 .RB ( " only GRE tunnels " )
2279 generate/require checksums for tunneled packets.
2280 The
2281 .B ocsum
2282 flag calculates checksums for outgoing packets.
2283 The
2284 .B icsum
2285 flag requires that all input packets have the correct
2286 checksum.  The
2287 .B csum
2288 flag is equivalent to the combination
2289 .BR "icsum ocsum" .
2290
2291 .TP
2292 .BR seq ", " iseq ", " oseq
2293 .RB ( " only GRE tunnels " )
2294 serialize packets.
2295 The
2296 .B oseq
2297 flag enables sequencing of outgoing packets.
2298 The
2299 .B iseq
2300 flag requires that all input packets are serialized.
2301 The
2302 .B  seq
2303 flag is equivalent to the combination
2304 .BR "iseq oseq" .
2305 .B It isn't work. Don't use it.
2306
2307 .TP
2308 .BR "dscp inherit"
2309 .RB ( " only IPv6 tunnels " )
2310 Inherit DS field between inner and outer header.
2311
2312 .TP
2313 .BI encaplim " ELIM"
2314 .RB ( " only IPv6 tunnels " )
2315 set a fixed encapsulation limit.  Default is 4.
2316
2317 .TP
2318 .BI flowlabel " FLOWLABEL"
2319 .RB ( " only IPv6 tunnels " )
2320 set a fixed flowlabel.
2321
2322 .SS ip tunnel prl - potential router list (ISATAP only)
2323
2324 .TP
2325 .BI dev " NAME"
2326 mandatory device name.
2327
2328 .TP
2329 .BI prl-default " ADDR"
2330 .TP
2331 .BI prl-nodefault " ADDR"
2332 .TP
2333 .BI prl-delete " ADDR"
2334 .RB "Add or delete " ADDR
2335 as a potential router or default router.
2336
2337 .SS ip tunnel show - list tunnels
2338 This command has no arguments.
2339
2340 .SH ip monitor and rtmon - state monitoring
2341
2342 The
2343 .B ip
2344 utility can monitor the state of devices, addresses
2345 and routes continuously.  This option has a slightly different format.
2346 Namely, the
2347 .B monitor
2348 command is the first in the command line and then the object list follows:
2349
2350 .BR "ip monitor" " [ " all " |"
2351 .IR LISTofOBJECTS " ]"
2352
2353 .I OBJECT-LIST
2354 is the list of object types that we want to monitor.
2355 It may contain
2356 .BR link ", " address " and " route "."
2357 If no
2358 .B file
2359 argument is given,
2360 .B ip
2361 opens RTNETLINK, listens on it and dumps state changes in the format
2362 described in previous sections.
2363
2364 .P
2365 If a file name is given, it does not listen on RTNETLINK,
2366 but opens the file containing RTNETLINK messages saved in binary format
2367 and dumps them.  Such a history file can be generated with the
2368 .B rtmon
2369 utility.  This utility has a command line syntax similar to
2370 .BR "ip monitor" .
2371 Ideally,
2372 .B rtmon
2373 should be started before the first network configuration command
2374 is issued. F.e. if you insert:
2375 .sp
2376 .in +8
2377 rtmon file /var/log/rtmon.log
2378 .in -8
2379 .sp
2380 in a startup script, you will be able to view the full history
2381 later.
2382
2383 .P
2384 Certainly, it is possible to start
2385 .B rtmon
2386 at any time.
2387 It prepends the history with the state snapshot dumped at the moment
2388 of starting.
2389
2390 .SH ip xfrm - setting xfrm
2391 xfrm is an IP framework, which can transform format of the datagrams,
2392 .br
2393 i.e. encrypt the packets with some algorithm. xfrm policy and xfrm state
2394 are associated through templates
2395 .IR TMPL_LIST "."
2396 This framework is used as a part of IPsec protocol.
2397
2398 .SS ip xfrm state add - add new state into xfrm
2399
2400 .SS ip xfrm state update - update existing xfrm state
2401
2402 .SS ip xfrm state allocspi - allocate SPI value
2403
2404 .TP
2405 .I MODE
2406 is set as default to
2407 .BR transport ","
2408 but it could be set to
2409 .BR tunnel "," ro " or " beet "."
2410
2411 .TP
2412 .I FLAG-LIST
2413 contains one or more flags.
2414
2415 .TP
2416 .I FLAG
2417 could be set to
2418 .BR noecn ", " decap-dscp " or " wildrecv "."
2419
2420 .TP
2421 .I ENCAP
2422 encapsulation is set to encapsulation type
2423 .IR ENCAP-TYPE ", source port " SPORT ", destination port "  DPORT " and " OADDR "."
2424
2425 .TP
2426 .I ENCAP-TYPE
2427 could be set to
2428 .BR espinudp " or " espinudp-nonike "."
2429
2430 .TP
2431 .I ALGO-LIST
2432 contains one or more algorithms
2433 .I ALGO
2434 which depend on the type of algorithm set by
2435 .IR ALGO_TYPE "."
2436 It can be used these algoritms
2437 .BR enc ", " auth " or " comp "."
2438
2439 .SS ip xfrm policy add - add a new policy
2440
2441 .SS ip xfrm policy update - update an existing policy
2442
2443 .SS ip xfrm policy delete - delete existing policy
2444
2445 .SS ip xfrm policy get - get existing policy
2446
2447 .SS ip xfrm policy deleteall - delete all existing xfrm policy
2448
2449 .SS ip xfrm policy list - print out the list of xfrm policy
2450
2451 .SS ip xfrm policy flush - flush policies
2452 It can be flush
2453 .BR all
2454 policies or only those specified with
2455 .BR ptype "."
2456
2457 .TP
2458 .BI dir " DIR "
2459 directory could be one of these:
2460 .BR "inp", " out " or " fwd".
2461
2462 .TP
2463 .IR SELECTOR
2464 selects for which addresses will be set up the policy. The selector
2465 is defined by source and destination address.
2466
2467 .TP
2468 .IR UPSPEC
2469 is defined by source port
2470 .BR sport ", "
2471 destination port
2472 .BR dport ", " type
2473 as number and
2474 .B code
2475 also number.
2476
2477 .TP
2478 .BI dev " DEV "
2479 specify network device.
2480
2481 .TP
2482 .BI index " INDEX "
2483 the number of indexed policy.
2484
2485 .TP
2486 .BI ptype " PTYPE "
2487 type is set as default on
2488 .BR "main" ,
2489 could be switch on
2490 .BR "sub" .
2491
2492 .TP
2493 .BI action " ACTION "
2494 is set as default on
2495 .BR "allow".
2496 It could be switch on
2497 .BR "block".
2498
2499 .TP
2500 .BI priority " PRIORITY "
2501 priority is a number. Default priority is set on zero.
2502
2503 .TP
2504 .IR LIMIT-LIST
2505 limits are set in seconds, bytes or numbers of packets.
2506
2507 .TP
2508 .IR TMPL-LIST
2509 template list is based on
2510 .IR ID ","
2511 .BR mode ", " reqid " and " level ". "
2512
2513 .TP
2514 .IR ID
2515 is specified by source address, destination address,
2516 .I proto
2517 and value of
2518 .IR spi "."
2519
2520 .TP
2521 .IR XFRM_PROTO
2522 values:
2523 .BR esp ", " ah ", " comp ", " route2 " or " hao "."
2524
2525 .TP
2526 .IR MODE
2527 is set as default on
2528 .BR transport ","
2529 but it could be set on
2530 .BR tunnel " or " beet "."
2531
2532 .TP
2533 .IR LEVEL
2534 is set as default on
2535 .BR required
2536 and the other choice is
2537 .BR use "."
2538
2539 .TP
2540 .IR UPSPEC
2541 is specified by
2542 .BR sport ", "
2543 .BR dport ", " type
2544 and
2545 .B code
2546 (NUMBER).
2547
2548 .SS ip xfrm monitor - is used for listing all objects or defined group of them.
2549 The
2550 .B xfrm monitor
2551 can monitor the policies for all objects or defined group of them.
2552
2553 .SH HISTORY
2554 .B ip
2555 was written by Alexey N. Kuznetsov and added in Linux 2.2.
2556 .SH SEE ALSO
2557 .BR tc (8)
2558 .br
2559 .RB "IP Command reference " ip-cref.ps
2560 .br
2561 .RB "IP tunnels " ip-cref.ps
2562 .br
2563 .RB "User documentation at " http://lartc.org/ ", but please direct bugreports and patches to: " <netdev@vger.kernel.org>
2564
2565 .SH AUTHOR
2566 Original Manpage  by Michail Litvak <mci@owl.openwall.com>