DEV Community

dpm_bush
dpm_bush

Posted on Originally published at sshflow.com

Linux Network Interfaces: Find the Right Device, State, and IP

#productivity #tutorial #devops #beginners

When a Linux machine can’t reach the network, first find out what interfaces the kernel sees and whether they have addresses. A quick check can distinguish a missing device from one that’s simply down or not configured.

Start with a compact overview

For a fast scan, run:

ip -br addr show
Enter fullscreen mode Exit fullscreen mode

You’ll get one line per interface, including its state and any assigned IP addresses. If you only need interface names and link state, use:

ip -br link show
Enter fullscreen mode Exit fullscreen mode

To print just the names, without parsing command output:

ls /sys/class/net
Enter fullscreen mode Exit fullscreen mode

That last command reads the kernel’s sysfs interface, so it’s handy in minimal environments and scripts.

Choose the command based on what you’re checking

The ip command, provided by iproute2, is the usual starting point on modern Linux systems:

ip link show
Enter fullscreen mode Exit fullscreen mode

This lists interfaces the kernel knows about, including ones that are down. To see addresses as well, use:

ip addr show
Enter fullscreen mode Exit fullscreen mode

The shorter ip a works too. For one device, pass its name:

ip addr show enp0s3
Enter fullscreen mode Exit fullscreen mode

An interface without an inet line has no assigned IPv4 address. That can be normal: it might be down, unconfigured, or using IPv6 only.

For a quick list of only interfaces marked up, use:

ip -br link show up
Enter fullscreen mode Exit fullscreen mode

Or include addresses:

ip -br addr show up
Enter fullscreen mode Exit fullscreen mode

Be careful about what “up” tells you: it means the interface is administratively enabled, not necessarily that it has a working physical connection. An Ethernet interface can be up even when no cable is plugged in.

Read the state in context

A full ip link show entry might look like this:

2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
    link/ether 08:00:27:4a:1b:3e brd ff:ff:ff:ff:ff:ff
Enter fullscreen mode Exit fullscreen mode

The interface name is enp0s3; link/ether shows its MAC address. The flags and state describe its link status. Don’t treat the interface’s existence, administrative state, and physical connectivity as the same thing.

If you need to check whether a particular Ethernet device detects a physical link, ethtool can inspect that named device:

ethtool enp0s3
Enter fullscreen mode Exit fullscreen mode

Look for its link-detection information. ethtool is for inspecting a device you already know about; use ip link show or ls /sys/class/net to discover interface names.

NetworkManager has a different view

On a system running NetworkManager, this command shows device type and connection status:

nmcli device status
Enter fullscreen mode Exit fullscreen mode

It can also show the active saved connection profile, which ip doesn’t track: ip reports kernel-level interface details, while NetworkManager manages connection profiles. This distinction is useful on laptops and desktops, especially when checking Wi-Fi connections.

Not every Linux system runs NetworkManager. Minimal servers may use another network configuration system, so nmcli might be missing or have nothing useful to report.

For wireless devices specifically, run iw dev if the iw utility is installed. For a complete list of wired, wireless, loopback, and virtual interfaces, use ip link show.

Don’t assume the interface name

You might see names such as eth0 and wlan0, or names such as enp0s3, ens33, and wlp2s0. Different naming patterns are expected across containers, virtual machines, and physical machines.

lo is the loopback interface, used by a machine to communicate with itself. Names beginning with en commonly identify Ethernet devices; names beginning with wl commonly identify wireless devices. On many systems, predictable names are based on hardware or device location rather than the order devices happened to be detected.

That’s why a configuration copied from another machine can refer to the wrong interface: confirm the actual name with ip -br link show before changing network settings.

A practical troubleshooting sequence

When a device appears to have a network problem, check in this order:

  1. Is the interface present? Run ip link show or ls /sys/class/net.
  2. Is it enabled? Check the state with ip -br link show.
  3. Does it have an address? Run ip -br addr show and look for an inet or inet6 entry.
  4. Does the connection manager report a connection? If NetworkManager is in use, run nmcli device status.
  5. Does the system have the route you expect? Interface listings show devices and addresses, not which route the system uses. For the separate question of how to inspect Linux IP addresses, check the addresses assigned to each interface; for routing, inspect the routing table.

If an expected interface is missing entirely, these commands tell you what the kernel currently sees; they don’t fix a hardware or driver detection problem. If the interface exists but has no address, focus next on its network configuration rather than assuming the device itself is absent.

Also keep the layers separate: an interface can be up without having an IP address, and an address alone doesn’t prove that a remote service is reachable. To investigate whether a service is listening locally, use tools such as ss to inspect sockets and ports.

For most checks, ip -br addr show is the useful first command. Switch to ip link show for full interface details, ls /sys/class/net for names only, and nmcli device status when you need NetworkManager’s connection state.

I originally published a more detailed version of this guide on the SSHFlow blog.

I'm also building SSHFlow — an SSH client where every server gets its own workspace for terminals, SFTP, code, and databases.

Top comments (0)