man/man8/ip-link.8.in

   1 .TH IP\-LINK 8 "13 Dec 2012" "iproute2" "Linux"
   2 .SH "NAME"
   3 ip-link \- network device configuration
   4 .SH "SYNOPSIS"
   5 .sp
   6 .ad l
   7 .in +8
   8 .ti -8
   9 .B ip link
  10 .RI  " { " COMMAND " | "
  11 .BR help " }"
  12 .sp
  13
  14 .ti -8
  15 .BI "ip link add"
  16 .RB "[ " link
  17 .IR DEVICE " ]"
  18 .RB "[ " name " ]"
  19 .I NAME
  20 .br
  21 .RB "[ " txqueuelen
  22 .IR PACKETS " ]"
  23 .br
  24 .RB "[ " address
  25 .IR LLADDR " ]"
  26 .RB "[ " broadcast
  27 .IR LLADDR " ]"
  28 .br
  29 .RB "[ " mtu
  30 .IR MTU " ]"
  31 .RB "[ " index
  32 .IR IDX " ]"
  33 .br
  34 .RB "[ " numtxqueues
  35 .IR QUEUE_COUNT " ]"
  36 .RB "[ " numrxqueues
  37 .IR QUEUE_COUNT " ]"
  38 .br
  39 .BI type " TYPE"
  40 .RI "[ " ARGS " ]"
  41
  42 .ti -8
  43 .BR "ip link delete " {
  44 .IR DEVICE " | "
  45 .BI "group " GROUP
  46 }
  47 .BI type " TYPE"
  48 .RI "[ " ARGS " ]"
  49
  50 .ti -8
  51 .BR "ip link set " {
  52 .IR DEVICE " | "
  53 .BI "group " GROUP
  54 }
  55 .br
  56 .RB "[ { " up " | " down " } ]"
  57 .br
  58 .RB "[ " type
  59 .IR "ETYPE TYPE_ARGS" " ]"
  60 .br
  61 .RB "[ " arp " { " on " | " off " } ]"
  62 .br
  63 .RB "[ " dynamic " { " on " | " off " } ]"
  64 .br
  65 .RB "[ " multicast " { " on " | " off " } ]"
  66 .br
  67 .RB "[ " allmulticast " { " on " | " off " } ]"
  68 .br
  69 .RB "[ " promisc " { " on " | " off " } ]"
  70 .br
  71 .RB "[ " protodown " { " on " | " off " } ]"
  72 .br
  73 .RB "[ " trailers " { " on " | " off " } ]"
  74 .br
  75 .RB "[ " txqueuelen
  76 .IR PACKETS " ]"
  77 .br
  78 .RB "[ " name
  79 .IR NEWNAME " ]"
  80 .br
  81 .RB "[ " address
  82 .IR LLADDR " ]"
  83 .br
  84 .RB "[ " broadcast
  85 .IR LLADDR " ]"
  86 .br
  87 .RB "[ " mtu
  88 .IR MTU " ]"
  89 .br
  90 .RB "[ " netns " {"
  91 .IR PID " | " NETNSNAME " } ]"
  92 .br
  93 .RB "[ " link-netnsid
  94 .IR ID " ]"
  95 .br
  96 .RB "[ " alias
  97 .IR NAME  " ]"
  98 .br
  99 .RB "[ " vf
 100 .IR NUM " ["
 101 .B  mac
 102 .IR LLADDR " ]"
 103 .br
 104 .in +9
 105 .RI "[ " VFVLAN-LIST " ]"
 106 .br
 107 .RB "[ " rate
 108 .IR TXRATE " ]"
 109 .br
 110 .RB "[ " max_tx_rate
 111 .IR TXRATE " ]"
 112 .br
 113 .RB "[ " min_tx_rate
 114 .IR TXRATE " ]"
 115 .br
 116 .RB "[ " spoofchk " { " on " | " off " } ]"
 117 .br
 118 .RB "[ " query_rss " { " on " | " off " } ]"
 119 .br
 120 .RB "[ " state " { " auto " | " enable " | " disable " } ]"
 121 .br
 122 .RB "[ " trust " { " on " | " off " } ]"
 123 .br
 124 .RB "[ " node_guid " eui64 ]"
 125 .br
 126 .RB "[ " port_guid " eui64 ] ]"
 127 .br
 128 .in -9
 129 .RB "[ { " xdp " | " xdpgeneric  " | " xdpdrv " | " xdpoffload " } { " off " | "
 130 .br
 131 .in +8
 132 .BR object
 133 .IR FILE
 134 .RB "[ " section
 135 .IR NAME " ]"
 136 .RB "[ " verbose " ] |"
 137 .br
 138 .BR pinned
 139 .IR FILE " } ]"
 140 .br
 141 .in -8
 142 .RB "[ " master
 143 .IR DEVICE " ]"
 144 .br
 145 .RB "[ " nomaster " ]"
 146 .br
 147 .RB "[ " vrf
 148 .IR NAME " ]"
 149 .br
 150 .RB "[ " addrgenmode " { " eui64 " | " none " | " stable_secret " | " random " } ]"
 151 .br
 152 .RB "[ " macaddr " { " flush " | { " add " | " del " } "
 153 .IR MACADDR " | set [ "
 154 .IR MACADDR " [ "
 155 .IR MACADDR " [ ... ] ] ] } ]"
 156 .br
 157
 158 .ti -8
 159 .B ip link show
 160 .RI "[ " DEVICE " | "
 161 .B group
 162 .IR GROUP " ] ["
 163 .BR up " ] ["
 164 .B master
 165 .IR DEVICE " ] ["
 166 .B type
 167 .IR ETYPE " ] ["
 168 .B vrf
 169 .IR NAME " ]"
 170
 171 .ti -8
 172 .B ip link xstats
 173 .BI type " TYPE"
 174 .RI "[ " ARGS " ]"
 175
 176 .ti -8
 177 .B ip link afstats
 178 .RB "[ " dev
 179 .IR DEVICE " ]"
 180
 181 .ti -8
 182 .B ip link help
 183 .RI "[ " TYPE " ]"
 184
 185 .ti -8
 186 .IR TYPE " := [ "
 187 .BR bridge " | "
 188 .BR bond " | "
 189 .BR can " | "
 190 .BR dummy " | "
 191 .BR hsr " | "
 192 .BR ifb " | "
 193 .BR ipoib " |"
 194 .BR macvlan  " | "
 195 .BR macvtap  " | "
 196 .BR vcan " | "
 197 .BR veth " | "
 198 .BR vlan " | "
 199 .BR vxlan " |"
 200 .BR ip6tnl " |"
 201 .BR ipip " |"
 202 .BR sit " |"
 203 .BR gre " |"
 204 .BR gretap " |"
 205 .BR erspan " |"
 206 .BR ip6gre " |"
 207 .BR ip6gretap " |"
 208 .BR vti " |"
 209 .BR nlmon " |"
 210 .BR ipvlan " |"
 211 .BR lowpan " |"
 212 .BR geneve " |"
 213 .BR vrf " |"
 214 .BR macsec " ]"
 215
 216 .ti -8
 217 .IR ETYPE " := [ " TYPE " |"
 218 .BR bridge_slave " | " bond_slave " ]"
 219
 220 .ti -8
 221 .IR VFVLAN-LIST " := [ "  VFVLAN-LIST " ] " VFVLAN
 222
 223 .ti -8
 224 .IR VFVLAN " := "
 225 .RB "[ " vlan
 226 .IR VLANID " [ "
 227 .B qos
 228 .IR VLAN-QOS " ] ["
 229 .B proto
 230 .IR VLAN-PROTO " ] ]"
 231
 232 .SH "DESCRIPTION"
 233 .SS ip link add - add virtual link
 234
 235 .TP
 236 .BI link " DEVICE "
 237 specifies the physical device to act operate on.
 238
 239 .I NAME
 240 specifies the name of the new virtual device.
 241
 242 .I TYPE
 243 specifies the type of the new device.
 244 .sp
 245 Link types:
 246
 247 .in +8
 248 .B bridge
 249 - Ethernet Bridge device
 250 .sp
 251 .B bond
 252 - Bonding device
 253 .sp
 254 .B can
 255 - Controller Area Network interface
 256 .sp
 257 .B dummy
 258 - Dummy network interface
 259 .sp
 260 .B hsr
 261 - High-availability Seamless Redundancy device
 262 .sp
 263 .B ifb
 264 - Intermediate Functional Block device
 265 .sp
 266 .B ipoib
 267 - IP over Infiniband device
 268 .sp
 269 .B macvlan
 270 - Virtual interface base on link layer address (MAC)
 271 .sp
 272 .B macvtap
 273 - Virtual interface based on link layer address (MAC) and TAP.
 274 .sp
 275 .B vcan
 276 - Virtual Controller Area Network interface
 277 .sp
 278 .B veth
 279 - Virtual ethernet interface
 280 .sp
 281 .BR vlan
 282 - 802.1q tagged virtual LAN interface
 283 .sp
 284 .BR vxlan
 285 - Virtual eXtended LAN
 286 .sp
 287 .BR ip6tnl
 288 - Virtual tunnel interface IPv4|IPv6 over IPv6
 289 .sp
 290 .BR ipip
 291 - Virtual tunnel interface IPv4 over IPv4
 292 .sp
 293 .BR sit
 294 - Virtual tunnel interface IPv6 over IPv4
 295 .sp
 296 .BR gre
 297 - Virtual tunnel interface GRE over IPv4
 298 .sp
 299 .BR gretap
 300 - Virtual L2 tunnel interface GRE over IPv4
 301 .sp
 302 .BR erspan
 303 - Encapsulated Remote SPAN over GRE and IPv4
 304 .sp
 305 .BR ip6gre
 306 - Virtual tunnel interface GRE over IPv6
 307 .sp
 308 .BR ip6gretap
 309 - Virtual L2 tunnel interface GRE over IPv6
 310 .sp
 311 .BR vti
 312 - Virtual tunnel interface
 313 .sp
 314 .BR nlmon
 315 - Netlink monitoring device
 316 .sp
 317 .BR ipvlan
 318 - Interface for L3 (IPv6/IPv4) based VLANs
 319 .sp
 320 .BR lowpan
 321 - Interface for 6LoWPAN (IPv6) over IEEE 802.15.4 / Bluetooth
 322 .sp
 323 .BR geneve
 324 - GEneric NEtwork Virtualization Encapsulation
 325 .sp
 326 .BR macsec
 327 - Interface for IEEE 802.1AE MAC Security (MACsec)
 328 .sp
 329 .BR vrf
 330 - Interface for L3 VRF domains
 331 .in -8
 332
 333 .TP
 334 .BI numtxqueues " QUEUE_COUNT "
 335 specifies the number of transmit queues for new device.
 336
 337 .TP
 338 .BI numrxqueues " QUEUE_COUNT "
 339 specifies the number of receive queues for new device.
 340
 341 .TP
 342 .BI index " IDX "
 343 specifies the desired index of the new virtual device. The link creation fails, if the index is busy.
 344
 345 .TP
 346 VLAN Type Support
 347 For a link of type
 348 .I VLAN
 349 the following additional arguments are supported:
 350
 351 .BI "ip link add
 352 .BI link " DEVICE "
 353 .BI name " NAME "
 354 .B "type vlan"
 355 [
 356 .BI protocol " VLAN_PROTO "
 357 ]
 358 .BI id " VLANID "
 359 [
 360 .BR reorder_hdr " { " on " | " off " } "
 361 ]
 362 [
 363 .BR gvrp " { " on " | " off " } "
 364 ]
 365 [
 366 .BR mvrp " { " on " | " off " } "
 367 ]
 368 [
 369 .BR loose_binding " { " on " | " off " } "
 370 ]
 371 [
 372 .BI ingress-qos-map " QOS-MAP "
 373 ]
 374 [
 375 .BI egress-qos-map " QOS-MAP "
 376 ]
 377
 378 .in +8
 379 .sp
 380 .BI protocol " VLAN_PROTO "
 381 - either 802.1Q or 802.1ad.
 382
 383 .BI id " VLANID "
 384 - specifies the VLAN Identifer to use. Note that numbers with a leading " 0 " or " 0x " are interpreted as octal or hexadeimal, respectively.
 385
 386 .BR reorder_hdr " { " on " | " off " } "
 387 - specifies whether ethernet headers are reordered or not (default is
 388 .BR on ")."
 389
 390 .in +4
 391 If
 392 .BR reorder_hdr " is " on
 393 then VLAN header will be not inserted immediately but only before passing to the
 394 physical device (if this device does not support VLAN offloading), the similar
 395 on the RX direction - by default the packet will be untagged before being
 396 received by VLAN device. Reordering allows to accelerate tagging on egress and
 397 to hide VLAN header on ingress so the packet looks like regular Ethernet packet,
 398 at the same time it might be confusing for packet capture as the VLAN header
 399 does not exist within the packet.
 400
 401 VLAN offloading can be checked by
 402 .BR ethtool "(8):"
 403 .in +4
 404 .sp
 405 .B ethtool -k
 406 <phy_dev> |
 407 .RB grep " tx-vlan-offload"
 408 .sp
 409 .in -4
 410 where <phy_dev> is the physical device to which VLAN device is bound.
 411 .in -4
 412
 413 .BR gvrp " { " on " | " off " } "
 414 - specifies whether this VLAN should be registered using GARP VLAN Registration Protocol.
 415
 416 .BR mvrp " { " on " | " off " } "
 417 - specifies whether this VLAN should be registered using Multiple VLAN Registration Protocol.
 418
 419 .BR loose_binding " { " on " | " off " } "
 420 - specifies whether the VLAN device state is bound to the physical device state.
 421
 422 .BI ingress-qos-map " QOS-MAP "
 423 - defines a mapping of VLAN header prio field to the Linux internal packet
 424 priority on incoming frames. The format is FROM:TO with multiple mappings
 425 separated by spaces.
 426
 427 .BI egress-qos-map " QOS-MAP "
 428 - defines a mapping of Linux internal packet priority to VLAN header prio field
 429 but for outgoing frames. The format is the same as for ingress-qos-map.
 430 .in +4
 431
 432 Linux packet priority can be set by
 433 .BR iptables "(8)":
 434 .in +4
 435 .sp
 436 .B iptables
 437 -t mangle -A POSTROUTING [...] -j CLASSIFY --set-class 0:4
 438 .sp
 439 .in -4
 440 and this "4" priority can be used in the egress qos mapping to set VLAN prio "5":
 441 .sp
 442 .in +4
 443 .B ip
 444 link set veth0.10 type vlan egress 4:5
 445 .in -4
 446 .in -4
 447 .in -8
 448
 449 .TP
 450 VXLAN Type Support
 451 For a link of type
 452 .I VXLAN
 453 the following additional arguments are supported:
 454
 455 .BI "ip link add " DEVICE
 456 .BI type " vxlan " id " VNI"
 457 [
 458 .BI dev " PHYS_DEV "
 459 .RB " ] [ { " group " | " remote " } "
 460 .I IPADDR
 461 ] [
 462 .B local
 463 .RI "{ "IPADDR " | "any " } "
 464 ] [
 465 .BI ttl " TTL "
 466 ] [
 467 .BI tos " TOS "
 468 ] [
 469 .BI flowlabel " FLOWLABEL "
 470 ] [
 471 .BI dstport " PORT "
 472 ] [
 473 .BI srcport " MIN MAX "
 474 ] [
 475 .RB [ no ] learning
 476 ] [
 477 .RB [ no ] proxy
 478 ] [
 479 .RB [ no ] rsc
 480 ] [
 481 .RB [ no ] l2miss
 482 ] [
 483 .RB [ no ] l3miss
 484 ] [
 485 .RB [ no ] udpcsum
 486 ] [
 487 .RB [ no ] udp6zerocsumtx
 488 ] [
 489 .RB [ no ] udp6zerocsumrx
 490 ] [
 491 .BI ageing " SECONDS "
 492 ] [
 493 .BI maxaddress " NUMBER "
 494 ] [
 495 .RB [ no ] external
 496 ] [
 497 .B gbp
 498 ] [
 499 .B gpe
 500 ]
 501
 502 .in +8
 503 .sp
 504 .BI  id " VNI "
 505 - specifies the VXLAN Network Identifer (or VXLAN Segment
 506 Identifier) to use.
 507
 508 .BI dev " PHYS_DEV"
 509 - specifies the physical device to use for tunnel endpoint communication.
 510
 511 .sp
 512 .BI group " IPADDR"
 513 - specifies the multicast IP address to join.
 514 This parameter cannot be specified with the
 515 .B remote
 516 parameter.
 517
 518 .sp
 519 .BI remote " IPADDR"
 520 - specifies the unicast destination IP address to use in outgoing packets
 521 when the destination link layer address is not known in the VXLAN device
 522 forwarding database. This parameter cannot be specified with the
 523 .B group
 524 parameter.
 525
 526 .sp
 527 .BI local " IPADDR"
 528 - specifies the source IP address to use in outgoing packets.
 529
 530 .sp
 531 .BI ttl " TTL"
 532 - specifies the TTL value to use in outgoing packets.
 533
 534 .sp
 535 .BI tos " TOS"
 536 - specifies the TOS value to use in outgoing packets.
 537
 538 .sp
 539 .BI flowlabel " FLOWLABEL"
 540 - specifies the flow label to use in outgoing packets.
 541
 542 .sp
 543 .BI dstport " PORT"
 544 - specifies the UDP destination port to communicate to the remote VXLAN tunnel endpoint.
 545
 546 .sp
 547 .BI srcport " MIN MAX"
 548 - specifies the range of port numbers to use as UDP
 549 source ports to communicate to the remote VXLAN tunnel endpoint.
 550
 551 .sp
 552 .RB [ no ] learning
 553 - specifies if unknown source link layer addresses and IP addresses
 554 are entered into the VXLAN device forwarding database.
 555
 556 .sp
 557 .RB [ no ] rsc
 558 - specifies if route short circuit is turned on.
 559
 560 .sp
 561 .RB [ no ] proxy
 562 - specifies ARP proxy is turned on.
 563
 564 .sp
 565 .RB [ no ] l2miss
 566 - specifies if netlink LLADDR miss notifications are generated.
 567
 568 .sp
 569 .RB [ no ] l3miss
 570 - specifies if netlink IP ADDR miss notifications are generated.
 571
 572 .sp
 573 .RB [ no ] udpcsum
 574 - specifies if UDP checksum is calculated for transmitted packets over IPv4.
 575
 576 .sp
 577 .RB [ no ] udp6zerocsumtx
 578 - skip UDP checksum calculation for transmitted packets over IPv6.
 579
 580 .sp
 581 .RB [ no ] udp6zerocsumrx
 582 - allow incoming UDP packets over IPv6 with zero checksum field.
 583
 584 .sp
 585 .BI ageing " SECONDS"
 586 - specifies the lifetime in seconds of FDB entries learnt by the kernel.
 587
 588 .sp
 589 .BI maxaddress " NUMBER"
 590 - specifies the maximum number of FDB entries.
 591
 592 .sp
 593 .RB [ no ] external
 594 - specifies whether an external control plane
 595 .RB "(e.g. " "ip route encap" )
 596 or the internal FDB should be used.
 597
 598 .sp
 599 .B gbp
 600 - enables the Group Policy extension (VXLAN-GBP).
 601
 602 .in +4
 603 Allows to transport group policy context across VXLAN network peers.
 604 If enabled, includes the mark of a packet in the VXLAN header for outgoing
 605 packets and fills the packet mark based on the information found in the
 606 VXLAN header for incomming packets.
 607
 608 Format of upper 16 bits of packet mark (flags);
 609
 610 .in +2
 611 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 612 .br
 613 |-|-|-|-|-|-|-|-|-|D|-|-|A|-|-|-|
 614 .br
 615 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 616
 617 .B D :=
 618 Don't Learn bit. When set, this bit indicates that the egress
 619 VTEP MUST NOT learn the source address of the encapsulated frame.
 620
 621 .B A :=
 622 Indicates that the group policy has already been applied to
 623 this packet. Policies MUST NOT be applied by devices when the A bit is set.
 624 .in -2
 625
 626 Format of lower 16 bits of packet mark (policy ID):
 627
 628 .in +2
 629 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 630 .br
 631 |        Group Policy ID        |
 632 .br
 633 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 634 .in -2
 635
 636 Example:
 637   iptables -A OUTPUT [...] -j MARK --set-mark 0x800FF
 638
 639 .in -4
 640
 641 .sp
 642 .B gpe
 643 - enables the Generic Protocol extension (VXLAN-GPE). Currently, this is
 644 only supported together with the
 645 .B external
 646 keyword.
 647
 648 .in -8
 649
 650 .TP
 651 GRE, IPIP, SIT, ERSPAN Type Support
 652 For a link of types
 653 .I GRE/IPIP/SIT/ERSPAN
 654 the following additional arguments are supported:
 655
 656 .BI "ip link add " DEVICE
 657 .BR type " { " gre " | " ipip " | " sit " | " erspan " }"
 658 .BI " remote " ADDR " local " ADDR
 659 [
 660 .BR encap " { " fou " | " gue " | " none " }"
 661 ] [
 662 .BR encap-sport " { " \fIPORT " | " auto " }"
 663 ] [
 664 .BI "encap-dport " PORT
 665 ] [
 666 .RB [ no ] encap-csum
 667 ] [
 668 .I " [no]encap-remcsum "
 669 ] [
 670 .I " mode " { ip6ip | ipip | mplsip | any } "
 671 ] [
 672 .BR erspan " \fIIDX "
 673 ]
 674
 675 .in +8
 676 .sp
 677 .BI  remote " ADDR "
 678 - specifies the remote address of the tunnel.
 679
 680 .sp
 681 .BI  local " ADDR "
 682 - specifies the fixed local address for tunneled packets.
 683 It must be an address on another interface on this host.
 684
 685 .sp
 686 .BR encap " { " fou " | " gue " | " none " }"
 687 - specifies type of secondary UDP encapsulation. "fou" indicates
 688 Foo-Over-UDP, "gue" indicates Generic UDP Encapsulation.
 689
 690 .sp
 691 .BR encap-sport " { " \fIPORT " | " auto " }"
 692 - specifies the source port in UDP encapsulation.
 693 .IR PORT
 694 indicates the port by number, "auto"
 695 indicates that the port number should be chosen automatically
 696 (the kernel picks a flow based on the flow hash of the
 697 encapsulated packet).
 698
 699 .sp
 700 .RB [ no ] encap-csum
 701 - specifies if UDP checksums are enabled in the secondary
 702 encapsulation.
 703
 704 .sp
 705 .RB [ no ] encap-remcsum
 706 - specifies if Remote Checksum Offload is enabled. This is only
 707 applicable for Generic UDP Encapsulation.
 708
 709 .sp
 710 .BI mode " { ip6ip | ipip | mplsip | any } "
 711 - specifies mode in which device should run. "ip6ip" indicates
 712 IPv6-Over-IPv4, "ipip" indicates "IPv4-Over-IPv4", "mplsip" indicates
 713 MPLS-Over-IPv4, "any" indicates IPv6, IPv4 or MPLS Over IPv4. Supported for
 714 SIT where the default is "ip6ip" and IPIP where the default is "ipip".
 715 IPv6-Over-IPv4 is not supported for IPIP.
 716
 717 .sp
 718 .BR erspan " \fIIDX "
 719 - specifies the ERSPAN index field.
 720 .IR IDX
 721 indicates a 20 bit index/port number associated with the ERSPAN
 722 traffic's source port and direction.
 723
 724 .in -8
 725
 726 .TP
 727 IP6GRE/IP6GRETAP Type Support
 728 For a link of type
 729 .I IP6GRE/IP6GRETAP
 730 the following additional arguments are supported:
 731
 732 .BI "ip link add " DEVICE
 733 .BR type " { " ip6gre " | " ip6gretap " }"
 734 .BI remote " ADDR " local " ADDR"
 735 [
 736 .RB [ i | o ] seq
 737 ] [
 738 .RB [ i | o ] key
 739 .I KEY
 740 ] [
 741 .RB [ i | o ] csum
 742 ] [
 743 .BI hoplimit " TTL "
 744 ] [
 745 .BI encaplimit " ELIM "
 746 ] [
 747 .BI tclass " TCLASS "
 748 ] [
 749 .BI flowlabel " FLOWLABEL "
 750 ] [
 751 .BI "dscp inherit"
 752 ] [
 753 .BI dev " PHYS_DEV "
 754 ]
 755
 756 .in +8
 757 .sp
 758 .BI  remote " ADDR "
 759 - specifies the remote IPv6 address of the tunnel.
 760
 761 .sp
 762 .BI  local " ADDR "
 763 - specifies the fixed local IPv6 address for tunneled packets.
 764 It must be an address on another interface on this host.
 765
 766 .sp
 767 .RB  [ i | o ] seq
 768 - serialize packets.
 769 The
 770 .B oseq
 771 flag enables sequencing of outgoing packets.
 772 The
 773 .B iseq
 774 flag requires that all input packets are serialized.
 775
 776 .sp
 777 .RB  [ i | o ] key " \fIKEY"
 778 - use keyed GRE with key
 779 .IR KEY ". "KEY
 780 is either a number or an IPv4 address-like dotted quad.
 781 The
 782 .B key
 783 parameter specifies the same key to use in both directions.
 784 The
 785 .BR ikey " and " okey
 786 parameters specify different keys for input and output.
 787
 788 .sp
 789 .RB  [ i | o ] csum
 790 - generate/require checksums for tunneled packets.
 791 The
 792 .B ocsum
 793 flag calculates checksums for outgoing packets.
 794 The
 795 .B icsum
 796 flag requires that all input packets have the correct
 797 checksum. The
 798 .B csum
 799 flag is equivalent to the combination
 800 .BR "icsum ocsum" .
 801
 802 .sp
 803 .BI  hoplimit " TTL"
 804 - specifies Hop Limit value to use in outgoing packets.
 805
 806 .sp
 807 .BI  encaplimit " ELIM"
 808 - specifies a fixed encapsulation limit. Default is 4.
 809
 810 .sp
 811 .BI  flowlabel " FLOWLABEL"
 812 - specifies a fixed flowlabel.
 813
 814 .sp
 815 .BI  tclass " TCLASS"
 816 - specifies the traffic class field on
 817 tunneled packets, which can be specified as either a two-digit
 818 hex value (e.g. c0) or a predefined string (e.g. internet).
 819 The value
 820 .B inherit
 821 causes the field to be copied from the original IP header. The
 822 values
 823 .BI "inherit/" STRING
 824 or
 825 .BI "inherit/" 00 ".." ff
 826 will set the field to
 827 .I STRING
 828 or
 829 .IR 00 ".." ff
 830 when tunneling non-IP packets. The default value is 00.
 831
 832 .in -8
 833
 834 .TP
 835 IPoIB Type Support
 836 For a link of type
 837 .I IPoIB
 838 the following additional arguments are supported:
 839
 840 .BI "ip link add " DEVICE " name " NAME
 841 .BR "type ipoib " [ " pkey \fIPKEY" " ] [ " mode " \fIMODE \fR]"
 842
 843 .in +8
 844 .sp
 845 .BI  pkey " PKEY "
 846 - specifies the IB P-Key to use.
 847
 848 .BI  mode " MODE "
 849 - specifies the mode (datagram or connected) to use.
 850
 851 .TP
 852 GENEVE Type Support
 853 For a link of type
 854 .I GENEVE
 855 the following additional arguments are supported:
 856
 857 .BI "ip link add " DEVICE
 858 .BI type " geneve " id " VNI " remote " IPADDR"
 859 [
 860 .BI ttl " TTL "
 861 ] [
 862 .BI tos " TOS "
 863 ] [
 864 .BI flowlabel " FLOWLABEL "
 865 ] [
 866 .BI dstport " PORT"
 867 ] [
 868 .RB [ no ] external
 869 ] [
 870 .RB [ no ] udpcsum
 871 ] [
 872 .RB [ no ] udp6zerocsumtx
 873 ] [
 874 .RB [ no ] udp6zerocsumrx
 875 ]
 876
 877 .in +8
 878 .sp
 879 .BI  id " VNI "
 880 - specifies the Virtual Network Identifer to use.
 881
 882 .sp
 883 .BI remote " IPADDR"
 884 - specifies the unicast destination IP address to use in outgoing packets.
 885
 886 .sp
 887 .BI ttl " TTL"
 888 - specifies the TTL value to use in outgoing packets.
 889
 890 .sp
 891 .BI tos " TOS"
 892 - specifies the TOS value to use in outgoing packets.
 893
 894 .sp
 895 .BI flowlabel " FLOWLABEL"
 896 - specifies the flow label to use in outgoing packets.
 897
 898 .sp
 899 .BI dstport " PORT"
 900 - select a destination port other than the default of 6081.
 901
 902 .sp
 903 .RB [ no ] external
 904 - make this tunnel externally controlled (or not, which is the default). This
 905 flag is mutually exclusive with the
 906 .BR id ,
 907 .BR remote ,
 908 .BR ttl ,
 909 .BR tos " and " flowlabel
 910 options.
 911
 912 .sp
 913 .RB [ no ] udpcsum
 914 - specifies if UDP checksum is calculated for transmitted packets over IPv4.
 915
 916 .sp
 917 .RB [ no ] udp6zerocsumtx
 918 - skip UDP checksum calculation for transmitted packets over IPv6.
 919
 920 .sp
 921 .RB [ no ] udp6zerocsumrx
 922 - allow incoming UDP packets over IPv6 with zero checksum field.
 923
 924 .in -8
 925
 926 .TP
 927 MACVLAN and MACVTAP Type Support
 928 For a link of type
 929 .I MACVLAN
 930 or
 931 .I MACVTAP
 932 the following additional arguments are supported:
 933
 934 .BI "ip link add link " DEVICE " name " NAME
 935 .BR type " { " macvlan " | " macvtap " } "
 936 .BR mode " { " private " | " vepa " | " bridge " | " passthru
 937 .RB " [ " nopromisc " ] | " source " } "
 938
 939 .in +8
 940 .sp
 941 .BR type " { " macvlan " | " macvtap " } "
 942 - specifies the link type to use.
 943 .BR macvlan " creates just a virtual interface, while "
 944 .BR macvtap " in addition creates a character device "
 945 .BR /dev/tapX " to be used just like a " tuntap " device."
 946
 947 .B mode private
 948 - Do not allow communication between
 949 .B macvlan
 950 instances on the same physical interface, even if the external switch supports
 951 hairpin mode.
 952
 953 .B mode vepa
 954 - Virtual Ethernet Port Aggregator mode. Data from one
 955 .B macvlan
 956 instance to the other on the same physical interface is transmitted over the
 957 physical interface. Either the attached switch needs to support hairpin mode,
 958 or there must be a TCP/IP router forwarding the packets in order to allow
 959 communication. This is the default mode.
 960
 961 .B mode bridge
 962 - In bridge mode, all endpoints are directly connected to each other,
 963 communication is not redirected through the physical interface's peer.
 964
 965 .BR mode " " passthru " [ " nopromisc " ] "
 966 - This mode gives more power to a single endpoint, usually in
 967 .BR macvtap " mode. It is not allowed for more than one endpoint on the same "
 968 physical interface. All traffic will be forwarded to this endpoint, allowing
 969 virtio guests to change MAC address or set promiscuous mode in order to bridge
 970 the interface or create vlan interfaces on top of it. By default, this mode
 971 forces the underlying interface into promiscuous mode. Passing the
 972 .BR nopromisc " flag prevents this, so the promisc flag may be controlled "
 973 using standard tools.
 974
 975 .B mode source
 976 - allows one to set a list of allowed mac address, which is used to match
 977 against source mac address from received frames on underlying interface. This
 978 allows creating mac based VLAN associations, instead of standard port or tag
 979 based. The feature is useful to deploy 802.1x mac based behavior,
 980 where drivers of underlying interfaces doesn't allows that.
 981 .in -8
 982
 983 .TP
 984 High-availability Seamless Redundancy (HSR) Support
 985 For a link of type
 986 .I HSR
 987 the following additional arguments are supported:
 988
 989 .BI "ip link add link " DEVICE " name " NAME " type hsr"
 990 .BI slave1 " SLAVE1-IF " slave2 " SLAVE2-IF "
 991 .RB [ " supervision"
 992 .IR ADDR-BYTE " ] ["
 993 .BR version " { " 0 " | " 1 " } ]"
 994
 995 .in +8
 996 .sp
 997 .BR type " hsr "
 998 - specifies the link type to use, here HSR.
 999
1000 .BI slave1 " SLAVE1-IF "
1001 - Specifies the physical device used for the first of the two ring ports.
1002
1003 .BI slave2 " SLAVE2-IF "
1004 - Specifies the physical device used for the second of the two ring ports.
1005
1006 .BI supervision " ADDR-BYTE"
1007 - The last byte of the multicast address used for HSR supervision frames.
1008 Default option is "0", possible values 0-255.
1009
1010 .BR version " { " 0 " | " 1 " }"
1011 - Selects the protocol version of the interface. Default option is "0", which
1012 corresponds to the 2010 version of the HSR standard. Option "1" activates the
1013 2012 version.
1014 .in -8
1015
1016 .TP
1017 BRIDGE Type Support
1018 For a link of type
1019 .I BRIDGE
1020 the following additional arguments are supported:
1021
1022 .BI "ip link add " DEVICE " type bridge "
1023 [
1024 .BI ageing_time " AGEING_TIME "
1025 ] [
1026 .BI group_fwd_mask " MASK "
1027 ] [
1028 .BI group_address " ADDRESS "
1029 ] [
1030 .BI forward_delay " FORWARD_DELAY "
1031 ] [
1032 .BI hello_time " HELLO_TIME "
1033 ] [
1034 .BI max_age " MAX_AGE "
1035 ] [
1036 .BI stp_state " STP_STATE "
1037 ] [
1038 .BI priority " PRIORITY "
1039 ] [
1040 .BI vlan_filtering " VLAN_FILTERING "
1041 ] [
1042 .BI vlan_protocol " VLAN_PROTOCOL "
1043 ] [
1044 .BI vlan_default_pvid " VLAN_DEFAULT_PVID "
1045 ] [
1046 .BI vlan_stats_enabled " VLAN_STATS_ENABLED "
1047 ] [
1048 .BI mcast_snooping " MULTICAST_SNOOPING "
1049 ] [
1050 .BI mcast_router " MULTICAST_ROUTER "
1051 ] [
1052 .BI mcast_query_use_ifaddr " MCAST_QUERY_USE_IFADDR "
1053 ] [
1054 .BI mcast_querier " MULTICAST_QUERIER "
1055 ] [
1056 .BI mcast_hash_elasticity " HASH_ELASTICITY "
1057 ] [
1058 .BI mcast_hash_max " HASH_MAX "
1059 ] [
1060 .BI mcast_last_member_count " LAST_MEMBER_COUNT "
1061 ] [
1062 .BI mcast_startup_query_count " STARTUP_QUERY_COUNT "
1063 ] [
1064 .BI mcast_last_member_interval " LAST_MEMBER_INTERVAL "
1065 ] [
1066 .BI mcast_membership_interval " MEMBERSHIP_INTERVAL "
1067 ] [
1068 .BI mcast_querier_interval " QUERIER_INTERVAL "
1069 ] [
1070 .BI mcast_query_interval " QUERY_INTERVAL "
1071 ] [
1072 .BI mcast_query_response_interval " QUERY_RESPONSE_INTERVAL "
1073 ] [
1074 .BI mcast_startup_query_interval " STARTUP_QUERY_INTERVAL "
1075 ] [
1076 .BI mcast_stats_enabled " MCAST_STATS_ENABLED "
1077 ] [
1078 .BI mcast_igmp_version " IGMP_VERSION "
1079 ] [
1080 .BI mcast_mld_version " MLD_VERSION "
1081 ] [
1082 .BI nf_call_iptables " NF_CALL_IPTABLES "
1083 ] [
1084 .BI nf_call_ip6tables " NF_CALL_IP6TABLES "
1085 ] [
1086 .BI nf_call_arptables " NF_CALL_ARPTABLES "
1087 ]
1088
1089 .in +8
1090 .sp
1091 .BI ageing_time " AGEING_TIME "
1092 - configure the bridge's FDB entries ageing time, ie the number of seconds a MAC address will be kept in the FDB after a packet has been received from that address. after this time has passed, entries are cleaned up.
1093
1094 .BI group_fwd_mask " MASK "
1095 - set the group forward mask. This is the bitmask that is applied to decide whether to forward incoming frames destined to link-local addresses, ie addresses of the form 01:80:C2:00:00:0X (defaults to 0, ie the bridge does not forward any link-local frames).
1096
1097 .BI group_address " ADDRESS "
1098 - set the MAC address of the multicast group this bridge uses for STP.  The address must be a link-local address in standard Ethernet MAC address format, ie an address of the form 01:80:C2:00:00:0X, with X in [0, 4..f].
1099
1100 .BI forward_delay " FORWARD_DELAY "
1101 - set the forwarding delay in seconds, ie the time spent in LISTENING state (before moving to LEARNING) and in LEARNING state (before moving to FORWARDING). Only relevant if STP is enabled. Valid values are between 2 and 30.
1102
1103 .BI hello_time " HELLO_TIME "
1104 - set the time in seconds between hello packets sent by the bridge, when it is a root bridge or a designated bridges. Only relevant if STP is enabled. Valid values are between 1 and 10.
1105
1106 .BI max_age " MAX_AGE "
1107 - set the hello packet timeout, ie the time in seconds until another bridge in the spanning tree is assumed to be dead, after reception of its last hello message. Only relevant if STP is enabled. Valid values are between 6 and 40.
1108
1109 .BI stp_state " STP_STATE "
1110 - turn spanning tree protocol on
1111 .RI ( STP_STATE " > 0) "
1112 or off
1113 .RI ( STP_STATE " == 0). "
1114 for this bridge.
1115
1116 .BI priority " PRIORITY "
1117 - set this bridge's spanning tree priority, used during STP root bridge election.
1118 .I PRIORITY
1119 is a 16bit unsigned integer.
1120
1121 .BI vlan_filtering " VLAN_FILTERING "
1122 - turn VLAN filtering on
1123 .RI ( VLAN_FILTERING " > 0) "
1124 or off
1125 .RI ( VLAN_FILTERING " == 0). "
1126 When disabled, the bridge will not consider the VLAN tag when handling packets.
1127
1128 .BR vlan_protocol " { " 802.1Q " | " 802.1ad " } "
1129 - set the protocol used for VLAN filtering.
1130
1131 .BI vlan_default_pvid " VLAN_DEFAULT_PVID "
1132 - set the default PVID (native/untagged VLAN ID) for this bridge.
1133
1134 .BI vlan_stats_enabled " VLAN_STATS_ENABLED "
1135 - enable
1136 .RI ( VLAN_STATS_ENABLED " == 1) "
1137 or disable
1138 .RI ( VLAN_STATS_ENABLED " == 0) "
1139 per-VLAN stats accounting.
1140
1141 .BI mcast_snooping " MULTICAST_SNOOPING "
1142 - turn multicast snooping on
1143 .RI ( MULTICAST_SNOOPING " > 0) "
1144 or off
1145 .RI ( MULTICAST_SNOOPING " == 0). "
1146
1147 .BI mcast_router " MULTICAST_ROUTER "
1148 - set bridge's multicast router if IGMP snooping is enabled.
1149 .I MULTICAST_ROUTER
1150 is an integer value having the following meaning:
1151 .in +8
1152 .sp
1153 .B 0
1154 - disabled.
1155
1156 .B 1
1157 - automatic (queried).
1158
1159 .B 2
1160 - permanently enabled.
1161 .in -8
1162
1163 .BI mcast_query_use_ifaddr " MCAST_QUERY_USE_IFADDR "
1164 - whether to use the bridge's own IP address as source address for IGMP queries
1165 .RI ( MCAST_QUERY_USE_IFADDR " > 0) "
1166 or the default of 0.0.0.0
1167 .RI ( MCAST_QUERY_USE_IFADDR " == 0). "
1168
1169 .BI mcast_querier " MULTICAST_QUERIER "
1170 - enable
1171 .RI ( MULTICAST_QUERIER " > 0) "
1172 or disable
1173 .RI ( MULTICAST_QUERIER " == 0) "
1174 IGMP querier, ie sending of multicast queries by the bridge (default: disabled).
1175
1176 .BI mcast_querier_interval " QUERIER_INTERVAL "
1177 - interval between queries sent by other routers. if no queries are seen after this delay has passed, the bridge will start to send its own queries (as if
1178 .BI mcast_querier
1179 was enabled).
1180
1181 .BI mcast_hash_elasticity " HASH_ELASTICITY "
1182 - set multicast database hash elasticity, ie the maximum chain length in the multicast hash table (defaults to 4).
1183
1184 .BI mcast_hash_max " HASH_MAX "
1185 - set maximum size of multicast hash table (defaults to 512, value must be a power of 2).
1186
1187 .BI mcast_last_member_count " LAST_MEMBER_COUNT "
1188 - set multicast last member count, ie the number of queries the bridge will send before stopping forwarding a multicast group after a "leave" message has been received (defaults to 2).
1189
1190 .BI mcast_last_member_interval " LAST_MEMBER_INTERVAL "
1191 - interval between queries to find remaining members of a group, after a "leave" message is received.
1192
1193 .BI mcast_startup_query_count " STARTUP_QUERY_COUNT "
1194 - set the number of IGMP queries to send during startup phase (defaults to 2).
1195
1196 .BI mcast_startup_query_interval " STARTUP_QUERY_INTERVAL "
1197 - interval between queries in the startup phase.
1198
1199 .BI mcast_query_interval " QUERY_INTERVAL "
1200 - interval between queries sent by the bridge after the end of the startup phase.
1201
1202 .BI mcast_query_response_interval " QUERY_RESPONSE_INTERVAL "
1203 - set the Max Response Time/Maximum Response Delay for IGMP/MLD queries sent by the bridge.
1204
1205 .BI mcast_membership_interval " MEMBERSHIP_INTERVAL "
1206 - delay after which the bridge will leave a group, if no membership reports for this group are received.
1207
1208 .BI mcast_stats_enabled " MCAST_STATS_ENABLED "
1209 - enable
1210 .RI ( MCAST_STATS_ENABLED " > 0) "
1211 or disable
1212 .RI ( MCAST_STATS_ENABLED " == 0) "
1213 multicast (IGMP/MLD) stats accounting.
1214
1215 .BI mcast_igmp_version " IGMP_VERSION "
1216 - set the IGMP version.
1217
1218 .BI mcast_mld_version " MLD_VERSION "
1219 - set the MLD version.
1220
1221 .BI nf_call_iptables " NF_CALL_IPTABLES "
1222 - enable
1223 .RI ( NF_CALL_IPTABLES " > 0) "
1224 or disable
1225 .RI ( NF_CALL_IPTABLES " == 0) "
1226 iptables hooks on the bridge.
1227
1228 .BI nf_call_ip6tables " NF_CALL_IP6TABLES "
1229 - enable
1230 .RI ( NF_CALL_IP6TABLES " > 0) "
1231 or disable
1232 .RI ( NF_CALL_IP6TABLES " == 0) "
1233 ip6tables hooks on the bridge.
1234
1235 .BI nf_call_arptables " NF_CALL_ARPTABLES "
1236 - enable
1237 .RI ( NF_CALL_ARPTABLES " > 0) "
1238 or disable
1239 .RI ( NF_CALL_ARPTABLES " == 0) "
1240 arptables hooks on the bridge.
1241
1242
1243 .in-8
1244
1245 .TP
1246 MACsec Type Support
1247 For a link of type
1248 .I MACsec
1249 the following additional arguments are supported:
1250
1251 .BI "ip link add link " DEVICE " name " NAME " type macsec"
1252 [ [
1253 .BI address " <lladdr>"
1254 ]
1255 .BI port " PORT"
1256 |
1257 .BI sci " SCI"
1258 ] [
1259 .BI cipher " CIPHER_SUITE"
1260 ] [
1261 .BR icvlen " { "
1262 .IR 8..16 " } ] ["
1263 .BR encrypt " {"
1264 .BR on " | " off " } ] [ "
1265 .BR send_sci " { " on " | " off " } ] ["
1266 .BR end_station " { " on " | " off " } ] ["
1267 .BR scb " { " on " | " off " } ] ["
1268 .BR protect " { " on " | " off " } ] ["
1269 .BR replay " { " on " | " off " }"
1270 .BR window " { "
1271 .IR 0..2^32-1 " } ] ["
1272 .BR validate " { " strict " | " check " | " disabled " } ] ["
1273 .BR encodingsa " { "
1274 .IR 0..3 " } ]"
1275
1276 .in +8
1277 .sp
1278 .BI address " <lladdr> "
1279 - sets the system identifier component of secure channel for this MACsec device.
1280
1281 .sp
1282 .BI port " PORT "
1283 - sets the port number component of secure channel for this MACsec device, in a
1284 range from 1 to 65535 inclusive. Numbers with a leading " 0 " or " 0x " are
1285 interpreted as octal and hexadecimal, respectively.
1286
1287 .sp
1288 .BI sci " SCI "
1289 - sets the secure channel identifier for this MACsec device.
1290 .I SCI
1291 is a 64bit wide number in hexadecimal format.
1292
1293 .sp
1294 .BI cipher " CIPHER_SUITE "
1295 - defines the cipher suite to use.
1296
1297 .sp
1298 .BI icvlen " LENGTH "
1299 - sets the length of the Integrity Check Value (ICV).
1300
1301 .sp
1302 .BR "encrypt on " or " encrypt off"
1303 - switches between authenticated encryption, or authenticity mode only.
1304
1305 .sp
1306 .BR "send_sci on " or " send_sci off"
1307 - specifies whether the SCI is included in every packet, or only when it is necessary.
1308
1309 .sp
1310 .BR "end_station on " or " end_station off"
1311 - sets the End Station bit.
1312
1313 .sp
1314 .BR "scb on " or " scb off"
1315 - sets the Single Copy Broadcast bit.
1316
1317 .sp
1318 .BR "protect on " or " protect off"
1319 - enables MACsec protection on the device.
1320
1321 .sp
1322 .BR "replay on " or " replay off"
1323 - enables replay protection on the device.
1324
1325 .in +8
1326
1327 .sp
1328 .BI window " SIZE "
1329 - sets the size of the replay window.
1330
1331 .in -8
1332
1333 .sp
1334 .BR "validate strict " or " validate check " or " validate disabled"
1335 - sets the validation mode on the device.
1336
1337 .sp
1338 .BI encodingsa " AN "
1339 - sets the active secure association for transmission.
1340
1341 .in -8
1342
1343 .TP
1344 VRF Type Support
1345 For a link of type
1346 .I VRF
1347 the following additional arguments are supported:
1348
1349 .BI "ip link add " DEVICE " type vrf table " TABLE
1350
1351 .in +8
1352 .sp
1353 .BR table " table id associated with VRF device"
1354
1355 .in -8
1356
1357 .SS ip link delete - delete virtual link
1358
1359 .TP
1360 .BI dev " DEVICE "
1361 specifies the virtual device to act operate on.
1362
1363 .TP
1364 .BI group " GROUP "
1365 specifies the group of virtual links to delete. Group 0 is not allowed to be
1366 deleted since it is the default group.
1367
1368 .TP
1369 .BI type " TYPE "
1370 specifies the type of the device.
1371
1372 .SS ip link set - change device attributes
1373
1374 .PP
1375 .B Warning:
1376 If multiple parameter changes are requested,
1377 .B ip
1378 aborts immediately after any of the changes have failed.
1379 This is the only case when
1380 .B ip
1381 can move the system to an unpredictable state. The solution
1382 is to avoid changing several parameters with one
1383 .B ip link set
1384 call.
1385
1386 .TP
1387 .BI dev " DEVICE "
1388 .I DEVICE
1389 specifies network device to operate on. When configuring SR-IOV Virtual Function
1390 (VF) devices, this keyword should specify the associated Physical Function (PF)
1391 device.
1392
1393 .TP
1394 .BI group " GROUP "
1395 .I GROUP
1396 has a dual role: If both group and dev are present, then move the device to the
1397 specified group. If only a group is specified, then the command operates on
1398 all devices in that group.
1399
1400 .TP
1401 .BR up " and " down
1402 change the state of the device to
1403 .B UP
1404 or
1405 .BR "DOWN" .
1406
1407 .TP
1408 .BR "arp on " or " arp off"
1409 change the
1410 .B NOARP
1411 flag on the device.
1412
1413 .TP
1414 .BR "multicast on " or " multicast off"
1415 change the
1416 .B MULTICAST
1417 flag on the device.
1418
1419 .TP
1420 .BR "protodown on " or " protodown off"
1421 change the
1422 .B PROTODOWN
1423 state on the device. Indicates that a protocol error has been detected on the port. Switch drivers can react to this error by doing a phys down on the switch port.
1424
1425 .TP
1426 .BR "dynamic on " or " dynamic off"
1427 change the
1428 .B DYNAMIC
1429 flag on the device. Indicates that address can change when interface goes down (currently
1430 .B NOT
1431 used by the Linux).
1432
1433 .TP
1434 .BI name " NAME"
1435 change the name of the device. This operation is not
1436 recommended if the device is running or has some addresses
1437 already configured.
1438
1439 .TP
1440 .BI txqueuelen " NUMBER"
1441 .TP
1442 .BI txqlen " NUMBER"
1443 change the transmit queue length of the device.
1444
1445 .TP
1446 .BI mtu " NUMBER"
1447 change the
1448 .I MTU
1449 of the device.
1450
1451 .TP
1452 .BI address " LLADDRESS"
1453 change the station address of the interface.
1454
1455 .TP
1456 .BI broadcast " LLADDRESS"
1457 .TP
1458 .BI brd " LLADDRESS"
1459 .TP
1460 .BI peer " LLADDRESS"
1461 change the link layer broadcast address or the peer address when
1462 the interface is
1463 .IR "POINTOPOINT" .
1464
1465 .TP
1466 .BI netns " NETNSNAME " \fR| " PID"
1467 move the device to the network namespace associated with name
1468 .IR "NETNSNAME " or
1469 .RI process " PID".
1470
1471 Some devices are not allowed to change network namespace: loopback, bridge,
1472 ppp, wireless. These are network namespace local devices. In such case
1473 .B ip
1474 tool will return "Invalid argument" error. It is possible to find out if device is local
1475 to a single network namespace by checking
1476 .B netns-local
1477 flag in the output of the
1478 .BR ethtool ":"
1479
1480 .in +8
1481 .B ethtool -k
1482 .I DEVICE
1483 .in -8
1484
1485 To change network namespace for wireless devices the
1486 .B iw
1487 tool can be used. But it allows to change network namespace only for physical devices and by process
1488 .IR PID .
1489
1490 .TP
1491 .BI alias " NAME"
1492 give the device a symbolic name for easy reference.
1493
1494 .TP
1495 .BI group " GROUP"
1496 specify the group the device belongs to.
1497 The available groups are listed in file
1498 .BR "@SYSCONFDIR@/group" .
1499
1500 .TP
1501 .BI vf " NUM"
1502 specify a Virtual Function device to be configured. The associated PF device
1503 must be specified using the
1504 .B dev
1505 parameter.
1506
1507 .in +8
1508 .BI mac " LLADDRESS"
1509 - change the station address for the specified VF. The
1510 .B vf
1511 parameter must be specified.
1512
1513 .sp
1514 .BI vlan " VLANID"
1515 - change the assigned VLAN for the specified VF. When specified, all traffic
1516 sent from the VF will be tagged with the specified VLAN ID. Incoming traffic
1517 will be filtered for the specified VLAN ID, and will have all VLAN tags
1518 stripped before being passed to the VF. Setting this parameter to 0 disables
1519 VLAN tagging and filtering. The
1520 .B vf
1521 parameter must be specified.
1522
1523 .sp
1524 .BI qos " VLAN-QOS"
1525 - assign VLAN QOS (priority) bits for the VLAN tag. When specified, all VLAN
1526 tags transmitted by the VF will include the specified priority bits in the
1527 VLAN tag. If not specified, the value is assumed to be 0. Both the
1528 .B vf
1529 and
1530 .B vlan
1531 parameters must be specified. Setting both
1532 .B vlan
1533 and
1534 .B qos
1535 as 0 disables VLAN tagging and filtering for the VF.
1536
1537 .sp
1538 .BI proto " VLAN-PROTO"
1539 - assign VLAN PROTOCOL for the VLAN tag, either 802.1Q or 802.1ad.
1540 Setting to 802.1ad, all traffic sent from the VF will be tagged with VLAN S-Tag.
1541 Incoming traffic will have VLAN S-Tags stripped before being passed to the VF.
1542 Setting to 802.1ad also enables an option to concatenate another VLAN tag, so both
1543 S-TAG and C-TAG will be inserted/stripped for outgoing/incoming traffic, respectively.
1544 If not specified, the value is assumed to be 802.1Q. Both the
1545 .B vf
1546 and
1547 .B vlan
1548 parameters must be specified.
1549
1550 .sp
1551 .BI rate " TXRATE"
1552 -- change the allowed transmit bandwidth, in Mbps, for the specified VF.
1553 Setting this parameter to 0 disables rate limiting.
1554 .B vf
1555 parameter must be specified.
1556 Please use new API
1557 .B "max_tx_rate"
1558 option instead.
1559
1560 .sp
1561 .BI max_tx_rate " TXRATE"
1562 - change the allowed maximum transmit bandwidth, in Mbps, for the specified VF.
1563 .B vf
1564 parameter must be specified.
1565
1566 .sp
1567 .BI min_tx_rate " TXRATE"
1568 - change the allowed minimum transmit bandwidth, in Mbps, for the specified VF.
1569 Minimum TXRATE should be always <= Maximum TXRATE.
1570 .B vf
1571 parameter must be specified.
1572
1573 .sp
1574 .BI spoofchk " on|off"
1575 - turn packet spoof checking on or off for the specified VF.
1576 .sp
1577 .BI query_rss " on|off"
1578 - toggle the ability of querying the RSS configuration of a specific VF. VF RSS information like RSS hash key may be considered sensitive on some devices where this information is shared between VF and PF and thus its querying may be prohibited by default.
1579 .sp
1580 .BI state " auto|enable|disable"
1581 - set the virtual link state as seen by the specified VF. Setting to auto means a
1582 reflection of the PF link state, enable lets the VF to communicate with other VFs on
1583 this host even if the PF link state is down, disable causes the HW to drop any packets
1584 sent by the VF.
1585 .sp
1586 .BI trust " on|off"
1587 - trust the specified VF user. This enables that VF user can set a specific feature
1588 which may impact security and/or performance. (e.g. VF multicast promiscuous mode)
1589 .sp
1590 .BI node_guid " eui64"
1591 - configure node GUID for Infiniband VFs.
1592 .sp
1593 .BI port_guid " eui64"
1594 - configure port GUID for Infiniband VFs.
1595 .in -8
1596
1597 .TP
1598 .B xdp object "|" pinned "|" off
1599 set (or unset) a XDP ("eXpress Data Path") BPF program to run on every
1600 packet at driver level.
1601 .B ip link
1602 output will indicate a
1603 .B xdp
1604 flag for the networking device. If the driver does not have native XDP
1605 support, the kernel will fall back to a slower, driver-independent "generic"
1606 XDP variant. The
1607 .B ip link
1608 output will in that case indicate
1609 .B xdpgeneric
1610 instead of
1611 .B xdp
1612 only. If the driver does have native XDP support, but the program is
1613 loaded under
1614 .B xdpgeneric object "|" pinned
1615 then the kernel will use the generic XDP variant instead of the native one.
1616 .B xdpdrv
1617 has the opposite effect of requestsing that the automatic fallback to the
1618 generic XDP variant be disabled and in case driver is not XDP-capable error
1619 should be returned.
1620 .B xdpdrv
1621 also disables hardware offloads.
1622 .B xdpoffload
1623 in ip link output indicates that the program has been offloaded to hardware
1624 and can also be used to request the "offload" mode, much like
1625 .B xdpgeneric
1626 it forces program to be installed specifically in HW/FW of the apater.
1627
1628 .B off
1629 (or
1630 .B none
1631 )
1632 - Detaches any currently attached XDP/BPF program from the given device.
1633
1634 .BI object " FILE "
1635 - Attaches a XDP/BPF program to the given device. The
1636 .I FILE
1637 points to a BPF ELF file (f.e. generated by LLVM) that contains the BPF
1638 program code, map specifications, etc. If a XDP/BPF program is already
1639 attached to the given device, an error will be thrown. If no XDP/BPF
1640 program is currently attached, the device supports XDP and the program
1641 from the BPF ELF file passes the kernel verifier, then it will be attached
1642 to the device. If the option
1643 .I -force
1644 is passed to
1645 .B ip
1646 then any prior attached XDP/BPF program will be atomically overridden and
1647 no error will be thrown in this case. If no
1648 .B section
1649 option is passed, then the default section name ("prog") will be assumed,
1650 otherwise the provided section name will be used. If no
1651 .B verbose
1652 option is passed, then a verifier log will only be dumped on load error.
1653 See also
1654 .B EXAMPLES
1655 section for usage examples.
1656
1657 .BI section " NAME "
1658 - Specifies a section name that contains the BPF program code. If no section
1659 name is specified, the default one ("prog") will be used. This option is
1660 to be passed with the
1661 .B object
1662 option.
1663
1664 .BI verbose
1665 - Act in verbose mode. For example, even in case of success, this will
1666 print the verifier log in case a program was loaded from a BPF ELF file.
1667
1668 .BI pinned " FILE "
1669 - Attaches a XDP/BPF program to the given device. The
1670 .I FILE
1671 points to an already pinned BPF program in the BPF file system. The option
1672 .B section
1673 doesn't apply here, but otherwise semantics are the same as with the option
1674 .B object
1675 described already.
1676
1677 .TP
1678 .BI master " DEVICE"
1679 set master device of the device (enslave device).
1680
1681 .TP
1682 .BI nomaster
1683 unset master device of the device (release device).
1684
1685 .TP
1686 .BI addrgenmode " eui64|none|stable_secret|random"
1687 set the IPv6 address generation mode
1688
1689 .I eui64
1690 - use a Modified EUI-64 format interface identifier
1691
1692 .I none
1693 - disable automatic address generation
1694
1695 .I stable_secret
1696 - generate the interface identifier based on a preset /proc/sys/net/ipv6/conf/{default,DEVICE}/stable_secret
1697
1698 .I random
1699 - like stable_secret, but auto-generate a new random secret if none is set
1700
1701 .TP
1702 .BR "link-netnsid "
1703 set peer netnsid for a cross-netns interface
1704
1705 .TP
1706 .BI type " ETYPE TYPE_ARGS"
1707 Change type-specific settings. For a list of supported types and arguments refer
1708 to the description of
1709 .B "ip link add"
1710 above. In addition to that, it is possible to manipulate settings to slave
1711 devices:
1712
1713 .TP
1714 Bridge Slave Support
1715 For a link with master
1716 .B bridge
1717 the following additional arguments are supported:
1718
1719 .B "ip link set type bridge_slave"
1720 [
1721 .B fdb_flush
1722 ] [
1723 .BI state " STATE"
1724 ] [
1725 .BI priority " PRIO"
1726 ] [
1727 .BI cost " COST"
1728 ] [
1729 .BR guard " { " on " | " off " }"
1730 ] [
1731 .BR hairpin " { " on " | " off " }"
1732 ] [
1733 .BR fastleave " { " on " | " off " }"
1734 ] [
1735 .BR root_block " { " on " | " off " }"
1736 ] [
1737 .BR learning " { " on " | " off " }"
1738 ] [
1739 .BR flood " { " on " | " off " }"
1740 ] [
1741 .BR proxy_arp " { " on " | " off " }"
1742 ] [
1743 .BR proxy_arp_wifi " { " on " | " off " }"
1744 ] [
1745 .BI mcast_router " MULTICAST_ROUTER"
1746 ] [
1747 .BR mcast_fast_leave " { " on " | " off "}"
1748 ] [
1749 .BR mcast_flood " { " on " | " off " }"
1750 ] [
1751 .BR group_fwd_mask " MASK"
1752 ] [
1753 .BR neigh_suppress " { " on " | " off " } ]"
1754 ] [
1755 .BR vlan_tunnel " { " on " | " off " } ]"
1756
1757 .in +8
1758 .sp
1759 .B fdb_flush
1760 - flush bridge slave's fdb dynamic entries.
1761
1762 .BI state " STATE"
1763 - Set port state.
1764 .I STATE
1765 is a number representing the following states:
1766 .BR 0 " (disabled),"
1767 .BR 1 " (listening),"
1768 .BR 2 " (learning),"
1769 .BR 3 " (forwarding),"
1770 .BR 4 " (blocking)."
1771
1772 .BI priority " PRIO"
1773 - set port priority (allowed values are between 0 and 63, inclusively).
1774
1775 .BI cost " COST"
1776 - set port cost (allowed values are between 1 and 65535, inclusively).
1777
1778 .BR guard " { " on " | " off " }"
1779 - block incoming BPDU packets on this port.
1780
1781 .BR hairpin " { " on " | " off " }"
1782 - enable hairpin mode on this port. This will allow incoming packets on this
1783 port to be reflected back.
1784
1785 .BR fastleave " { " on " | " off " }"
1786 - enable multicast fast leave on this port.
1787
1788 .BR root_block " { " on " | " off " }"
1789 - block this port from becoming the bridge's root port.
1790
1791 .BR learning " { " on " | " off " }"
1792 - allow MAC address learning on this port.
1793
1794 .BR flood " { " on " | " off " }"
1795 - open the flood gates on this port, i.e. forward all unicast frames to this
1796 port also. Requires
1797 .BR proxy_arp " and " proxy_arp_wifi
1798 to be turned off.
1799
1800 .BR proxy_arp " { " on " | " off " }"
1801 - enable proxy ARP on this port.
1802
1803 .BR proxy_arp_wifi " { " on " | " off " }"
1804 - enable proxy ARP on this port which meets extended requirements by IEEE
1805 802.11 and Hotspot 2.0 specifications.
1806
1807 .BI mcast_router " MULTICAST_ROUTER"
1808 - configure this port for having multicast routers attached. A port with a
1809 multicast router will receive all multicast traffic.
1810 .I MULTICAST_ROUTER
1811 may be either
1812 .B 0
1813 to disable multicast routers on this port,
1814 .B 1
1815 to let the system detect the presence of of routers (this is the default),
1816 .B 2
1817 to permanently enable multicast traffic forwarding on this port or
1818 .B 3
1819 to enable multicast routers temporarily on this port, not depending on incoming
1820 queries.
1821
1822 .BR mcast_fast_leave " { " on " | " off " }"
1823 - this is a synonym to the
1824 .B fastleave
1825 option above.
1826
1827 .BR mcast_flood " { " on " | " off " }"
1828 - controls whether a given port will be flooded with multicast traffic for which there is no MDB entry.
1829
1830 .BI group_fwd_mask " MASK "
1831 - set the group forward mask. This is the bitmask that is applied to decide whether to forward incoming frames destined to link-local addresses, ie addresses of the form 01:80:C2:00:00:0X (defaults to 0, ie the bridge does not forward any link-local frames coming on this port).
1832
1833 .BR neigh_suppress " { " on " | " off " }"
1834 - controls whether neigh discovery (arp and nd) proxy and suppression is enabled on the port. By default this flag is off.
1835
1836 .BR vlan_tunnel " { " on " | " off " }"
1837 - Controls whether vlan to tunnel mapping is enabled on the port. By default this flag is off.
1838
1839 .in -8
1840
1841 .TP
1842 Bonding Slave Support
1843 For a link with master
1844 .B bond
1845 the following additional arguments are supported:
1846
1847 .B "ip link set type bond_slave"
1848 [
1849 .BI queue_id " ID"
1850 ]
1851
1852 .in +8
1853 .sp
1854 .BI queue_id " ID"
1855 - set the slave's queue ID (a 16bit unsigned value).
1856
1857 .in -8
1858
1859 .TP
1860 MACVLAN and MACVTAP Support
1861 Modify list of allowed macaddr for link in source mode.
1862
1863 .B "ip link set type { macvlan | macvap } "
1864 [
1865 .BI macaddr " " "" COMMAND " " MACADDR " ..."
1866 ]
1867
1868 Commands:
1869 .in +8
1870 .B add
1871 - add MACADDR to allowed list
1872 .sp
1873 .B set
1874 - replace allowed list
1875 .sp
1876 .B del
1877 - remove MACADDR from allowed list
1878 .sp
1879 .B flush
1880 - flush whole allowed list
1881 .sp
1882 .in -8
1883
1884
1885 .SS  ip link show - display device attributes
1886
1887 .TP
1888 .BI dev " NAME " (default)
1889 .I NAME
1890 specifies the network device to show.
1891 If this argument is omitted all devices in the default group are listed.
1892
1893 .TP
1894 .BI group " GROUP "
1895 .I GROUP
1896 specifies what group of devices to show.
1897
1898 .TP
1899 .B up
1900 only display running interfaces.
1901
1902 .TP
1903 .BI master " DEVICE "
1904 .I DEVICE
1905 specifies the master device which enslaves devices to show.
1906
1907 .TP
1908 .BI vrf " NAME "
1909 .I NAME
1910 speficies the VRF which enslaves devices to show.
1911
1912 .TP
1913 .BI type " TYPE "
1914 .I TYPE
1915 specifies the type of devices to show.
1916
1917 Note that the type name is not checked against the list of supported types -
1918 instead it is sent as-is to the kernel. Later it is used to filter the returned
1919 interface list by comparing it with the relevant attribute in case the kernel
1920 didn't filter already. Therefore any string is accepted, but may lead to empty
1921 output.
1922
1923 .SS  ip link xstats - display extended statistics
1924
1925 .TP
1926 .BI type " TYPE "
1927 .I TYPE
1928 specifies the type of devices to display extended statistics for.
1929
1930 .SS  ip link afstats - display address-family specific statistics
1931
1932 .TP
1933 .BI dev " DEVICE "
1934 .I DEVICE
1935 specifies the device to display address-family statistics for.
1936
1937 .SS  ip link help - display help
1938
1939 .PP
1940 .I "TYPE"
1941 specifies which help of link type to dislpay.
1942
1943 .SS
1944 .I GROUP
1945 may be a number or a string from the file
1946 .B @SYSCONFDIR@/group
1947 which can be manually filled.
1948
1949 .SH "EXAMPLES"
1950 .PP
1951 ip link show
1952 .RS 4
1953 Shows the state of all network interfaces on the system.
1954 .RE
1955 .PP
1956 ip link show type bridge
1957 .RS 4
1958 Shows the bridge devices.
1959 .RE
1960 .PP
1961 ip link show type vlan
1962 .RS 4
1963 Shows the vlan devices.
1964 .RE
1965 .PP
1966 ip link show master br0
1967 .RS 4
1968 Shows devices enslaved by br0
1969 .RE
1970 .PP
1971 ip link set dev ppp0 mtu 1400
1972 .RS 4
1973 Change the MTU the ppp0 device.
1974 .RE
1975 .PP
1976 ip link add link eth0 name eth0.10 type vlan id 10
1977 .RS 4
1978 Creates a new vlan device eth0.10 on device eth0.
1979 .RE
1980 .PP
1981 ip link delete dev eth0.10
1982 .RS 4
1983 Removes vlan device.
1984 .RE
1985
1986 ip link help gre
1987 .RS 4
1988 Display help for the gre link type.
1989 .RE
1990 .PP
1991 ip link add name tun1 type ipip remote 192.168.1.1
1992 local 192.168.1.2 ttl 225 encap gue encap-sport auto
1993 encap-dport 5555 encap-csum encap-remcsum
1994 .RS 4
1995 Creates an IPIP that is encapsulated with Generic UDP Encapsulation,
1996 and the outer UDP checksum and remote checksum offload are enabled.
1997 .RE
1998 .PP
1999 ip link set dev eth0 xdp obj prog.o
2000 .RS 4
2001 Attaches a XDP/BPF program to device eth0, where the program is
2002 located in prog.o, section "prog" (default section). In case a
2003 XDP/BPF program is already attached, throw an error.
2004 .RE
2005 .PP
2006 ip -force link set dev eth0 xdp obj prog.o sec foo
2007 .RS 4
2008 Attaches a XDP/BPF program to device eth0, where the program is
2009 located in prog.o, section "foo". In case a XDP/BPF program is
2010 already attached, it will be overridden by the new one.
2011 .RE
2012 .PP
2013 ip -force link set dev eth0 xdp pinned /sys/fs/bpf/foo
2014 .RS 4
2015 Attaches a XDP/BPF program to device eth0, where the program was
2016 previously pinned as an object node into BPF file system under
2017 name foo.
2018 .RE
2019 .PP
2020 ip link set dev eth0 xdp off
2021 .RS 4
2022 If a XDP/BPF program is attached on device eth0, detach it and
2023 effectively turn off XDP for device eth0.
2024 .RE
2025 .PP
2026 ip link add link wpan0 lowpan0 type lowpan
2027 .RS 4
2028 Creates a 6LoWPAN interface named lowpan0 on the underlying
2029 IEEE 802.15.4 device wpan0.
2030 .RE
2031
2032 .SH SEE ALSO
2033 .br
2034 .BR ip (8),
2035 .BR ip-netns (8),
2036 .BR ethtool (8),
2037 .BR iptables (8)
2038
2039 .SH AUTHOR
2040 Original Manpage by Michail Litvak <mci@owl.openwall.com>