Skip to content

ip, ss and nmcli

Synopsis

ip [OPTIONS] OBJECT [COMMAND [ARGUMENTS]]
ss [OPTIONS] [state STATE-FILTER] [EXPRESSION]
nmcli [OPTIONS] OBJECT [COMMAND [ARGUMENTS]]

Description

ip and ss are part of iproute2, the userspace tools for the Linux networking stack. ip shows and changes network interfaces, addresses, routes, neighbour entries and routing policy rules, communicating with the kernel over netlink. ss lists sockets and their state. Changes made with ip take effect immediately and are not saved: they last until reboot, or until a network manager reconfigures the interface.

nmcli is the command-line client of NetworkManager. It manages connection profiles, which NetworkManager stores and applies to devices, so changes made with nmcli connection are persistent.

Checked against iproute2 6.15.0 (Debian 13), 6.17.0 (AlmaLinux 10 and Rocky Linux 10), 6.19.0 (Ubuntu 26.04), 7.0.0 (Gentoo) and 7.3.0 (Arch Linux), and NetworkManager 1.56.0 (AlmaLinux 10 and Rocky Linux 10).

Availability

iproute2 (ip, ss) NetworkManager (nmcli)
Debian/Ubuntu Package iproute2, installed by default Package network-manager; default on desktop installations, not installed on cloud images
RHEL/Alma/Rocky Package iproute, installed by default Package NetworkManager, installed and used by default
Arch Package iproute2, installed by default Package networkmanager; not installed on the cloud image
Gentoo Package sys-apps/iproute2 Package net-misc/networkmanager; not installed by default

ip

Global options

Options go before the object.

Option Description
-4, -6 Show or act on IPv4 or IPv6 only (shortcuts for -f inet, -f inet6)
-br, -brief One line per object, with the main fields only
-o, -oneline One line per record, with line breaks replaced by \
-s, -stats Include statistics (counters); repeat for more detail
-d, -details Include detailed information, such as the link type and its parameters
-j, -json JSON output; add -p (-pretty) for indented JSON
-c, -color Coloured output
-n NETNS, -netns NETNS Run the command in the named network namespace
-r, -resolve Resolve addresses to host names
-V, -Version Print the version and exit

Objects

The object and command names can be abbreviated to any unambiguous prefix: ip a is ip address show, ip r is ip route show. With no command, show (or list) is assumed.

Object Manages
link Network devices: state, MTU, name, hardware address; virtual devices
address (addr) IPv4 and IPv6 addresses on devices
route Entries in routing tables
neighbour (neigh) ARP and NDP neighbour entries
rule Routing policy rules, which select routing tables
netns, nexthop, maddress, tunnel, tuntap, vrf, monitor, … Network namespaces, nexthop objects, multicast addresses, tunnels, TUN/TAP devices, VRFs, event monitoring and other objects; see ip help
Command Description
ip link show [dev DEVICE] [up] List devices, or one device; up lists only devices that are up
ip link set DEVICE up / down Bring the device up or down
ip link set DEVICE mtu MTU Set the MTU
ip link set DEVICE name NEWNAME Rename the device (the device must be down)
ip link set DEVICE address LLADDR Set the hardware (MAC) address
ip link set DEVICE master BRIDGE / nomaster Attach the device to, or detach it from, a bridge or bond
ip link add NAME type TYPE [ARGS] Create a virtual device, for example dummy, bridge, bond, veth, vlan, macvlan or wireguard
ip link delete DEVICE Delete a virtual device

Flags in ip link show output include UP (administratively up), LOWER_UP (the physical layer reports a carrier) and NO-CARRIER; state gives the operational state (UP, DOWN, UNKNOWN, …).

ip address

Command Description
ip address show [dev DEVICE] List addresses, of all devices or one
ip address add PREFIX dev DEVICE Add an address with its prefix length, such as 192.0.2.10/24
ip address del PREFIX dev DEVICE Remove an address
ip address replace PREFIX dev DEVICE Add the address, or update it if it exists
ip address flush dev DEVICE Remove all addresses from the device (combine with -4/-6 or scope to narrow it)

Arguments for add, change and replace:

Argument Description
broadcast ADDR / brd + Set the IPv4 broadcast address; + derives it from the prefix
label LABEL IPv4 address label, shown in older tools as an alias name
scope SCOPE global, link or host
valid_lft SECONDS / preferred_lft SECONDS Address lifetimes; forever by default
metric METRIC Metric of the prefix route created for the address
noprefixroute Don't create the prefix route for the address
nodad IPv6: skip duplicate address detection

Adding an address with a prefix length also adds a route to that prefix (proto kernel scope link) to the main table, unless noprefixroute is given.

ip route

Command Description
ip route show [SELECTOR] List routes in the main table, or those matching the selector
ip route show table TABLE List a specific table; table all lists every table
ip route get ADDRESS [from ADDRESS] [iif DEVICE] [oif DEVICE] [mark MARK] [uid UID] Show the route the kernel would use for a packet, including policy rules
ip route add ROUTE Add a route; fails if an identical route exists
ip route del ROUTE Delete a route
ip route replace ROUTE Add the route, or replace an existing route to the same destination
ip route change ROUTE Change an existing route
ip route append ROUTE Add a route even if one to the same destination exists
ip route flush SELECTOR Delete all routes matching the selector

A ROUTE is a destination prefix (or default for 0.0.0.0/0 or ::/0) followed by any of:

Argument Description
via ADDRESS Next-hop gateway; must be reachable through a connected route unless onlink is given
dev DEVICE Outgoing device
src ADDRESS Preferred source address for packets to this destination
metric NUMBER Route priority; among routes with the same prefix, the lowest wins
table TABLE Routing table: main (the default), local, default, a number or a name from the rt_tables file
proto PROTO Origin recorded with the route: kernel, boot (the default for add), static, dhcp or a number
scope SCOPE global, link (destination directly reachable) or host
onlink Treat the gateway as directly reachable on the device, without a connected route
mtu NUMBER Path MTU for the destination
nexthop via ADDRESS dev DEVICE weight N … Multipath route with several weighted next hops

Route types, given before the prefix (for example ip route add blackhole 198.51.100.0/24): unicast (the default), local, broadcast, multicast, blackhole (discard silently), unreachable and prohibit (discard and return an ICMP error), throw (continue with the next policy rule).

ip neighbour

Command Description
ip neigh show [dev DEVICE] [nud STATE] List neighbour entries, optionally for one device or state
ip neigh get ADDRESS dev DEVICE Show one entry
ip neigh add ADDRESS lladdr LLADDR dev DEVICE [nud STATE] Add an entry, for example a permanent one
ip neigh replace ADDRESS lladdr LLADDR dev DEVICE Add or update an entry
ip neigh del ADDRESS dev DEVICE Delete an entry
ip neigh flush dev DEVICE Delete the entries of a device

Neighbour states (nud): permanent, noarp, reachable, stale, delay, probe, incomplete, failed, none.

ip rule

Command Description
ip rule show List policy rules in priority order
ip rule add SELECTOR ACTION [pref NUMBER] Add a rule; lower pref values are evaluated first
ip rule del SELECTOR ACTION / ip rule del pref NUMBER Delete a rule
Selector Matches
from PREFIX / to PREFIX Source or destination address
iif DEVICE / oif DEVICE Incoming or outgoing device
fwmark MARK[/MASK] Firewall mark set by netfilter
uidrange START-END User ID of a local process
ipproto PROTOCOL, sport PORT, dport PORT IP protocol and port numbers
tos TOS, dscp DSCP Type of service or DSCP value
not Inverts the selector
Action Effect
table TABLE Look up the route in this table
goto NUMBER Continue with the rule of that priority
suppress_prefixlength N Ignore a result from the table whose prefix length is N or less
blackhole Drop the packet silently, without a table lookup
unreachable Drop the packet and report "Network is unreachable"
prohibit Drop the packet and report "Communication is administratively prohibited"

The selector and action tables list the common forms; ip-rule(8) describes the rest. The default rules are 0: from all lookup local, 32766: from all lookup main and 32767: from all lookup default.

ss

Options

Option Description
-t, --tcp TCP sockets
-u, --udp UDP sockets
-x, --unix Unix domain sockets
-w, --raw Raw sockets
-4, -6 IPv4 or IPv6 sockets only
-l, --listening Listening sockets only
-a, --all Listening and non-listening sockets
-n, --numeric Don't resolve service names (show port numbers)
-r, --resolve Resolve host names
-p, --processes Show the process using each socket; other users' processes need root
-e, --extended Detailed socket information, such as the UID and inode
-o, --options Timer information
-i, --info Internal TCP information (congestion window, RTT, …)
-m, --memory Socket memory usage
-s, --summary Summary counts by socket type
-H, --no-header Omit the header line
-K, --kill Forcibly close the matching sockets (needs root and kernel support)
-N NETNS, --net=NETNS Switch to the named network namespace

Without -t, -u or a similar option, ss lists sockets of all types; without -a or -l, it lists only non-listening (established and similar) sockets.

Filters

A filter is an optional state filter followed by an expression.

Element Description
state STATE / exclude STATE TCP states to include or exclude: established, syn-sent, syn-recv, fin-wait-1, fin-wait-2, time-wait, closed, close-wait, last-ack, listening, closing; groups all, connected, synchronized, bucket, big
dst HOST / src HOST Remote or local address, as ADDRESS, PREFIX or ADDRESS:PORT (IPv6 addresses in brackets)
dport OP :PORT / sport OP :PORT Remote or local port; OP is =, !=, <, <=, >, >= (or eq, ne, lt, le, gt, ge)
dev DEVICE Sockets bound to or using the device
and, or, not, ( ) Combine predicates; adjacent predicates are joined with and

Ports can be given as numbers or service names (:22 or :ssh). Quote expressions that contain parentheses or < and > so the shell doesn't interpret them.

nmcli

Global options

Option Description
-t, --terse Terse output for scripts
-f FIELDS, --fields FIELDS Fields to show (all, common or a comma-separated list)
-g FIELDS, --get-values FIELDS Print only the values of the fields (shortcut for -m tabular -t -f)
-p, --pretty Output formatted for people
-m MODE, --mode MODE tabular or multiline
-s, --show-secrets Include passwords and keys in the output
-a, --ask Prompt for missing arguments
-w SECONDS, --wait SECONDS Timeout for operations that wait
-o, --overview Overview mode: hide properties that have their default value
-c MODE, --colors MODE Coloured output: auto, yes or no
-e yes\|no, --escape yes\|no Escape column separators in values
-v, --version Print the version and exit
-h, --help Print help

Objects and commands

Object and command names can be abbreviated: nmcli c s is nmcli connection show.

Command Description
nmcli general status Overall NetworkManager state and connectivity
nmcli general hostname [NAME] Show or set the persistent host name
nmcli networking on / off Enable or disable all networking managed by NetworkManager
nmcli radio wifi on / off Switch the Wi-Fi radio
nmcli device status Devices, their state and active connection profile
nmcli device show [DEVICE] Device details, including addresses, routes and DNS
nmcli device connect DEVICE / disconnect DEVICE Activate the best profile on the device, or deactivate it (and stop automatic reconnection)
nmcli device reapply DEVICE Apply changes to the active profile without fully deactivating it
nmcli device set DEVICE managed yes / no Let NetworkManager manage the device, or leave it alone
nmcli connection show [--active] [ID] List profiles, or show all properties of one
nmcli connection up ID / down ID Activate or deactivate a profile
nmcli connection add type TYPE [ifname DEVICE] [con-name NAME] [PROPERTY VALUE …] Create a profile
nmcli connection modify ID [+\|-]PROPERTY VALUE … Change a stored profile; + adds to a list property, - removes from it
nmcli connection delete ID Delete a profile
nmcli connection reload Reload profiles changed on disk
nmcli connection load FILE Load or reload one profile file
nmcli monitor Print NetworkManager state changes as they happen

ID is the profile name, or uuid UUID. connection modify changes only the stored profile; the change applies to the device on the next connection up or device reapply.

Common properties:

Property Description
connection.autoconnect yes or no: activate the profile automatically
connection.interface-name (ifname) Device the profile is bound to
ipv4.method auto (DHCP), manual, link-local, shared (share the connection with other hosts), disabled
ipv6.method auto (router advertisements, and DHCPv6 when they ask for it), dhcp (DHCPv6 only), manual, link-local, shared, ignore (leave IPv6 alone), disabled
ipv4.addresses / ipv6.addresses Static addresses with prefix length, comma-separated
ipv4.gateway / ipv6.gateway Default gateway
ipv4.dns / ipv6.dns DNS servers
ipv4.routes / ipv6.routes Static routes as PREFIX [NEXT-HOP] [METRIC], comma-separated
ipv4.route-metric / ipv6.route-metric Metric of the profile's routes
ipv4.never-default yes: never use this profile for the default route

Examples

ip -br addr show                                  # addresses, one line per device
ip -4 route show                                  # IPv4 routes in the main table
ip route get 203.0.113.25                         # the route used for one destination
sudo ip route add 203.0.113.0/24 via 192.0.2.1    # a temporary static route
ip neigh show dev enp0s4                          # neighbour entries on one device
ip rule show                                      # policy rules
ss -tlnp                                          # listening TCP sockets with processes
ss -tn state established '( dport = :22 or sport = :22 )'
nmcli device status
sudo nmcli connection modify enp0s4 +ipv4.routes "203.0.113.0/24 192.0.2.1"

Files

Path Purpose
/usr/share/iproute2/rt_tables Default names for routing table numbers, as installed on all the distributions checked
/etc/iproute2/rt_tables, /etc/iproute2/rt_tables.d/*.conf Local names for routing table numbers; not present by default
/proc/net/route, /proc/net/ipv6_route Kernel routing tables, as read by older tools
/etc/NetworkManager/NetworkManager.conf, /etc/NetworkManager/conf.d/ NetworkManager configuration
/etc/NetworkManager/system-connections/ Persistent NetworkManager connection profiles (keyfile format)
/run/NetworkManager/system-connections/ Profiles that last until reboot, such as automatically created ones

See also