ip(7)

💖 ip(7) 💖 — Linux IPv4 protocol implementation

okay bestie, welcome to section 7 of the manual (that's the "miscellaneous info" shelf, we live here now 🫶). this is the whole entire tea on how Linux does Internet Protocol version 4. grab a strawberry drink 🍓 and let's go, no cap.

---

✨ NAME ✨

ip — Linux IPv4 protocol implementation. that's it, that's the girl. 💅

---

✨ SYNOPSIS ✨

#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/ip.h>  /* superset of previous */

tcp_socket = socket(AF_INET, SOCK_STREAM, 0);
udp_socket = socket(AF_INET, SOCK_DGRAM, 0);
raw_socket = socket(AF_INET, SOCK_RAW, protocol);

like... look at her. gorgeous. ✨

---

✨ DESCRIPTION ✨

so Linux implements Internet Protocol, version 4, which is described in RFC 791 and RFC 1122. ip comes with a level 2 multicasting implementation that conforms to RFC 1112. she ALSO contains an IP router, packet filter included. multi-talented fr fr 👑

the programming interface is BSD-sockets compatible. wanna know more about sockets in general? go read socket(7), bestie.

an IP socket gets made with socket(2):

socket(AF_INET, socket_type, protocol);

valid socket types include SOCK_STREAM for a stream socket, SOCK_DGRAM for a datagram socket, and SOCK_RAW for a raw(7) socket when you wanna access the IP protocol directly. raw access, main character energy, we love to see it 😌

protocol is the IP protocol in the IP header that's gonna be received or sent. valid values for protocol include:

• 0 and IPPROTO_TCP for tcp(7) stream sockets;
• 0 and IPPROTO_UDP for udp(7) datagram sockets;
• IPPROTO_SCTP for sctp(7) stream sockets; and
• IPPROTO_UDPLITE for udplite(7) datagram sockets.

for SOCK_RAW you may specify a valid IANA IP protocol, which is defined in RFC 1700's assigned numbers. iykyk 🌸

when a process wants to receive new incoming packets or connections, it should bind a socket to a local interface address using bind(2). and here's the rule: in this case, only one IP socket may be bound to any given local (address, port) pair. one. single. socket. 💀 when INADDR_ANY is specified in the bind call, the socket gets bound to all local interfaces. when listen(2) is called on an unbound socket, the socket is automatically bound to a random free port with the local address set to INADDR_ANY. when connect(2) is called on an unbound socket, the socket is automatically bound to a random free port or to a usable shared port with the local address set to INADDR_ANY.

⚠️ a TCP local socket address that has been bound is unavailable for some time after closing, unless the SO_REUSEADDR flag has been set. and babe, care should be taken when using this flag — it makes TCP less reliable. she said what she said 🙈

---

🎀 Address format 🎀

an IP socket address is defined as a combination of an IP interface address and a 16-bit port number. the basic IP protocol itself does not supply port numbers — those are implemented by higher level protocols like udp(7) and tcp(7). on raw sockets, .sin_port is set to the IP protocol. wild, right?

see sockaddr_in(3type) for the full structure.

.sin_family is always set to AF_INET. this is required, no negotiating — in Linux 2.2, most networking functions return EINVAL when this setting is missing. 🚩

.sin_port contains the port in network byte order. the port numbers below 1024 are called privileged ports (or sometimes: reserved ports). only a privileged process may bind(2) to these sockets — and "privileged" on Linux means a process that has the CAP_NET_BIND_SERVICE capability in the user namespace governing its network namespace. so specific. we respect it. also note that the raw IPv4 protocol as such has no concept of a port — ports are implemented only by higher protocols like tcp(7) and udp(7).

.sin_addr is the IP host address. the .s_addr member of the in_addr(3type) structure contains the host interface address in network byte order. in_addr(3type) should be assigned one of the INADDR_* values (e.g., INADDR_LOOPBACK) using htonl(3), or set using the inet_aton(3), inet_addr(3), inet_makeaddr(3) library functions, or directly with the name resolver (see gethostbyname(3)). so many options, we're obsessed 💅

IPv4 addresses are divided into unicast, broadcast, and multicast addresses:

• unicast addresses specify a single interface of a host,
• broadcast addresses specify all hosts on a network, and
• multicast addresses address all hosts in a multicast group.

datagrams to broadcast addresses can be sent or received only when the SO_BROADCAST socket flag is set. and in the current implementation, connection-oriented sockets are allowed to use only unicast addresses. periodt.

note that the address and the port are always stored in network byte order. in particular, this means you need to call htons(3) on the number that is assigned to a port. all address/port manipulation functions in the standard library work in network byte order. don't skip the htons, i'm begging 🥺

---

🌈 Special and reserved addresses 🌈

there are several special addresses, bestie, and they each have a whole personality:

• INADDR_LOOPBACK (127.0.0.1) — always refers to the local host via the loopback device. she's the homegirl who never leaves the house 🏠
• INADDR_ANY (0.0.0.0) — means any address for socket binding.
• INADDR_BROADCAST (255.255.255.255) — a packet addressed to INADDR_BROADCAST through a socket which has SO_BROADCAST set will be broadcast to all hosts on the local network segment, as long as the link is broadcast-capable.
• Highest-numbered address / Lowest-numbered address — on any locally-attached non-point-to-point IP subnet with a link type that supports broadcasts, the highest-numbered address (e.g., the .255 address on a subnet with netmask 255.255.255.0) is designated as a broadcast address. it cannot usefully be assigned to an individual interface, and can only be addressed with a socket on which the SO_BROADCAST option has been set. Internet standards have historically also reserved the lowest-numbered address (e.g., the .0 address on a subnet with netmask 255.255.255.0) for broadcast, though they call it "obsolete" for this purpose. (some sources also refer to this as the "network address.") since Linux 5.14, it is treated as an ordinary unicast address and can be assigned to an interface. glow-up ✨

Internet standards have traditionally also reserved various addresses for particular uses, though Linux no longer treats some of these specially:

• [0.0.0.1, 0.255.255.255] / [240.0.0.0, 255.255.255.254] — addresses in these ranges (0/8 and 240/4) are reserved globally. since Linux 5.3 and Linux 2.6.25, respectively, the 0/8 and 240/4 addresses, other than INADDR_ANY and INADDR_BROADCAST, are treated as ordinary unicast addresses. ⚠️ systems that follow the traditional behaviors may not interoperate with these historically reserved addresses, so heads up.
• [127.0.0.1, 127.255.255.254] — addresses in this range (127/8) are treated as loopback addresses, akin to the standardized local loopback address INADDR_LOOPBACK (127.0.0.1);
• [224.0.0.0, 239.255.255.255] — addresses in this range (224/4) are dedicated to multicast use. 🎉

---

🦋 Socket options 🦋

see IPPROTO_IP(2const). all the deets live there, bestie.

---

🦋 /proc interfaces 🦋

see proc_sys_net_ipv4(5).

---

🦋 Ioctls 🦋

all ioctls described in socket(7) apply to ip.

ioctls to configure generic device parameters are described in netdevice(7).

---

✨ ERRORS ✨

here's the whole mood board of ways things can go wrong 💀

• EACCES — the user tried to execute an operation without the necessary permissions. these include: sending a packet to a broadcast address without having the SO_BROADCAST flag set; sending a packet via a prohibit route; modifying firewall settings without superuser privileges (the CAP_NET_ADMIN capability); binding to a privileged port without superuser privileges (the CAP_NET_BIND_SERVICE capability).
• EADDRINUSE — tried to bind to an address already in use. taken, sorry babe 💔
• EADDRNOTAVAIL — a nonexistent interface was requested or the requested source address was not local.
• EAGAIN — operation on a nonblocking socket would block.
• EALREADY — a connection operation on a nonblocking socket is already in progress.
• ECONNABORTED — a connection was closed during an accept(2).
• EHOSTUNREACH — no valid routing table entry matches the destination address. this error can be caused by an ICMP message from a remote router or for the local routing table.
• EINVAL — invalid argument passed. for send operations this can be caused by sending to a blackhole route.
• EISCONN — connect(2) was called on an already connected socket. girl, she's already taken 😭
• EMSGSIZE — datagram is bigger than an MTU on the path and it cannot be fragmented.
• ENOBUFS / ENOMEM — not enough free memory. this often means that the memory allocation is limited by the socket buffer limits, not by the system memory, but this is not 100% consistent. (read: she's a little messy 🙈)
• ENOENT — SIOCGSTAMP was called on a socket where no packet arrived.
• ENOPKG — a kernel subsystem was not configured.
• ENOPROTOOPT / EOPNOTSUPP — invalid socket option passed.
• ENOTCONN — the operation is defined only on a connected socket, but the socket wasn't connected.
• EPERM — user doesn't have permission to set high priority, change configuration, or send signals to the requested process or group.
• EPIPE — the connection was unexpectedly closed or shut down by the other end.
• ESOCKTNOSUPPORT — the socket is not configured or an unknown socket type was requested.

other errors may be generated by the overlaying protocols; see tcp(7), raw(7), udp(7), and socket(7).

---

✨ NOTES ✨

🔥 be very careful with the SO_BROADCAST option — it is not privileged in Linux. it is easy to overload the network with careless broadcasts. for new application protocols it is better to use a multicast group instead of broadcasting. broadcasting is discouraged. see RFC 6762 for an example of a protocol (mDNS) using the more modern multicast approach to communicating with an open-ended group of hosts on the local network. do not be the girl who yells into every room of the house at once 🗣️

using the SOL_IP socket options level isn't portable; BSD-based stacks use the IPPROTO_IP level. keep that in mind when you're writing cross-platform code, bestie 🫶

INADDR_ANY (0.0.0.0) and INADDR_BROADCAST (255.255.255.255) are byte-order-neutral. this means htonl(3) has no effect on them. calling it is just vibes at that point 💅

---

🧚 Compatibility 🧚

for compatibility with Linux 2.0, the obsolete socket(AF_INET, SOCK_PACKET, protocol) syntax is still supported to open a packet(7) socket. this is deprecated and should be replaced by socket(AF_PACKET, SOCK_RAW, protocol) instead. the main difference is the new sockaddr_ll address structure for generic link layer information instead of the old sockaddr_pkt. old-school girl, time to upgrade ✨

---

✨ BUGS ✨

• there are too many inconsistent error values. yeah. that's a whole thing. 😭
• the error used to diagnose exhaustion of the ephemeral port range differs across the various system calls (connect(2), bind(2), listen(2), sendto(2)) that can assign ephemeral ports. pick a struggle, kings 💀
• the ioctls to configure IP-specific interface options and ARP tables are not described.
• receiving the original destination address with MSG_ERRQUEUE in msg_name by recvmsg(2) does not work in some Linux 2.2 kernels.

✨ SEE ALSO ✨

okay bestie, you're done with the main page but the lore goes DEEP. here's the extended universe, all legit cross-references, no filler 💅

• IPPROTO_IP(2const) — the constants for the IP socket options, if you want the raw definitions without the commentary 🎀
• recvmsg(2) — receiving messages, and where all those ancillary cmsg vibes show up
• sendmsg(2) — the sending twin, same energy, opposite direction
• byteorder(3) — because network byte order is a whole lifestyle and you WILL need to convert things 🌈
• capabilities(7) — what privileges you need before you start doing spicy socket stuff, important
• icmp(7) — the ICMP layer, for when things go wrong and you want to know why 😭
• ipv6(7) — the newer sibling protocol, same family, different drip
• netdevice(7) — low-level network device access, for the truly committed
• netlink(7) — the kernel's favorite gossip channel, socket-based
• raw(7) — raw sockets, the main character energy version of networking
• socket(7) — the general socket interface, the parent of us all 💖
• tcp(7) — TCP, reliable and dramatic
• udp(7) — UDP, chaotic and fast, we love her
• ip(8) — the command-line tool, your day-to-day bestie for actually configuring this stuff

---

and if you want to read the actual source of truth, not just us yapping about it: the kernel source file Documentation/networking/ip-sysctl.rst. that's where the sysctl knobs live 💜

also, for the OGs and the academically inclined 🧚:

• RFC 791 — the original IP specification, the founding document, the blueprint, iconic
• RFC 1122 — the IPv4 host requirements, i.e. what YOUR machine has to do
• RFC 1812 — the IPv4 router requirements, i.e. what the machines in the middle have to do

---

and that's the whole page bestie!! 🫶 this lil masterpiece is from Linux man-pages 6.20, dated 2026-02-08. go forth, configure your sockets, and remember: network byte order or it didn't happen. periodt. 💅✨👑