IP-ADDRESS(8)

✨ NAME ✨

Heyy bestie, this is the ip-address manual page (section 8, Linux) and it is literally about managing protocol addresses 💅🌸

ip-address is all about protocol address management. Basically, it's how you add, change, remove and look at the addresses on your network devices 🦋

✨ SYNOPSIS ✨

Okay so here's the whole family of commands. Don't panic, they look scarier than they are 🫶

ip [ OPTIONS ] address  { COMMAND | help }
ip address { add | change | replace } IFADDR dev IFNAME [ LIFETIME ] [ CONFFLAG-LIST ]
ip address delete IFADDR dev IFNAME [ mngtmpaddr ]
ip address { save | flush } [ dev IFNAME ] [ scope SCOPE-ID ] [ metric METRIC ] [ to PREFIX ] [ FLAG-LIST ] [ label PATTERN ] [ { up | down } ]
ip address [ show [ dev IFNAME ] [ scope SCOPE-ID ] [ to PREFIX ] [ FLAG-LIST ] [ label PATTERN ] [ master DEVICE ] [ type TYPE ] [ vrf NAME ] [ { up | down } ] [ nomaster ] proto ADDRPROTO ] ]
ip address { showdump | restore }

🧁 The Little Definitions 🧁

Now the building blocks. These are the pieces you slot into the commands above, so keep them handy 🍓

IFADDR := PREFIX | ADDR peer PREFIX [ broadcast ADDR ] [ anycast ADDR ]
        [ label LABEL ] [ scope SCOPE-ID ] [ proto ADDRPROTO ]

SCOPE-ID := [ host | link | global | NUMBER ]

ADDRPROTO := [ NAME | NUMBER ]

FLAG-LIST := [ FLAG-LIST ] FLAG

FLAG := [ [-]permanent | [-]dynamic | [-]secondary | [-]primary |
        [-]tentative | [-]deprecated | [-]dadfailed | [-]temporary |
        CONFFLAG-LIST ]

CONFFLAG-LIST := [ CONFFLAG-LIST ] CONFFLAG

CONFFLAG := [ home | mngtmpaddr | nodad | optimistic | noprefixroute |
        autojoin ]

LIFETIME := [ valid_lft LFT ] [ preferred_lft LFT ]

LFT := [ forever | SECONDS ]

TYPE := [ bridge | bridge_slave | bond | bond_slave | can | dummy | hsr
        | ifb | ipoib | macvlan | macvtap | vcan | veth | vlan | vxlan |
        ip6tnl | ipip | sit | gre | gretap | erspan | ip6gre | ip6gretap
        | ip6erspan | vti | vrf | nlmon | ipvlan | lowpan | geneve |
        macsec | netkit ]

✨ DESCRIPTION ✨

okay so an address is a protocol address (IPv4 or IPv6) that gets attached to a network device 🌸 every device needs at least one address before it can use that protocol. and a device can hold several addresses at once 💅 these addresses aren't ranked against each other, so calling them "aliases" isn't really accurate, which is why this page doesn't use that word 🙈

The ip address command is your all-in-one spot to show addresses and their properties, add new ones, and delete old ones 🎀

💖 ip address add - add new protocol address.

• dev IFNAME — the name of the device you want to add the address to 🦋
• local ADDRESS (default) — the address of the interface 💜 the format depends on the protocol: a dotted quad for IP, or a bunch of hexadecimal halfwords separated by colons for IPv6. the ADDRESS can be followed by a slash and a decimal number, which is the network prefix length ✨
• peer ADDRESS — the address of the remote endpoint on pointopoint interfaces 🫶 the ADDRESS can also get a slash and a decimal prefix length. if you give a peer address, the local address cannot have a prefix length, because the network prefix belongs to the peer, not the local address 👑
• broadcast ADDRESS — the broadcast address on the interface 📡

you can also use the special symbols + and - instead of a broadcast address. when you do, the broadcast address gets worked out by setting or resetting the host bits of the interface prefix 🧚

• label LABEL — each address can be tagged with a label string 🏷️ the maximum total length of a label is 15 characters, so keep it short bestie 🍓
• scope SCOPE_VALUE — the scope of the area where this address is valid 🌈 the available scopes are listed in /usr/share/iproute2/rt_scopes or /etc/iproute2/rt_scopes, and the /etc one wins if it exists. the predefined scope values are:
  • global — the address is globally valid 🌍
  • site — (IPv6 only, deprecated) the address is site local, meaning it's valid inside this site 🏠
  • link — the address is link local, meaning it's only valid on this device 🔗
  • host — the address is only valid inside this host 💻
• metric NUMBER — the priority of the prefix route associated with the address ⭐
• valid_lft LFT — the valid lifetime of this address, see section 5.5.4 of RFC 4862 ⏳ once it expires, the kernel removes the address. defaults to forever 💀
• preferred_lft LFT — the preferred lifetime of this address, see section 5.5.4 of RFC 4862 ⌛ once it expires, the address stops being used for new outgoing connections. defaults to forever 🫠
• home — (IPv6 only) marks this address as the "home address" from RFC 6275 🏡
• mngtmpaddr — (IPv6 only) tells the kernel to manage temporary addresses made from this one as a template, on behalf of Privacy Extensions (RFC3041) 🕵️‍♀️ for this to kick in, the use_tempaddr sysctl setting has to be greater than zero, and the address needs a prefix length of 64. it lets you use privacy extensions on a manually configured network, just like stateless auto-configuration would 🔐
• nodad — (IPv6 only) skips Duplicate Address Detection (RFC 4862) when adding this address 🙅‍♀️
• optimistic — (IPv6 only) when doing Duplicate Address Detection, uses the RFC 4429 optimistic variant 🌤️
• noprefixroute — does not automatically create a route for the network prefix of the added address, and doesn't go looking for one to delete when removing the address 🛣️ changing an address to add this flag removes the automatically added prefix route, and changing it to remove this flag creates the prefix route automatically again 🔄
• autojoin — okay this one's a whole storyline 🎬 joining multicast groups at the Ethernet level with ip maddr doesn't work if you're plugged into an Ethernet switch doing IGMP snooping, because the switch won't copy multicast packets to ports that never sent IGMP reports for those multicast addresses 😭

Linux VXLAN interfaces made with ip link add vxlan have the group option, which lets them do the required join ✨

using the autojoin flag when adding a multicast address gives similar help to Openvswitch VXLAN interfaces, and to other tunneling mechanisms that need to receive multicast traffic 🧚

• proto ADDRPROTO — the protocol identifier of this route 🪄 ADDRPROTO can be a number, or a string from /usr/share/iproute2/rt_addrprotos or /etc/iproute2/rt_addrprotos (the /etc one wins if it exists). a directory named rt_addrprotos.d also gets scanned in either location 📂 if you don't give a protocol ID, ip assumes protocol 0 🤷‍♀️ a few protocol values have fixed meanings:
  • kernel_lo — the ::1 address that the kernel installs on a loopback netdevice has this protocol value 🔁
  • kernel_ra — IPv6 addresses installed in response to router advertisement messages 📻
  • kernel_ll — link-local addresses have this protocol value 🔗

everything else is unreserved, so the admin is free to assign protocol tags (or not) 🎨

💀 ip address delete - delete protocol address

Arguments: coincide with the arguments of ip address add. the same stuff you'd type to add it, you type to delete it 🫶

the device name is a required argument, so don't forget it 🙏

👀 ip address show - look at protocol addresses

• dev IFNAME (default) — name of the device 🔍
• scope SCOPE_VAL — only lists addresses with this scope 🌐
• to PREFIX — only lists addresses matching this prefix 🎯
• label PATTERN — only lists addresses whose labels match the PATTERN. the PATTERN is a usual shell style pattern 🐚
• master DEVICE — only lists interfaces enslaved to this master device 👑
• vrf NAME — only lists interfaces enslaved to this vrf 🗂️
• type TYPE — only lists interfaces of the given type 🧩

heads up, the type name isn't checked against the list of supported types. it's just sent as-is to the kernel, then used to filter the returned interface list by comparing it with the relevant attribute, in case the kernel didn't filter already 🙃 so any string is accepted, but you might get empty output 🫠

• up — only lists running interfaces 🟢
• down — only lists not running interfaces 🔴
• nomaster — only lists interfaces with no master 🫧
• dynamic and permanent — (IPv6 only) only lists addresses installed through stateless address configuration, or only lists permanent (not dynamic) addresses 🌓 these two flags are inverses of each other, so -dynamic is equal to permanent, and -permanent is equal to dynamic 🔀
• tentative — (IPv6 only) only lists addresses that haven't yet passed duplicate address detection 🥚
• -tentative — (IPv6 only) only lists addresses that aren't currently in the middle of duplicate address detection 🐣
• deprecated — (IPv6 only) only lists deprecated addresses 🪦
• -deprecated — (IPv6 only) only lists addresses that aren't deprecated 🌟
• dadfailed — (IPv6 only) only lists addresses that failed duplicate address detection 💥
• -dadfailed — (IPv6 only) only lists addresses that didn't fail duplicate address detection 🙌
• temporary or secondary — lists temporary IPv6 or secondary IPv4 addresses only 🌀 the Linux kernel shares a single bit for those, so they're actually aliases of each other, even though the meaning changes depending on the address family 🤯
• -temporary or -secondary — these flags are aliases for primary 🔁
• primary — lists only primary addresses, and for IPv6 it leaves out temporary ones 👑 this flag is the inverse of temporary and secondary 🔄
• -primary — this is an alias for temporary or secondary 🌀
• proto ADDRPROTO — only shows addresses with a given protocol, or addresses where the kernel response didn't include a protocol 🧾 check the proto ADDRPROTO entry under ip address add for the details on address protocols 📖

🧹 ip address flush - flush protocol addresses

This command flushes the protocol addresses picked out by some criteria 🚿

This command takes the same arguments as show, except the type and master selectors aren't supported 🙅‍♀️ another difference is that it doesn't run when you give it no arguments 🛑

Warning: this command and the other flush commands are unforgiving. they will cruelly purge all the addresses. 💀 please don't flush blindly bestie 😭

With the -statistics option, the command gets verbose 📢 it prints out the number of deleted addresses and the number of rounds it took to flush the address list. if you give this option twice, ip address flush also dumps all the deleted addresses, in the format described in the previous subsection 🧾

---

🌸 EXAMPLES 🌸

Here's the fun stuff, let's go 💅

ip address show

Shows IPv4 and IPv6 addresses assigned to all network interfaces. the show subcommand can be left out 🫶

ip address show up

Same as above, except only addresses on active network interfaces get shown 🟢

ip address show dev eth0

Shows IPv4 and IPv6 addresses assigned to the network interface eth0 🔍

ip address add 2001:0db8:85a3::0370:7334/64 dev eth1

Adds an IPv6 address to the network interface eth1 ✨

ip address delete 2001:0db8:85a3::0370:7334/64 dev eth1

Deletes the IPv6 address we added above 👋

ip address flush dev eth4 scope global

Removes all global IPv4 and IPv6 addresses from the device eth4 🧹 without scope global, it would remove all addresses, including the IPv6 link-local ones 😱

---

🦋 SEE ALSO 🦋

ip(8) 💜

🎀 AUTHOR 🎀

Original Manpage by Michail Litvak <mci@owl.openwall.com> 🫶

---

Thanks for sticking with me through this one bestie 💖 this was the iproute2 manual page, and the date and page name are sitting right at the bottom if you want them 🌈 slay and happy addressing ✨👑