A Linux server can have plenty of CPU, memory, and storage available and still appear completely down because of a connectivity problem. Before capturing packets with tcpdump or digging through dozens of logs, the ip command provides a quick way to check interfaces, addresses, routes, and network neighbors, making it one of the essential tools for managing and troubleshooting Linux networks.

The Linux ip command in 30 seconds

ip is part of iproute2 and covers many of the tasks traditionally handled by ifconfig, route, and arp.
Its main objects are link, addr, route, and neigh; it can also manage namespaces and routing rules.
ip route get is particularly useful for finding out which route the kernel would choose for a destination.
Manual changes usually take effect immediately but do not replace your distribution’s persistent network configuration.
Commands such as flush, link set down, or deleting the default route require particular care on remote servers.

ip was introduced to Linux around the Linux 2.2 kernel era and is now part of the iproute2 collection of utilities. Its main advantage over traditional networking tools is that it uses a common syntax to work with different network objects.

The general structure is:

ip [OPTIONS] OBJECT { COMMAND | help }

For example:

ip addr show

Here, addr indicates that we want to work with addresses, while show asks the system to display them.

For an initial inspection, this is particularly convenient:

ip -br addr

The -br option provides concise output:

lo       UNKNOWN        127.0.0.1/8
eth0     UP             192.168.1.100/24

Other useful options include -4 and -6 to restrict the output to IPv4 or IPv6, -c to add colors, and -o to display each record on a single line, which can be useful when processing output in scripts.

Interfaces, Addresses, and Routes: The First Three Places to Look

When a machine loses connectivity, ip link answers one of the most basic questions: does the interface exist, and is it active?

ip link show
ip -br link

To inspect a specific interface:

ip link show dev eth0

And to bring it up or down:

sudo ip link set dev eth0 up
sudo ip link set dev eth0 downCode language: JavaScript (javascript)

This changes the state of the device, but it does not mean that its address, gateway, or DNS configuration is correct.

ip link can also change link-layer properties. For example, the Maximum Transmission Unit (MTU):

sudo ip link set dev eth0 mtu 9000Code language: JavaScript (javascript)

A value of 9,000 bytes is commonly associated with jumbo frames, but it should not be configured simply because it is larger. The rest of the network path must support it; otherwise, difficult-to-diagnose connectivity problems can appear.

A MAC address can also be changed temporarily:

sudo ip link set dev eth0 down
sudo ip link set dev eth0 address aa:bb:cc:dd:ee:ff
sudo ip link set dev eth0 upCode language: CSS (css)

Not every device necessarily supports this operation.

The second essential object is addr:

ip addr show
ip -4 addr show dev eth0
ip -6 addr show dev eth0

A single interface can have several IPv4 or IPv6 addresses. To add one:

sudo ip addr add 192.168.1.50/24 dev eth0

For IPv6:

sudo ip addr add 2001:db8::50/64 dev eth0

And to remove it:

sudo ip addr del 192.168.1.50/24 dev eth0

One command requires considerably more caution:

sudo ip addr flush dev eth0

flush removes addresses matching the specified criteria. Running it on the interface used to remotely administer a server can make the machine inaccessible.

Once the interface and address have been checked, the third question is: does Linux know where to send the packets?

ip route show

A simple routing table might contain something like this:

default via 192.168.1.1 dev eth0
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.100Code language: JavaScript (javascript)

The first line establishes the gateway used when there is no more specific route. The second indicates that the 192.168.1.0/24 network is directly connected through eth0.

For troubleshooting, one of the most useful commands in the entire iproute2 toolkit is:

ip route get 8.8.8.8Code language: CSS (css)

Unlike ping or traceroute, it does not need to send a packet to the destination to show the routing decision. It queries the route the kernel would resolve and can show the outgoing interface, next hop, and selected source address.

This can quickly uncover situations where a server has connectivity but is trying to use the wrong interface, gateway, or source IP address.

Routes can also be changed manually:

sudo ip route add default via 192.168.1.1 dev eth0
sudo ip route add 10.10.0.0/16 via 192.168.1.254 dev eth0
sudo ip route del 10.10.0.0/16 via 192.168.1.254Code language: JavaScript (javascript)

Deleting the default route on a remote machine can immediately cut off access to it.

ip neigh, Policy Routing, and Namespaces: When Networking Gets More Complex

If the interface is active, the address looks correct, and a route exists, the next place to inspect may be the neighbor table:

ip neigh show

ip neigh manages associations between protocol addresses and link-layer addresses. For IPv4, this includes information traditionally associated with ARP (Address Resolution Protocol), while it also supports IPv6 Neighbor Discovery.

Its output can include states such as REACHABLE, STALE, DELAY, PROBE, INCOMPLETE, or FAILED.

For example:

192.168.1.1 dev eth0 lladdr 00:11:22:33:44:55 REACHABLECode language: CSS (css)

If the gateway repeatedly appears as FAILED or INCOMPLETE, the problem may be on the local link rather than somewhere on the Internet.

The neighbor table can be inspected for a specific device:

ip neigh show dev eth0

And flushed:

sudo ip neigh flush dev eth0

Static entries can also be created manually:

sudo ip neigh add 192.168.1.100 \
  lladdr 00:11:22:33:44:55 dev eth0Code language: CSS (css)

For systems with multiple network connections, ip also supports policy routing. Linux can make routing decisions based on criteria beyond the destination address.

For example:

sudo ip rule add from 192.168.2.0/24 table 100
sudo ip route add default via 192.168.2.1 table 100
ip rule showCode language: JavaScript (javascript)

This makes it possible to maintain different routing tables and select one based on criteria such as the traffic’s source address.

Another important capability comes through network namespaces:

sudo ip netns add ns1
ip netns listCode language: PHP (php)

A network namespace provides an isolated networking environment with its own interfaces, addresses, routes, and neighbor tables. It is one of the Linux technologies used extensively in containerization and network virtualization.

Commands can be executed inside a namespace:

sudo ip netns exec ns1 ip addr
sudo ip netns exec ns1 ip route

Two network namespaces can be connected using a veth pair, which conceptually works like the two ends of a virtual network cable:

sudo ip link add veth0 type veth peer name veth1
sudo ip link set veth1 netns ns1

sudo ip addr add 10.0.0.1/24 dev veth0
sudo ip link set veth0 up

sudo ip netns exec ns1 ip addr add 10.0.0.2/24 dev veth1
sudo ip netns exec ns1 ip link set veth1 up
sudo ip netns exec ns1 ip link set lo upCode language: JavaScript (javascript)

ip link goes much further. It can create bridges, VLANs, veth pairs, and several other types of virtual interfaces. For example:

sudo ip link add name br0 type bridge
sudo ip link add link eth0 name eth0.10 type vlan id 10Code language: CSS (css)

This explains why ip is not simply a modern version of ifconfig: iproute2 exposes modern Linux networking capabilities that go far beyond checking an IP address.

A Practical Sequence for Troubleshooting a Linux Server with No Network

Instead of running commands without a clear order, administrators can follow a simple troubleshooting sequence.

Question	First command to try
Does the interface exist?	`ip -br link`
Is it UP?	`ip link show dev eth0`
Does it have an address?	`ip -br addr`
Does it have IPv4?	`ip -4 addr show dev eth0`
Does it have IPv6?	`ip -6 addr show dev eth0`
Is there a gateway?	`ip route`
Which path would it use to reach a destination?	`ip route get 8.8.8.8`
Can it resolve the gateway/neighbor?	`ip neigh show`
Are there special routing rules?	`ip rule show`

This order also helps separate different kinds of problems. If eth0 is DOWN, there is little point in investigating a route to the Internet yet. If the interface is UP but does not have the expected address, the problem is probably occurring before routing comes into play.

If the address and routes are correct but the gateway appears as FAILED in ip neigh, it is worth investigating the local link, VLAN, switch, or virtual machine configuration.

And if everything above looks correct, it may be time to move on to other tools:

ping
ss
traceroute
tracepath
ethtool
resolvectl
tcpdump

Each answers a different question. ip does not diagnose DNS, does not replace packet captures, and does not by itself display every open socket. Its strength lies in showing the kernel’s view of a significant part of the system’s network configuration.

As a quick reference, these are some of the commands worth keeping close at hand:

# Interfaces
ip -br link
ip link show dev eth0
ip link set dev eth0 up
ip link set dev eth0 down

# Addresses
ip -br addr
ip -4 addr
ip -6 addr
ip addr show dev eth0

# Routes
ip route
ip route get 8.8.8.8

# Neighbors
ip neigh
ip neigh show dev eth0

# Policy routing
ip rule show
ip route show table all

# Namespaces
ip netns list
sudo ip netns exec ns1 ip addrCode language: PHP (php)

There is one final distinction worth keeping in mind: testing a network configuration is not the same as making it persistent. Changes made directly with ip modify the kernel’s current network state, but they can later be overwritten by the network manager or disappear after a reboot.

For persistent configuration, administrators should use the system appropriate for their distribution and server, such as NetworkManager, systemd-networkd, Netplan, or another network management framework.

That is why ip is particularly valuable for troubleshooting and testing. Mastering link, addr, route, and neigh makes it possible to answer four essential questions within minutes: which interfaces Linux can see, which addresses they have, where the kernel intends to send traffic, and which devices it knows about on the local link. From there, netns, rule, and the rest of iproute2 provide the tools needed to work with considerably more complex Linux networks.