Reading Linux Network State with the ip Command

When a Linux machine can’t reach a network, start by separating three questions: does the interface exist and have a link, does it have an address, and does the system have a route to the destination? The ip command helps answer those questions without changing anything.

Start with a read-only snapshot

The ip utility is part of iproute2, a standard Linux networking toolset. Its general form is ip [OPTIONS] OBJECT COMMAND; the object selects what you want to inspect or manage.

ip -br addr
ip route
ip link

ip -br addr shows addresses and interfaces in a compact format. ip route prints the routing table, while ip link lists network interfaces and their link state. These inspection commands normally don’t need sudo.

If you need to identify the interface name first, ip link lists available links. Names vary between machines: you might see enp1s0, ens18, or wlan0, so don’t assume a name from an example exists on your system. For more ways to list Linux network interfaces, including alternative commands, use the one that fits your environment.

Find and understand an address

To see all addresses in more detail, run:

ip addr show

You can narrow the output to IPv4 or IPv6, or inspect one interface:

ip -4 addr show
ip -6 addr show
ip addr show dev enp1s0

Replace enp1s0 with an interface name from your own output. For a concise view of just IPv4 addresses, use ip -br -4 addr.

An entry such as inet 192.0.2.25/24 contains an IPv4 address and a CIDR prefix length. inet6 identifies an IPv6 address. The prefix is part of the interface’s network configuration; it isn’t another portion of the address. The lo interface is loopback, used for communication within the same host.

An address marked dynamic was assigned dynamically. Address output tells you what is configured locally, but it doesn’t prove that another machine can reach you. It also doesn’t necessarily show your public internet address: a host behind NAT can have a private local address while its router uses a separate public address. If you’re trying to find the address to use when connecting to a machine, this guide to finding your IP address in Linux explains the local-versus-public distinction.

Check the route, not just the address

A machine can have an IP address and still lack a usable route to its destination. To inspect the routing table, run:

ip route

A line beginning with default via identifies the default gateway and the outgoing interface used for destinations without a more specific route. To ask the kernel which route it would choose for a particular destination, run:

ip route get 1.1.1.1

This reports the selected route. It does not test whether the destination responds or whether the full connection works. Check the actual service or connection separately when reachability is the question.

For local network peers, ip neigh show displays cached neighbor entries, such as IPv4 ARP and IPv6 neighbor-discovery information. A missing or stale neighbor entry can be useful context, but it isn’t a complete diagnosis by itself.

Make runtime changes carefully

The ip command can change the kernel’s current network state. For example, to bring an interface up or down:

sudo ip link set dev enp1s0 up
sudo ip link set dev enp1s0 down

To add a temporary address, use an address and interface appropriate for your network:

sudo ip addr add 192.0.2.50/24 dev enp1s0
ip addr show dev enp1s0

The address above is documentation-only; don’t copy it as a real network setting. Adding an address doesn’t automatically set up routes, DNS, or a network manager’s persistent configuration. Remove a specific address with ip addr del, or use ip addr replace to add it if absent or update the matching entry.

Be especially cautious over SSH. Bringing down the interface carrying your session, or changing its address or route, can disconnect you immediately. Before making remote network changes, make sure you have console or out-of-band access and a recovery plan. Verify the interface and values rather than copying a sample command blindly.

Changes made directly with ip are runtime changes. They generally last only until configuration is reapplied, the interface is reset, or the system restarts; the exact behavior can depend on the network manager. If an address needs to survive a reboot, configure the active network manager—such as Netplan, NetworkManager, or ifupdown—instead. Avoid having both manual commands and a network manager configure the same interface unless you understand which one owns it.

A quick troubleshooting sequence

If the output doesn’t match what you expect, work through these checks:

1. No expected interface? Run ip link and confirm the device name. Cannot find device often means the name is wrong or the device isn’t present.
2. Interface exists, but traffic fails? Check its link state with ip link, then inspect its addresses with ip addr.
3. Address is present? Check ip route for a route to the destination or a default gateway.
4. A runtime change disappears? The system’s network manager may have reapplied its configuration. Use that manager for persistent settings.
5. Permission error while changing state? Use sudo where appropriate. Don’t add elevated privileges to read-only inspection commands unless needed.

The useful distinction is simple: ip addr shows local addresses, ip link shows interfaces and their state, and ip route shows forwarding choices. Inspect first; make changes only when you know which part of the network configuration needs attention.

I originally published a more detailed version of this guide on the SSHFlow blog.

I'm also building SSHFlow — an SSH client where every server gets its own workspace for terminals, SFTP, code, and databases.