IP(8) Linux IP(8) NAME ip−show/manipulaterouting,devices,policyroutingandtunnels SYNOPSIS ip[OPTIONS]OBJECT{COMMAND|help} OBJECT:={link|addr|route|rule|neigh|tunnel|maddr|mroute|monitor} OPTIONS:={−V[ersion]|−s[tatistics]|−r[esolve]|−f[amily]{inet|inet6|ipx|dnet| link}|−o[neline]} iplinksetDEVICE{up|down|arp{on|off}| promisc{on|off}| allmulti{on|off}| dynamic{on|off}| multicast{on|off}| txqueuelenPACKETS| nameNEWNAME| addressLLADDR|broadcastLLADDR| mtuMTU} iplinkshow[DEVICE] ipaddr{add|del}IFADDRdevSTRING ipaddr{show|flush}[devSTRING][scopeSCOPE-ID][toPREFIX][FLAG-LIST] [labelPATTERN] IFADDR:=PREFIX|ADDRpeerPREFIX[broadcastADDR][anycastADDR][label STRING][scopeSCOPE-ID] SCOPE-ID:=[host|link|global|NUMBER] FLAG-LIST:=[FLAG-LIST]FLAG FLAG:=[permanent|dynamic|secondary|primary|tentative|deprecated] iproute{list|flush}SELECTOR iproutegetADDRESS[fromADDRESSiifSTRING][oifSTRING][tosTOS] iproute{add|del|change|append|replace|monitor}ROUTE SELECTOR:=[rootPREFIX][matchPREFIX][exactPREFIX][tableTABLEID][ protoRTPROTO][typeTYPE][scopeSCOPE] ROUTE:=NODESPEC[INFOSPEC] NODESPEC:=[TYPE]PREFIX[tosTOS][tableTABLEID][protoRTPROTO][ scopeSCOPE][metricMETRIC] INFOSPEC:=NHOPTIONSFLAGS[nexthopNH]... iproute2 17January2002 1 IP(8) Linux IP(8) NH:=[viaADDRESS][devSTRING][weightNUMBER]NHFLAGS OPTIONS:=FLAGS[mtuNUMBER][advmssNUMBER][rttNUMBER][rttvar NUMBER][windowNUMBER][cwndNUMBER][ssthreshREALM][ realmsREALM] TYPE:=[unicast|local|broadcast|multicast|throw|unreachable|prohibit|blackhole|nat] TABLEID:=[local|main|default|all|NUMBER] SCOPE:=[host|link|global|NUMBER] FLAGS:=[equalize] NHFLAGS:=[onlink|pervasive] RTPROTO:=[kernel|boot|static|NUMBER] iprule[list|add|del]SELECTORACTION SELECTOR:=[fromPREFIX][toPREFIX][tosTOS][fwmarkFWMARK][dev STRING][prefNUMBER] ACTION:=[tableTABLEID][natADDRESS][prohibit|reject|unreachable][ realms[SRCREALM/]DSTREALM] TABLEID:=[local|main|default|NUMBER] ipneigh{add|del|change|replace}{ADDR[lladdrLLADDR][nud{permanent| noarp|stale|reachable}]|proxyADDR}[devDEV] ipneigh{show|flush}[toPREFIX][devDEV][nudSTATE] iptunnel{add|change|del|show}[NAME] [mode{ipip|gre|sit}] [remoteADDR][localADDR] [[i|o]seq][[i|o]keyKEY][[i|o]csum]] [ttlTTL][tosTOS][[no]pmtudisc] [devPHYSDEV] ADDR:={IPADDRESS|any} TOS:={NUMBER|inherit} TTL:={1..255|inherit} KEY:={DOTTEDQUAD|NUMBER} ipmaddr[add|del]MULTIADDRdevSTRING ipmaddrshow[devSTRING] ipmrouteshow[PREFIX][fromPREFIX][iifDEVICE] iproute2 17January2002 2 IP(8) Linux IP(8) ipmonitor[all|LISTofOBJECTS] OPTIONS −V,-Version printtheversionoftheiputilityandexit. −s,−stats,−statistics outputmoreinformation.Iftheoptionappearstwiceormore,theamountofinformation increases.Asarule,theinformationisstatisticsorsometimevalues. −f,−family followedbyprotocolfamilyidentifier:inet,inet6orlink,enforcetheprotocolfamilyto use.Iftheoptionisnotpresent,theprotocolfamilyisguessedfromotherarguments.If therestofthecommandlinedoesnotgiveenoughinformationtoguessthefamily,ip fallsbacktothedefaultone,usuallyinetorany.linkisaspecialfamilyidentifier meaningthatnonetworkingprotocolisinvolved. −4shortcutfor-familyinet. −6shortcutfor−familyinet6. −0shortcutfor−familylink. −o,−oneline outputeachrecordonasingleline,replacinglinefeedswiththe’´ character.Thisisconvenientwhenyouwanttocountrecordswithwc(1) ortogrep(1)theoutput. −r,−resolve usethesystem’snameresolvertoprintDNSnamesinsteadofhostaddresses. IP-COMMANDSYNTAX OBJECT link-networkdevice. address -protocol(IPorIPv6)addressonadevice. neighbour -ARPorNDISCcacheentry. route-routingtableentry. rule-ruleinroutingpolicydatabase. maddress -multicastaddress. iproute2 17January2002 3 IP(8) Linux IP(8) mroute -multicastroutingcacheentry. tunnel -tunneloverIP. Thenamesofallobjectsmaybewritteninfullorabbreviatedform,f.e.addressisabbreviated asaddrorjusta. COMMAND Specifiestheactiontoperformontheobject.Thesetofpossibleactionsdependsontheobject type.Asarule,itispossibletoadd,deleteandshow(orlist)objects,butsomeobjectsdo notallowalloftheseoperationsorhavesomeadditionalcommands.Thehelpcommandisavailableforallobjects.Itprintsoutalistofavailablecommandsandargumentsyntaxconventions. Ifnocommandisgiven,somedefaultcommandisassumed.Usuallyitislistor,iftheobjectsof thisclasscannotbelisted,help. iplink-networkdeviceconfiguration linkisanetworkdeviceandthecorrespondingcommandsdisplayandchangethestateofdevices. iplinkset-changedeviceattributes devNAME(default) NAMEspecifiesnetworkdevicetooperateon. upanddown changethestateofthedevicetoUPorDOWN. arponorarpoff changetheNOARPflagonthedevice. multicastonormulticastoff changetheMULTICASTflagonthedevice. dynamiconordynamicoff changetheDYNAMICflagonthedevice. nameNAME changethenameofthedevice.Thisoperationisnotrecommendedifthedeviceisrunningorhassomeaddressesalreadyconfigured. txqueuelenNUMBER txqlenNUMBER changethetransmitqueuelengthofthedevice. mtuNUMBER changetheMTUofthedevice. iproute2 17January2002 4 IP(8) Linux IP(8) addressLLADDRESS changethestationaddressoftheinterface. broadcastLLADDRESS brdLLADDRESS peerLLADDRESS changethelinklayerbroadcastaddressorthepeeraddresswhentheinterfaceis POINTOPOINT. Warning:Ifmultipleparameterchangesarerequested,ipabortsimmediatelyafteranyofthe changeshavefailed.Thisistheonlycasewhenipcanmovethesystemtoanunpredictablestate. Thesolutionistoavoidchangingseveralparameterswithoneiplinksetcall. iplinkshow-displaydeviceattributes devNAME(default) NAMEspecifiesthenetworkdevicetoshow.Ifthisargumentisomittedalldevicesare listed. uponlydisplayrunninginterfaces. ipaddress-protocoladdressmanagement. Theaddressisaprotocol(IPorIPv6)addressattachedtoanetworkdevice.Eachdevicemust haveatleastoneaddresstousethecorrespondingprotocol.Itispossibletohaveseveraldifferent addressesattachedtoonedevice.Theseaddressesarenotdiscriminated,sothatthetermaliasis notquiteappropriateforthemandwedonotuseitinthisdocument. Theipaddrcommanddisplaysaddressesandtheirproperties,addsnewaddressesanddeletes oldones. ipaddressadd-addnewprotocoladdress. devNAME thenameofthedevicetoaddtheaddressto. localADDRESS(default) theaddressoftheinterface.Theformatoftheaddressdependsontheprotocol.Itisa dottedquadforIPandasequenceofhexadecimalhalfwordsseparatedbycolonsforIPv6. TheADDRESSmaybefollowedbyaslashandadecimalnumberwhichencodesthenetworkprefixlength. peerADDRESS theaddressoftheremoteendpointforpointopointinterfaces.Again,theADDRESSmay befollowedbyaslashandadecimalnumber,encodingthenetworkprefixlength.Ifa peeraddressisspecified,thelocaladdresscannothaveaprefixlength.Thenetworkprefixisassociatedwiththepeerratherthanwiththelocaladdress. broadcastADDRESS thebroadcastaddressontheinterface. Itispossibletousethespecialsymbols’+’and’-’insteadofthebroadcastaddress.In thiscase,thebroadcastaddressisderivedbysetting/resettingthehostbitsofthe iproute2 17January2002 5 IP(8) Linux IP(8) interfaceprefix. labelNAME Eachaddressmaybetaggedwithalabelstring.Inordertopreservecompatibilitywith Linux-2.0netaliases,thisstringmustcoincidewiththenameofthedeviceormustbe prefixedwiththedevicenamefollowedbycolon. scopeSCOPEVALUE thescopeoftheareawherethisaddressisvalid.Theavailablescopesarelistedinfile /etc/iproute2/rtscopes.Predefinedscopevaluesare: global-theaddressisgloballyvalid. site-(IPv6only)theaddressissitelocal,i.e.itisvalidinsidethissite. link-theaddressislinklocal,i.e.itisvalidonlyonthisdevice. host-theaddressisvalidonlyinsidethishost. ipaddressdelete-deleteprotocoladdress Arguments:coincidewiththeargumentsofipaddradd.Thedevicenameisarequiredargument.Therestareoptional.Ifnoargumentsaregiven,thefirstaddressisdeleted. ipaddressshow-lookatprotocoladdresses devNAME(default) nameofdevice. scopeSCOPEVAL onlylistaddresseswiththisscope. toPREFIX onlylistaddressesmatchingthisprefix. labelPATTERN onlylistaddresseswithlabelsmatchingthePATTERN.PATTERNisausualshellstyle pattern. dynamicandpermanent (IPv6only)onlylistaddressesinstalledduetostatelessaddressconfigurationoronlylist permanent(notdynamic)addresses. tentative (IPv6only)onlylistaddresseswhichdidnotpassduplicateaddressdetection. deprecated (IPv6only)onlylistdeprecatedaddresses. primaryandsecondary onlylistprimary(orsecondary)addresses. iproute2 17January2002 6 IP(8) Linux IP(8) ipaddressflush-flushprotocoladdresses Thiscommandflushestheprotocoladdressesselectedbysomecriteria. Thiscommandhasthesameargumentsasshow.Thedifferenceisthatitdoesnotrunwhenno argumentsaregiven. Warning:Thiscommand(andotherflushcommandsdescribedbelow)isprettydangerous.If youmakeamistake,itwillnotforgiveit,butwillcruellypurgealltheaddresses. Withthe-statisticsoption,thecommandbecomesverbose.Itprintsoutthenumberofdeleted addressesandthenumberofroundsmadetoflushtheaddresslist.Ifthisoptionisgiventwice, ipaddrflushalsodumpsallthedeletedaddressesintheformatdescribedintheprevioussubsection. ipneighbour-neighbour/arptablesmanagement. neighbourobjectsestablishbindingsbetweenprotocoladdressesandlinklayeraddressesfor hostssharingthesamelink.Neighbourentriesareorganizedintotables.TheIPv4neighbourtableisknownbyanothername-theARPtable. Thecorrespondingcommandsdisplayneighbourbindingsandtheirproperties,addnewneighbour entriesanddeleteoldones. ipneighbouradd-addanewneighbourentry ipneighbourchange-changeanexistingentry ipneighbourreplace-addanewentryorchangeanexistingone Thesecommandscreatenewneighbourrecordsorupdateexistingones. toADDRESS(default) theprotocoladdressoftheneighbour.ItiseitheranIPv4orIPv6address. devNAME theinterfacetowhichthisneighbourisattached. lladdrLLADDRESS thelinklayeraddressoftheneighbour.LLADDRESScanalsobenull. nudNUDSTATE thestateoftheneighbourentry.nudisanabbreviationfor’NeighbourUnreachability Detection’.Thestatecantakeoneofthefollowingvalues: permanent-theneighbourentryisvalidforeverandcanbeonlybe removedadministratively. noarp-theneighbourentryisvalid.Noattemptstovalidatethisentry willbemadebutitcanberemovedwhenitslifetimeexpires. reachable-theneighbourentryisvaliduntilthereachabilitytimeout expires. iproute2 17January2002 7 IP(8) Linux IP(8) stale-theneighbourentryisvalidbutsuspicious.Thisoptiontoip neighdoesnotchangetheneighbourstateifitwasvalidandthe addressisnotchangedbythiscommand. ipneighbourdelete-deleteaneighbourentry Thiscommandinvalidatesaneighbourentry. Theargumentsarethesameaswithipneighadd,exceptthatlladdrandnudareignored. Warning:Attemptstodeleteormanuallychangeanoarpentrycreatedbythekernelmayresult inunpredictablebehaviour.Particularly,thekernelmaytrytoresolvethisaddressevenona NOARPinterfaceoriftheaddressismulticastorbroadcast. ipneighbourshow-listneighbourentries Thiscommandsdisplaysneighbourtables. toADDRESS(default) theprefixselectingtheneighbourstolist. devNAME onlylisttheneighboursattachedtothisdevice. unused onlylistneighbourswhicharenotcurrentlyinuse. nudNUDSTATE onlylistneighbourentriesinthisstate.NUDSTATEtakesvalueslistedbeloworthe specialvalueallwhichmeansallstates.Thisoptionmayoccurmorethanonce.Ifthis optionisabsent,iplistsallentriesexceptfornoneandnoarp. ipneighbourflush-flushneighbourentries Thiscommandflushesneighbourtables,selectingentriestoflushbysomecriteria. Thiscommandhasthesameargumentsasshow.Thedifferencesarethatitdoesnotrunwhen noargumentsaregiven,andthatthedefaultneighbourstatestobeflusheddonotincludepermanentandnoarp. Withthe-statisticsoption,thecommandbecomesverbose.Itprintsoutthenumberofdeleted neighboursandthenumberofroundsmadetoflushtheneighbourtable.Iftheoptionisgiven twice,ipneighflushalsodumpsallthedeletedneighbours. iproute-routingtablemanagement Manipulaterouteentriesinthekernelroutingtableskeepinformationaboutpathstoothernetworkednodes. Routetypes: unicast-therouteentrydescribesrealpathstothedestinationscoveredby therouteprefix. iproute2 17January2002 8 IP(8) Linux IP(8) unreachable-thesedestinationsareunreachable.Packetsarediscardedand theICMPmessagehostunreachableisgenerated.Thelocalsendersgetan EHOSTUNREACHerror. blackhole-thesedestinationsareunreachable.Packetsarediscardedsilently. ThelocalsendersgetanEINVALerror. prohibit-thesedestinationsareunreachable.Packetsarediscardedandthe ICMPmessagecommunicationadministrativelyprohibitedisgenerated.The localsendersgetanEACCESerror. local-thedestinationsareassignedtothishost.Thepacketsareloopedback anddeliveredlocally. broadcast-thedestinationsarebroadcastaddresses.Thepacketsaresentas linkbroadcasts. throw-aspecialcontrolrouteusedtogetherwithpolicyrules.Ifsucharoute isselected,lookupinthistableisterminatedpretendingthatnoroutewas found.Withoutpolicyroutingitisequivalenttotheabsenceoftherouteinthe routingtable.ThepacketsaredroppedandtheICMPmessagenetunreachable isgenerated.ThelocalsendersgetanENETUNREACHerror. nat-aspecialNATroute.Destinationscoveredbytheprefixareconsideredto bedummy(orexternal)addresseswhichrequiretranslationtoreal(orinternal) onesbeforeforwarding.Theaddressestotranslatetoareselectedwiththe attributevia. anycast-notimplementedthedestinationsareanycastaddressesassignedto thishost.Theyaremainlyequivalenttolocalwithonedifference:such addressesareinvalidwhenusedasthesourceaddressofanypacket. multicast-aspecialtypeusedformulticastrouting.Itisnotpresentinnor-malroutingtables. Routetables:Linux-2.xcanpackroutesintoseveralroutingtablesidentifiedbyanumberinthe rangefrom1to255orbynamefromthefile/etc/iproute2/rttablesmaintable(ID254)and thekernelonlyusesthistablewhencalculatingroutes. Actually,oneothertablealwaysexists,whichisinvisiblebutevenmoreimportant.Itisthelocal table(ID255).Thistableconsistsofroutesforlocalandbroadcastaddresses.Thekernelmaintainsthistableautomaticallyandtheadministratorusuallyneednotmodifyitorevenlookatit. Themultipleroutingtablesenterthegamewhenpolicyroutingisused. iproute2 17January2002 9 IP(8) Linux IP(8) iprouteadd-addnewroute iproutechange-changeroute iproutereplace-changeoraddnewone toTYPEPREFIX(default) thedestinationprefixoftheroute.IfTYPEisomitted,ipassumestypeunicast.Other valuesofTYPEarelistedabove.PREFIXisanIPorIPv6addressoptionallyfollowed byaslashandtheprefixlength.Ifthelengthoftheprefixismissing,ipassumesafulllengthhostroute.ThereisalsoaspecialPREFIXdefault-whichisequivalenttoIP 0/0ortoIPv6::/0. tosTOS dsfieldTOS theTypeOfService(TOS)key.Thiskeyhasnoassociatedmaskandthelongestmatch isunderstoodas:First,comparetheTOSoftherouteandofthepacket.Iftheyarenot equal,thenthepacketmaystillmatcharoutewithazeroTOS.TOSiseitheran8bit hexadecimalnumberoranidentifierfrom/etc/iproute2/rtdsfield. metricNUMBER preferenceNUMBER thepreferencevalueoftheroute.NUMBERisanarbitrary32bitnumber. tableTABLEID thetabletoaddthisrouteto.TABLEIDmaybeanumberorastringfromthefile /etc/iproute2/rttables.Ifthisparameterisomitted,ipassumesthemaintable, withtheexceptionoflocal,broadcastandnatroutes,whichareputintothelocaltablebydefault. devNAME theoutputdevicename. viaADDRESS theaddressofthenexthoprouter.Actually,thesenseofthisfielddependsontheroute type.Fornormalunicastroutesitiseitherthetruenexthoprouteror,ifitisadirect routeinstalledinBSDcompatibilitymode,itcanbealocaladdressoftheinterface.For NATroutesitisthefirstaddressoftheblockoftranslatedIPdestinations. srcADDRESS thesourceaddresstopreferwhensendingtothedestinationscoveredbytherouteprefix. realmREALMID therealmtowhichthisrouteisassigned.REALMIDmaybeanumberorastringfrom thefile/etc/iproute2/rtrealms. mtuMTU mtulockMTU theMTUalongthepathtothedestination.Ifthemodifierlockisnotused,theMTU maybeupdatedbythekernelduetoPathMTUDiscovery.Ifthemodifierlockisused, nopathMTUdiscoverywillbetried,allpacketswillbesentwithouttheDFbitinIPv4 caseorfragmentedtoMTUforIPv6. iproute2 17January2002 10 IP(8) Linux IP(8) windowNUMBER themaximalwindowforTCPtoadvertisetothesedestinations,measuredinbytes.It limitsmaximaldataburststhatourTCPpeersareallowedtosendtous. rttNUMBER theinitialRTT(’RoundTripTime’)estimate. rttvarNUMBER(2.3.15+only) theinitialRTTvarianceestimate. ssthreshNUMBER(2.3.15+only) anestimatefortheinitialslowstartthreshold. cwndNUMBER(2.3.15+only) theclampforcongestionwindow.Itisignoredifthelockflagisnotused. advmssNUMBER(2.3.15+only) theMSS(’MaximalSegmentSize’)toadvertisetothesedestinationswhenestablishing TCPconnections.Ifitisnotgiven,Linuxusesadefaultvaluecalculatedfromthefirst hopdeviceMTU.(Ifthepathtothesedestinationisasymmetric,thisguessmaybe wrong.) reorderingNUMBER(2.3.15+only) Maximalreorderingonthepathtothisdestination.Ifitisnotgiven,Linuxusesthe valueselectedwithsysctlvariablenet/ipv4/tcpreordering. nexthopNEXTHOP thenexthopofamultipathroute.NEXTHOPisacomplexvaluewithitsownsyntax similartothetoplevelargumentlists: viaADDRESS-isthenexthoprouter. devNAME-istheoutputdevice. weightNUMBER-isaweightforthiselementofamultipathroute reflectingitsrelativebandwidthorquality. scopeSCOPEVAL thescopeofthedestinationscoveredbytherouteprefix.SCOPEVALmaybeanumber orastringfromthefile/etc/iproute2/rtscopes.Ifthisparameterisomitted,ip assumesscopeglobalforallgatewayedunicastroutes,scopelinkfordirectunicast andbroadcastroutesandscopehostforlocalroutes. protocolRTPROTO theroutingprotocolidentifierofthisroute.RTPROTOmaybeanumberorastring fromthefile/etc/iproute2/rtprotos.IftheroutingprotocolIDisnotgiven,ip assumesprotocolboot(i.e.itassumestheroutewasaddedbysomeonewhodoesn’t understandwhattheyaredoing).Severalprotocolvalueshaveafixedinterpretation. Namely: iproute2 17January2002 11 IP(8) Linux IP(8) redirect-theroutewasinstalledduetoanICMPredirect. kernel-theroutewasinstalledbythekernelduringautoconfiguration. boot-theroutewasinstalledduringthebootupsequence.Ifarouting daemonstarts,itwillpurgeallofthem. static-theroutewasinstalledbytheadministratortooverride dynamicrouting.Routingdaemonwillrespectthemand,probably, evenadvertisethemtoitspeers. ra-theroutewasinstalledbyRouterDiscoveryprotocol. Therestofthevaluesarenotreservedandtheadministratorisfreetoassign(ornotto assign)protocoltags. onlinkpretendthatthenexthopisdirectlyattachedtothislink,evenifitdoesnotmatchany interfaceprefix. equalize allowpacketbypacketrandomizationonmultipathroutes.Withoutthismodifier,the routewillbefrozentooneselectednexthop,sothatloadsplittingwillonlyoccuronperflowbase.equalizeonlyworksifthekernelispatched. iproutedelete-deleteroute iproutedelhasthesameargumentsasiprouteadd,buttheirsemanticsareabitdifferent. Keyvalues(to,tos,preferenceandtable)selecttheroutetodelete.Ifoptionalattributesare present,ipverifiesthattheycoincidewiththeattributesoftheroutetodelete.Ifnoroutewith thegivenkeyandattributeswasfound,iproutedelfails. iprouteshow-listroutes thecommanddisplaysthecontentsoftheroutingtablesortheroute(s)selectedbysomecriteria. toSELECTOR(default) onlyselectroutesfromthegivenrangeofdestinations.SELECTORconsistsofan optionalmodifier(root,matchorexact)andaprefix.rootPREFIXselectsroutes withprefixesnotshorterthanPREFIX.F.e.root0/0selectstheentireroutingtable. matchPREFIXselectsrouteswithprefixesnotlongerthanPREFIX.F.e.match 10.0/16selects10.0/16,10/8and0/0,butitdoesnotselect10.1/16and10.0.0/24. AndexactPREFIX(orjustPREFIX)selectsrouteswiththisexactprefix.Ifneitherof theseoptionsarepresent,ipassumesroot0/0i.e.itliststheentiretable. tosTOS dsfieldTOSonlyselectrouteswiththegivenTOS. iproute2 17January2002 12 IP(8) Linux IP(8) tableTABLEID showtheroutesfromthistable(s).Thedefaultsettingistoshowtablemain.TABLEID mayeitherbetheIDofarealtableoroneofthespecialvalues: all-listallofthetables. cache-dumptheroutingcache. cloned cached listclonedroutesi.e.routeswhichweredynamicallyforkedfromotherroutesbecause somerouteattribute(f.e.MTU)wasupdated.Actually,itisequivalenttotablecache. fromSELECTOR thesamesyntaxasforto,butitbindsthesourceaddressrangeratherthandestinations. Notethatthefromoptiononlyworkswithclonedroutes. protocolRTPROTO onlylistroutesofthisprotocol. scopeSCOPEVAL onlylistrouteswiththisscope. typeTYPE onlylistroutesofthistype. devNAME onlylistroutesgoingviathisdevice. viaPREFIX onlylistroutesgoingviathenexthoproutersselectedbyPREFIX. srcPREFIX onlylistrouteswithpreferredsourceaddressesselectedbyPREFIX. realmREALMID realmsFROMREALM/TOREALM onlylistrouteswiththeserealms. iprouteflush-flushroutingtables thiscommandflushesroutesselectedbysomecriteria. Theargumentshavethesamesyntaxandsemanticsastheargumentsofiprouteshow,but routingtablesarenotlistedbutpurged.Theonlydifferenceisthedefaultaction:showdumps alltheIPmainroutingtablebutflushprintsthehelperpage. Withthe-statisticsoption,thecommandbecomesverbose.Itprintsoutthenumberofdeleted routesandthenumberofroundsmadetoflushtheroutingtable.Iftheoptionisgiventwice,ip iproute2 17January2002 13 IP(8) Linux IP(8) routeflushalsodumpsallthedeletedroutesintheformatdescribedintheprevioussubsection. iprouteget-getasingleroute thiscommandgetsasingleroutetoadestinationandprintsitscontentsexactlyasthekernelsees it. toADDRESS(default) thedestinationaddress. fromADDRESS thesourceaddress. tosTOS dsfieldTOS theTypeOfService. iifNAME thedevicefromwhichthispacketisexpectedtoarrive. oifNAME forcetheoutputdeviceonwhichthispacketwillberouted. connected ifnosourceaddress(optionfrom)wasgiven,relookuptheroutewiththesourcesetto thepreferredaddressreceivedfromthefirstlookup.Ifpolicyroutingisused,itmaybea differentroute. Notethatthisoperationisnotequivalenttoiprouteshow.showshowsexistingroutes.get resolvesthemandcreatesnewclonesifnecessary.Essentially,getisequivalenttosendinga packetalongthispath.Iftheiifargumentisnotgiven,thekernelcreatesaroutetooutputpacketstowardstherequesteddestination.Thisisequivalenttopingingthedestinationwithasubsequentiproutelscache,however,nopacketsareactuallysent.Withtheiifargument,thekernelpretendsthatapacketarrivedfromthisinterfaceandsearchesforapathtoforwardthe packet. iprule-routingpolicydatabasemanagement Rulesintheroutingpolicydatabasecontroltherouteselectionalgorithm. ClassicroutingalgorithmsusedintheInternetmakeroutingdecisionsbasedonlyonthedestinationaddressofpackets(andintheory,butnotinpractice,ontheTOSfield). Insomecircumstanceswewanttoroutepacketsdifferentlydependingnotonlyondestination addresses,butalsoonotherpacketfields:sourceaddress,IPprotocol,transportprotocolportsor evenpacketpayload.Thistaskiscalled’policyrouting’. Tosolvethistask,theconventionaldestinationbasedroutingtable,orderedaccordingtothe longestmatchrule,isreplacedwitha’routingpolicydatabase’(orRPDB),whichselectsroutes byexecutingsomesetofrules. iproute2 17January2002 14 IP(8) Linux IP(8) Eachpolicyroutingruleconsistsofaselectorandanactionpredicate.TheRPDBisscanned intheorderofincreasingpriority.Theselectorofeachruleisappliedto{sourceaddress,destinationaddress,incominginterface,tos,fwmark}and,iftheselectormatchesthepacket,theaction isperformed.Theactionpredicatemayreturnwithsuccess.Inthiscase,itwilleithergivea routeorfailureindicationandtheRPDBlookupisterminated.Otherwise,theRPDBprogram continuesonthenextrule. Semantically,naturalactionistoselectthenexthopandtheoutputdevice. AtstartuptimethekernelconfiguresthedefaultRPDBconsistingofthreerules: 1.Priority:0,Selector:matchanything,Action:lookuproutingtablelocal(ID255).The localtableisaspecialroutingtablecontaininghighprioritycontrolroutesforlocaland broadcastaddresses. Rule0isspecial.Itcannotbedeletedoroverridden. 2.Priority:32766,Selector:matchanything,Action:lookuproutingtablemain(ID254). Themaintableisthenormalroutingtablecontainingallnon-policyroutes.Thisrule maybedeletedand/oroverriddenwithotheronesbytheadministrator. 3.Priority:32767,Selector:matchanything,Action:lookuproutingtabledefault(ID253). Thedefaulttableisempty.Itisreservedforsomepost-processingifnopreviousdefault rulesselectedthepacket.Thisrulemayalsobedeleted. EachRPDBentryhasadditionalattributes.F.e.eachrulehasapointertosomeroutingtable. NATandmasqueradingruleshaveanattributetoselectnewIPaddresstotranslate/masquerade. Besidesthat,ruleshavesomeoptionalattributes,whichrouteshave,namelyrealms.Thesevaluesdonotoverridethosecontainedintheroutingtables.Theyareonlyusediftheroutedidnot selectanyattributes. TheRPDBmaycontainrulesofthefollowingtypes: unicast-theruleprescribestoreturntheroutefoundintheroutingtableref-erencedbytherule. blackhole-theruleprescribestosilentlydropthepacket. unreachable-theruleprescribestogeneratea’Networkisunreachable’error. prohibit-theruleprescribestogenerate’Communicationisadministratively prohibited’error. nat-theruleprescribestotranslatethesourceaddressoftheIPpacketinto someothervalue. ipruleadd-insertanewrule ipruledelete-deletearule typeTYPE(default) thetypeofthisrule.Thelistofvalidtypeswasgivenintheprevioussubsection. iproute2 17January2002 15 IP(8) Linux IP(8) fromPREFIX selectthesourceprefixtomatch. toPREFIX selectthedestinationprefixtomatch. iifNAME selecttheincomingdevicetomatch.Iftheinterfaceisloopback,theruleonlymatches packetsoriginatingfromthishost.Thismeansthatyoumaycreateseparaterouting tablesforforwardedandlocalpacketsand,hence,completelysegregatethem. tosTOS dsfieldTOS selecttheTOSvaluetomatch. fwmarkMARK selectthefwmarkvaluetomatch. priorityPREFERENCE thepriorityofthisrule.Eachruleshouldhaveanexplicitlysetuniquepriorityvalue. tableTABLEID theroutingtableidentifiertolookupiftheruleselectormatches. realmsFROM/TO Realmstoselectiftherulematchedandtheroutingtablelookupsucceeded.RealmTO isonlyusediftheroutedidnotselectanyrealm. natADDRESS ThebaseoftheIPaddressblocktotranslate(forsourceaddresses).TheADDRESSmay beeitherthestartoftheblockofNATaddresses(selectedbyNATroutes)oralocalhost address(orevenzero).Inthelastcasetherouterdoesnottranslatethepackets,but masqueradesthemtothisaddress. Warning:ChangestotheRPDBmadewiththesecommandsdonotbecomeactive immediately.Itisassumedthatafterascriptfinishesabatchofupdates,itflushesthe routingcachewithiprouteflushcache. ipruleshow-listrules Thiscommandhasnoarguments. ipmaddress-multicastaddressesmanagement maddressobjectsaremulticastaddresses. ipmaddressshow-listmulticastaddresses devNAME(default) thedevicename. iproute2 17January2002 16 IP(8) Linux IP(8) ipmaddressadd-addamulticastaddress ipmaddressdelete-deleteamulticastaddress thesecommandsattach/detachastaticlinklayermulticastaddresstolistenontheinterface. Notethatitisimpossibletojoinprotocolmulticastgroupsstatically.Thiscommandonlymanageslinklayeraddresses. addressLLADDRESS(default) thelinklayermulticastaddress. devNAME thedevicetojoin/leavethismulticastaddress. ipmroute-multicastroutingcachemanagement mrouteobjectsaremulticastroutingcacheentriescreatedbyauserlevelmroutingdaemon(f.e. pimdormrouted). Duetothelimitationsofthecurrentinterfacetothemulticastroutingengine,itisimpossibleto changemrouteobjectsadministratively,sowemayonlydisplaythem.Thislimitationwillbe removedinthefuture. ipmrouteshow-listmroutecacheentries toPREFIX(default) theprefixselectingthedestinationmulticastaddressestolist. iifNAME theinterfaceonwhichmulticastpacketsarereceived. fromPREFIX theprefixselectingtheIPsourceaddressesofthemulticastroute. iptunnel-tunnelconfiguration tunnelobjectsaretunnels,encapsulatingpacketsinIPv4packetsandthensendingthemoverthe IPinfrastructure. iptunneladd-addanewtunnel iptunnelchange-changeanexistingtunnel iptunneldelete-destroyatunnel nameNAME(default) selectthetunneldevicename. modeMODE setthetunnelmode.Threemodesarecurrentlyavailable:ipip,sitandgre. remoteADDRESS settheremoteendpointofthetunnel. localADDRESS setthefixedlocaladdressfortunneledpackets.Itmustbeanaddressonanotherinterfaceofthishost. iproute2 17January2002 17 IP(8) Linux IP(8) ttlNsetafixedTTLNontunneledpackets.Nisanumberintherange1--255.0isaspecial valuemeaningthatpacketsinherittheTTLvalue.Thedefaultvalueis:inherit. tosT dsfieldT setafixedTOSTontunneledpackets.Thedefaultvalueis:inherit. devNAME bindthetunneltothedeviceNAMEsothattunneledpacketswillonlyberoutedviathis deviceandwillnotbeabletoescapetoanotherdevicewhentheroutetoendpoint changes. nopmtudisc disablePathMTUDiscoveryonthistunnel.Itisenabledbydefault.Notethatafixed ttlisincompatiblewiththisoption:tunnellingwithafixedttlalwaysmakespmtudiscovery. keyK ikeyK okeyK (onlyGREtunnels)usekeyedGREwithkeyK.KiseitheranumberoranIP address-likedottedquad.Thekeyparametersetsthekeytouseinbothdirections.The ikeyandokeyparameterssetdifferentkeysforinputandoutput. csum,icsum,ocsum (onlyGREtunnels)generate/requirechecksumsfortunneledpackets.Theocsum flagcalculateschecksumsforoutgoingpackets.Theicsumflagrequiresthatallinput packetshavethecorrectchecksum.Thecsumflagisequivalenttothecombination icsumocsum. seq,iseq,oseq (onlyGREtunnels)serializepackets.Theoseqflagenablessequencingofoutgoing packets.Theiseqflagrequiresthatallinputpacketsareserialized.Theseqflagis equivalenttothecombinationiseqoseq.Itisn’twork.Don’tuseit. iptunnelshow-listtunnels Thiscommandhasnoarguments. ipmonitorandrtmon-statemonitoring Theiputilitycanmonitorthestateofdevices,addressesandroutescontinuously.Thisoption hasaslightlydifferentformat.Namely,themonitorcommandisthefirstinthecommandline andthentheobjectlistfollows: ipmonitor[all|LISTofOBJECTS] OBJECT-LISTisthelistofobjecttypesthatwewanttomonitor.Itmaycontainlink,address androute.Ifnofileargumentisgiven,ipopensRTNETLINK,listensonitanddumpsstate changesintheformatdescribedinprevioussections. Ifafilenameisgiven,itdoesnotlistenonRTNETLINK,butopensthefilecontaining iproute2 17January2002 18 IP(8) Linux IP(8) RTNETLINKmessagessavedinbinaryformatanddumpsthem.Suchahistoryfilecanbegeneratedwiththertmonutility.Thisutilityhasacommandlinesyntaxsimilartoipmonitor.Ideally,rtmonshouldbestartedbeforethefirstnetworkconfigurationcommandisissued.F.e.if youinsert: rtmonfile/var/log/rtmon.log inastartupscript,youwillbeabletoviewthefullhistorylater. Certainly,itispossibletostartrtmonatanytime.Itprependsthehistorywiththestatesnapshotdumpedatthemomentofstarting. HISTORY ipwaswrittenbyAlexeyN.KuznetsovandaddedinLinux2.2. SEEALSO tc(8) IPCommandreferenceip-cref.ps IPtunnelsip-cref.ps AUTHOR ManpagemaintainedbyMichailLitvak<mci@owl.openwall.com> iproute2 17January2002 19