This is actually very unlike a man page. It assumes that you know very little about
TCP/IP networking. It also deals with only the parameter-less
ifconfig, since other invocations are well documented
in the real man page.
You can read the sections independently of one another, skipping what you already know. In this regard, it is quite like a man page.
What is ifconfig?
ifconfig is a systems administration utility for UNIX-like systems
that allows for diagnosing and configuring network
interfaces. Although some claim that it is being replaced with
iproute2 (or simply the
ip command), I
have seen it being used abundantly.
You can using
ifconfig to bring up interfaces, turn them off, and configure
the protocols and identifiers they use.
Why document it?
ifconfig prints out a wealth of information if invoked
without any parameters and options. I simply could not find the
definitions of most of these things and what follows
is my attempt at documenting these exhaustively.
This is what we see when we invoke GNU
ifconfig on a virtual host running
Ubuntu. Note the absence of a wifi interface, as is the case with most
$ ifconfig eth0 Link encap:Ethernet HWaddr 08:00:27:0c:49:47 inet addr:192.168.0.121 Bcast:192.168.0.255 Mask:255.255.255.0 inet6 addr: fe80::a00:27ff:fe0c:4947/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:3461 errors:0 dropped:0 overruns:0 frame:0 TX packets:3686 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:1778710 (1.7 MB) TX bytes:821363 (821.3 KB) Interrupt:10 Base address:0xd020 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:12 errors:0 dropped:0 overruns:0 frame:0 TX packets:12 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:720 (720.0 B) TX bytes:720 (720.0 B)
The Ethernet Interface
eth0 Link encap:Ethernet HWaddr 08:00:27:0c:49:47
Application data is progressively encapsulated as it descends through
the layers of the TCP/IP Stack.
Link encap:Ethernet means that IP
Datagrams coming from the Internet layer will be wrapped in an Ethernet
Frame before leaving this interface.
HWaddr 08:00:27:0c:49:47 is the 48 bit Media Access Control (MAC) address. It uniquely
identifies this network interface on the hardware layer. This address
will be sent in ARP (Address Resolution Protocol) reponse packets when other devices want to send
Ethernet Frames to this interface.
The IPv4 address
eth0 inet addr:192.168.0.121 Bcast:192.168.0.255 Mask:255.255.255.0
inet addr:192.168.0.121 needs no introduction, it is the 32 bit IPv4 address that
this interface is using. Wanting to know this address is also probably the most common reason
Modern networking relies on slicing networks
into smaller portions using subnetting and Classless
Inter-Domain Routing (CIDR).
For subnetting to work, we need to understand what part of
an IP address is the Network ID and what part is the Host ID. This
information is carried in the Network Mask
Bcast:192.168.0.255 is the broadcast address of the subnetwork the interface is
on. Packets sent to this address will be received by all interfaces
on this subnet.
We get this the broadcast address by masking the IP Address with a bit complement of the network mask
Mask:255.255.255.0 like this –
Network Mask: 255 . 255 . 255 . 0 Complement all bits: 0 . 0 . 0 . 255 Original IP address: 192 . 168 . 0 . 121 _____________________ OR them bitwise: 192 . 168 . 0 . 255 Which is the Broadcast Address
Next, let’s go over the IPv6 address
I never paid much attention to IPv6 addresses in the past. However, it isn’t too complicated to get to the bottom of it. Your local IPv6 addresses are essentially based on the MAC address of the interface.
eth0 inet6 addr: fe80::a00:27ff:fe0c:4947/64 Scope:Link
fe80::a00:27ff:fe0c:4947/64 is the 128 bit link-local IPv6 address
for the interface. We understand that it is a link-local address
because of the
Scope:Link field. Link-local IPv6 addresses are for
communicating with the directly attached network, and not globally.
This is how all link-local addresses are laid out: 10 bytes | 54 bytes | 64 bytes 1111 1110 10 | All Zeroes | Interface Identifier Let's see whether our IPv6 address conforms to this pattern: fe80::a00:27ff:fe0c:4947 (we replace :: with multiple all-zero double-octets) fe80:0000:0000:0000 : 0a00:27ff:fe0c:4947 PREFIX | INTERFACE IDENTIFER All these zeroes make a | This looks a lot similiar link-local IPv6 address | to the MAC address which non-routable | is '08:00:27:0c:49:47'
The Interface Identifier is in fact usually made up using the MAC address. This is called EUI-64, or Extended Unique Indentifier by the IEEE.
08:00:27:0c:49:47 # Start with the MAC adress 08:00:27:ff:fe:0c:49:47 # Insert ff:fe in the center 0a:00:27:ff:fe:0c:49:47 # Invert the 7th MSB starting from the right 0a00:27ff:fe0c:4947 # Group it into double octets!
More about the interface
eth0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
UP means that network interface is activated (with address and routing
tables) and is accessible to the IP layer.
BROADCAST means that interface supports broadcasting (and can hence obtain
an IP address using DHCP).
RUNNING signifies that the network driver has been loaded and has
initialized the interface.
MULTICAST tells us that multicasting support is enabled on this
Since we didn’t invoke
ifconfig with the
--all flag, it will only
print out interfaces that are currently
MTU 1500 shows that the current
Maximum Transmission Unit is set to 1500 bytes, the largest
allowed over Ethernet. Any IP datagrams larger than 1500 bytes will be
fragmented into multiple Ethernet Frames, if allowed by the routers
and hosts in between. Else we’ll just get an ICMP
Unreachable response with Code 4.
Metric:1 is the cost associated with routing frames
over this interface. Normally, Linux kernels don’t build routing
tables based on metrics. This value is only present for
compatibility. If you do try to change the metric, it may not work. 
$ sudo ifconfig eth0 metric 2 SIOCSIFMETRIC: Operation not supported
eth0 RX packets:3461 errors:0 dropped:0 overruns:0 frame:0 TX packets:3686 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:1778710 (1.7 MB) TX bytes:821363 (821.3 KB)
RX stands for received and
TX stands for transmitted.
Documentation for the fields that follow is sparse and only
long-deserted ghost-town forums popped up in my searches.
I download the source code for
GNU inetutils 1.9.1
and here are my findings after a few recursive greps:
RX packets: total number of packets received.
RX errors: an aggregation of the total number of packets received
with errors. This includes too-long-frames errors, ring-buffer overflow errors, crc errors,
frame alignment errors, fifo overruns, and missed packets.
The ring-buffer refers to a buffer that the NIC transfers frames to before raising an IRQ with the kernel.
RX overruns field displays fifo overruns, which are
caused by the rate at which the ring-buffer is drained being higher
that the kernel being able to handle IO.
RX frame accounts for the incoming frames that were misaligned.
TX packets indicate the total number of transmitted packets.
TX errors present a summation of errors encountered while
transmitting packets. This list includes errors due to the
transmission being aborted, errors due to the carrier, fifo errors,
heartbeat errors, and window errors. This particular
struct in the source code
We also have itemized error counts for
collisions is the number of transmissions terminated due to CSMA/CD
(Carrier Sense Multiple Access with Collision Detection).
The final line is merely all successfully received and transmitted data in bytes and a human readable format.
Transmit Queue Length
Since this isn’t a statistic, it gets its own heading.
txqueuelen field displays the current Transmit
This queue limits the number of frames in the interface’s device driver that are queued for
The value of the
txqueuelen can also be set by the
eth0 Interrupt:10 Base address:0xd020
Interrupt:10 corresponds to the IRQ number against which to look up
eth0 device in
/proc/interrupts, where the interrupts are counted.
$ cat /proc/interrupts CPU0 0: 115 XT-PIC-XT-PIC timer 1: 3402 XT-PIC-XT-PIC i8042 2: 0 XT-PIC-XT-PIC cascade 5: 1 XT-PIC-XT-PIC snd_intel8x0 8: 0 XT-PIC-XT-PIC rtc0 9: 0 XT-PIC-XT-PIC acpi => 10: 53981 XT-PIC-XT-PIC eth0 <= 11: 1535 XT-PIC-XT-PIC ohci_hcd:usb1 12: 146 XT-PIC-XT-PIC i8042 14: 16923 XT-PIC-XT-PIC ata_piix 15: 10416 XT-PIC-XT-PIC ata_piix
53981 is the number of times the
eth0 device has interrupted
The third column tells the name of the programmable interrupt handler, and
XT-PIC-XT-PIC may be something that my VirtualBox is doing.
The Loopback Interface
lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:12 errors:0 dropped:0 overruns:0 frame:0 TX packets:12 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:720 (720.0 B) TX bytes:720 (720.0 B)
The Loopback is not an Ethernet device.
It isn’t connected to the NIC (or any hardware) and frames relayed over
the loopback don’t exit the host on any layer. It is fully implemented
in software. This also means that IP Datagrams sent over this
interface are not encapsulted in an Ethernet frame, as can be seen by
Link encap:Local Loopback.
lo inet addr:127.0.0.1 Mask:255.0.0.0
We have a large address space as set by the liberal subnet mask –
The loopback device can be configured with an IP address on the
127.0.0.0/8 subnetwork which can be any address between
127.255.255.254. The loopback address on my machine is
127.0.0.1, which is usually the default.
And the IPv6
lo inet6 addr: ::1/128 Scope:Host
Unlike IPv4, only one address is reserved for the loopback interface in
the IPv6 address space –
0:0:0:0:0:0:0:1. It represented more
::1/128 since we can replace consecutive groups of
The IPv6 Scope for the loopback address
::1/128 and is treated under the
link-local scope in RFC 3513. The terminology
Scope:Node is also used to further emphasize that the packet will never exit the host
(or node). Unlike other link-local addresses, if a packet addressed
::1/128 is received on an Ethernet interface, it is promptly dropped.
lo UP LOOPBACK RUNNING MTU:16436 Metric:1
LOOPBACK flag in the flags string isn’t as interesting
MTU:16436. Since the loopback interface isn’t bounded by the
physical limitations of Ethernet or FDDI, its MTU is set to more than
We can send a
16 x 1024 = 16384 byte data packet, with an additional
52 bytes without fragmenting it.
52 bytes are usually sufficient
for TCP and IP headers (both are 20 bytes long without options).
The concept of
Metric is the same as it was for Ethernet interface above.
Statistics and Transmit Queue Length
lo RX packets:12 errors:0 dropped:0 overruns:0 frame:0 TX packets:12 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0
The fields for loopback statistics are printed out by the same
function and retain the same definitions from the Ethernet piece
above. However, errors and collisions have little chance of making an
appearance here, since there isn’t a physical medium present.
txqueuelen is set to
0 by default. It can be changed for the
lo device, but I doubt if that would have any effect.
Don’t like GNU
ifconfig or don’t have it? No problem, there are a few other ways of
querying a system for similar information.
netstat -ai and
ifconfig also work on Mac
OS X, but the output is slightly different since both tools originate
from the BSD userland.
$ ip --statistics link list 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN mode DEFAULT link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 RX: bytes packets errors dropped overrun mcast 67710 812 0 0 0 0 TX: bytes packets errors dropped carrier collsns 67710 812 0 0 0 0 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN mode DEFAULT qlen 1000 link/ether 08:00:27:89:cf:84 brd ff:ff:ff:ff:ff:ff RX: bytes packets errors dropped overrun mcast 10372230 53359 9 0 0 0 TX: bytes packets errors dropped carrier collsns 206555 1826 0 0 0 0
netstat, on which the
ifconfig output is actually based on –
$ netstat --all --interfaces Kernel Interface table Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg eth0 1500 0 56092 10 0 0 3095 0 0 0 BMRU lo 16436 0 858 0 0 0 858 0 0 0 LRU
Flg field above shows us the status of the interfaces.
stands for Broadcast, Multicast, Running, and Up.
LRU stands for
Loopback, Running, and Up.
- Cotton, M., & Vegoda, L. (2010). Special Use IPv4 Addresses. Internet Engineering Taskforce RFC 5735.
- Domingo, D. & Bailey, L. (Eds.). (2011). Red Hat Enterprise Linux 6 Performance Tuning Guide. Red Hat, Incorporated.
- Fall, K. R., & Stevens, W. R. (2011). TCP/IP Illustrated, Volume 1: The Protocols (Vol. 1). Addison-Wesley Professional.
- Hinden, R. M., & Deering, S. E. (2003). Internet protocol version 6 (IPv6) addressing architecture. Internet Engineering Taskforce RFC 3513.
- Hunt, C. (2002). TCP/IP network administration. O’Reilly Media, Incorporated.
- Kempen, F., Cox, A., Blundell, P., Kleen, A., Eckenfels, B. (2007). ifconfig(8) Manual Page.
- Kirch, O., & Dawson, T. (2000). Linux network administrator’s guide. O’Reilly Media, Incorporated.