Getting the most from ifconfig

The ifconfig command can tell you a lot about your Unix server’s connection to your network and the role it’s playing in both generating and receiving network traffic.

The newer ip command does much the same thing, but you won’t find it on all varieties of Unix. Both commands will display a lot of settings and numbers associated with your network connection. Let’s look into what all those numbers and settings mean.

For starters, ifconfig stands for “interface configuration”. The command provides options for viewing as well as changing your network settings.

By itself (no options), the ifconfig command shows active network interfaces (you may have others). This is generally the primary network interface – usually eth0 – and the loopback address as shown in the example below.

$ ifconfig
eth0      Link encap:Ethernet  HWaddr 78:2B:CB:4E:B2:44
          inet addr:  Bcast:  Mask:
          inet6 addr: fe80::890:52ff:fe31:1bdb/64 Scope:Link
          RX packets:4279184 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3979015 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:618520008 (589.8 MiB)  TX bytes:827050668 (788.7 MiB)

lo        Link encap:Local Loopback
          inet addr:  Mask:
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:462 errors:0 dropped:0 overruns:0 frame:0
          TX packets:462 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:42110 (41.1 KiB)  TX bytes:42110 (41.1 KiB)

So what about all of those settings and packet counts? Which should you look at and what do they tell you? Let’s run through them.

Encap – this one tells you about the encapsulation that is in use. The encap:Ethernet entry above just tells you that the interface is connected to an Ethernet and packetizes its communications for that standard.

HWaddr – the address that is associated with the physical network adaptor. The first portion (first three octets) can also be used to identify the manufacturer of your network adaptor. The value 78:2B:CB identifies the manufacturer of this network interface as Dell. You should be able to find a number of sites online to identify the manufacturer from this information. One such site is http://www.askapache.com/online-tools/mac-lookup/.

You may encounter bonded interfaces --- an arrangement that allows a system to increase network throughput by using more than one physical interface to send traffic. In the example below, notice how the same hardware address appears to be used for three separate interfaces. The bonded interface is called bond0. That kind of gives it away. It's not a separate physical interface, but a bonding of the eth0 and eth1 interfaces.

# ifconfig -a
bond0     Link encap:Ethernet  HWaddr 78:2B:CB:4E:B2:44
          inet addr:  Bcast:  Mask:
          inet6 addr: fe80::b2a7:bcee:fe5f:a949/64 Scope:Link
          RX packets:552315 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1811373 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:50142555 (47.8 MiB)  TX bytes:2726862940 (2.5 GiB)

eth0      Link encap:Ethernet  HWaddr 78:2B:CB:4E:B2:44
          RX packets:375620 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1811373 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:32261660 (30.7 MiB)  TX bytes:2726862940 (2.5 GiB)
          Interrupt:106 Memory:d2000000-d2012100

eth1      Link encap:Ethernet  HWaddr 78:2B:CB:4E:B2:44
          RX packets:176695 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:17880895 (17.0 MiB)  TX bytes:0 (0.0 b)
          Interrupt:114 Memory:d4000000-d4012100

inet & inet6 – the IPv4 and IPv6 addresses. Yes, those IPv6 addresses are still somewhat intimidating for those of us who have spent the bulk of our careers with IPv4, but you’re likely to see more and more of them.

The status indicators – UP, BROADCAST, RUNNING, MULTICAST, MTU – tell you a range of things. Note that UP and RUNNING are not the same thing.

  • UP shows that the kernel modules needed for the interface have been loaded.
  • RUNNING tells you that the interface is ready to accept data.
  • BROADCAST tells you that the interface supports broadcasting. Note that this is necessary if a system is going to obtain its address using DHCP as it has to broadcast its request for an IP address.
  • MULTICAST tells you that the interface supports multicasting – sending packets to a select group of systems.
  • MTU (maximum transmission unit) sets the packet size, generally 1500. Notice how the packet size for the loopback interface is so much larger. These packets, of course, don’t actually have to go over the network.

RX and TX – Receive and transmit packet counts. These will probably be in the same general ballpark and larger if your system has been running a lot time or does a lot of communicating with other systems. Web servers will likely have much larger TX than RX counts. The RX and TX counts are cumulative. The RX and TX counts for loopback interfaces will likely be quite small. Try pinging the system with the “ping localhost” command and both numbers will go up.

RX and TX bytes – These show you very similar data, but as bytes rather than packets, so the numbers are considerably larger.

The errors, dropped, overruns, frame, and carrier counts will generally all be zeroes. You may be having problems with your network interface if you see numbers bigger than 0 – malformed frames or CRC (cyclical redundancy check) errors that might indicate a problem with the interface or a network cable.

Collisions should be 0 or at least a small number. Collisions indicate that the network is has so much traffic that packets are interfering with each other.

The ifconfig’s –a option allows you see all network interfaces. You can also look at a specific network interface so that you focus on that without having to scan data for other interfaces.

ifconfig –a        show all interfaces
ifconfig eth0      show just eth0

You can also bring an interface up or shut it down with variations of the ifconfig command or some convenient shortcuts.

Bring the interface up:

ifconfig eth0 up
ifup eth0

Shut the interface down:

ifconfig eth0 down
ifdown eth0

Assigning a different IP address, netmask, and broadcast address can be done piece by piece or all together in a single command such as this one:

ifconfig eth0 netmask broadcast

If you use unusual subnet sizes, you can work out the number yourself or find a nice IP calculator like http://jodies.de/ipcalc to do the thinking for you. By providing a single IP address, the number of bytes in the netmask (e.g., 24 if your netmask is, you can get your netmask, network, broadcast, first and last host IPs, and subnet size all calculated for you. Then you can be extra comfortable before running a command like this one:

ifconfig eth0 netmask broadcast

The 240 in this netmask represents the first four bits (128 + 64 + 32 + 16) in the address while the 15 in the broadcast represents the last four (8 + 4 + 2 + 1) indicating the break between the network and host portions of each IP address. Then again, these addresses depend on the particular subnet you’re working with. If the host you’re working with is, you’ll see a different broadcast address.

The netmasks you’re likely to see for subnets include these:

For groups of 128 (126 machines) - (/25)
For groups of 64 (62 machines) - (/26)
For groups of 32 (30 machines) - (/27)
For groups of 16 (14 machines) - (/28)
For groups of 8 (6 machines) - (/29)
For groups of 4 (2 machines) - (/30)

You can use ifconfig to set an interface to promiscuous mode with a command such as this:

ifconfig eth0 promisc

Promiscuous mode means the network interface will be able to capture all traffic on the network segment rather than just traffic intended for it. In general, this isn’t a good idea as it enables sniffing, though there are probably times when that is just what you need to do.

Rather than just a command to report on assigned IP addresses, ifconfig can tell you how busy your network interface is, if it permits sniffing, if your network is so busy that packets are colliding, and whether the interface is running into errors.

IDG Insider


« Apple confirms WWDC June 13-17, opens registration for ticket lottery


Companies test the waters with Facebook chatbots »
IDG News Service

The IDG News Service is the world's leading daily source of global IT news, commentary and editorial resources. The News Service distributes content to IDG's more than 300 IT publications in more than 60 countries.

  • Mail


Do you think your smartphone is making you a workaholic?