Getting the most from ifconfig

The ifconfig command can tell you a lot about your Unix server’s connection to your network and the role it’s playing in both generating and receiving network traffic.

The newer ip command does much the same thing, but you won’t find it on all varieties of Unix. Both commands will display a lot of settings and numbers associated with your network connection. Let’s look into what all those numbers and settings mean.

For starters, ifconfig stands for “interface configuration”. The command provides options for viewing as well as changing your network settings.

By itself (no options), the ifconfig command shows active network interfaces (you may have others). This is generally the primary network interface – usually eth0 – and the loopback address as shown in the example below.

$ ifconfig
eth0  Link encap:Ethernet  HWaddr 78:2B:CB:4E:B2:44
      inet addr:172.30.0.28  Bcast:172.30.0.255  Mask:255.255.255.0
      inet6 addr: fe80::890:52ff:fe31:1bdb/64 Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:4279184 errors:0 dropped:0 overruns:0 frame:0
      TX packets:3979015 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000
      RX bytes:618520008 (589.8 MiB)  TX bytes:827050668 (788.7 MiB)

lo    Link encap:Local Loopback
      inet addr:127.0.0.1  Mask:255.0.0.0
      inet6 addr: ::1/128 Scope:Host
      UP LOOPBACK RUNNING  MTU:65536  Metric:1
      RX packets:462 errors:0 dropped:0 overruns:0 frame:0
      TX packets:462 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:0
      RX bytes:42110 (41.1 KiB)  TX bytes:42110 (41.1 KiB)

So what about all of those settings and packet counts? Which should you look at and what do they tell you? Let’s run through them.

Encap – this one tells you about the encapsulation that is in use. The encap:Ethernet entry above just tells you that the interface is connected to an Ethernet and packetizes its communications for that standard.

HWaddr – the address that is associated with the physical network adaptor. The first portion (first three octets) can also be used to identify the manufacturer of your network adaptor. The value 78:2B:CB identifies the manufacturer of this network interface as Dell. You should be able to find a number of sites online to identify the manufacturer from this information. One such site is http://www.askapache.com/online-tools/mac-lookup/.

You may encounter bonded interfaces — an arrangement that allows a system to increase network throughput by using more than one physical interface to send traffic. In the example below, notice how the same hardware address appears to be used for three separate interfaces. The bonded interface is called bond0. That kind of gives it away. It’s not a separate physical interface, but a bonding of the eth0 and eth1 interfaces.

# ifconfig -a
bond0 Link encap:Ethernet  HWaddr 78:2B:CB:4E:B2:44
      inet addr:10.1.2.3  Bcast:10.1.255.255  Mask:255.255.0.0
      inet6 addr: fe80::b2a7:bcee:fe5f:a949/64 Scope:Link
      UP BROADCAST RUNNING MASTER MULTICAST  MTU:1500  Metric:1
      RX packets:552315 errors:0 dropped:0 overruns:0 frame:0
      TX packets:1811373 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:0
      RX bytes:50142555 (47.8 MiB)  TX bytes:2726862940 (2.5 GiB)

eth0  Link encap:Ethernet  HWaddr 78:2B:CB:4E:B2:44
      UP BROADCAST RUNNING SLAVE MULTICAST  MTU:1500  Metric:1
      RX packets:375620 errors:0 dropped:0 overruns:0 frame:0
      TX packets:1811373 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000
      RX bytes:32261660 (30.7 MiB)  TX bytes:2726862940 (2.5 GiB)
      Interrupt:106 Memory:d2000000-d2012100

eth1  Link encap:Ethernet  HWaddr 78:2B:CB:4E:B2:44
      UP BROADCAST RUNNING SLAVE MULTICAST  MTU:1500  Metric:1
      RX packets:176695 errors:0 dropped:0 overruns:0 frame:0
      TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000
      RX bytes:17880895 (17.0 MiB)  TX bytes:0 (0.0 b)
      Interrupt:114 Memory:d4000000-d4012100

inet & inet6 – the IPv4 and IPv6 addresses. Yes, those IPv6 addresses are still somewhat intimidating for those of us who have spent the bulk of our careers with IPv4, but you’re likely to see more and more of them.

The status indicators – UP, BROADCAST, RUNNING, MULTICAST, MTU – tell you a range of things. Note that UP and RUNNING are not the same thing.

• UP shows that the kernel modules needed for the interface have been loaded.
• RUNNING tells you that the interface is ready to accept data.
• BROADCAST tells you that the interface supports broadcasting. Note that this is necessary if a system is going to obtain its address using DHCP as it has to broadcast its request for an IP address.
• MULTICAST tells you that the interface supports multicasting – sending packets to a select group of systems.
• MTU (maximum transmission unit) sets the packet size, generally 1500. Notice how the packet size for the loopback interface is so much larger. These packets, of course, don’t actually have to go over the network.

RX and TX – Receive and transmit packet counts. These will probably be in the same general ballpark and larger if your system has been running a lot time or does a lot of communicating with other systems. Web servers will likely have much larger TX than RX counts. The RX and TX counts are cumulative. The RX and TX counts for loopback interfaces will likely be quite small. Try pinging the system with the “ping localhost” command and both numbers will go up.

RX and TX bytes – These show you very similar data, but as bytes rather than packets, so the numbers are considerably larger.

The errors, dropped, overruns, frame, and carrier counts will generally all be zeroes. You may be having problems with your network interface if you see numbers bigger than 0 – malformed frames or CRC (cyclical redundancy check) errors that might indicate a problem with the interface or a network cable.

Collisions should be 0 or at least a small number. Collisions indicate that the network is has so much traffic that packets are interfering with each other.

The ifconfig’s –a option allows you see all network interfaces. You can also look at a specific network interface so that you focus on that without having to scan data for other interfaces.

ifconfig –a      show all interfaces
ifconfig eth0    show just eth0

You can also bring an interface up or shut it down with variations of the ifconfig command or some convenient shortcuts.

Bring the interface up:

ifconfig eth0 up
ifup eth0

Shut the interface down:

ifconfig eth0 down
ifdown eth0

Assigning a different IP address, netmask, and broadcast address can be done piece by piece or all together in a single command such as this one:

ifconfig eth0 10.20.30.2 netmask 255.255.255.0 broadcast 10.20.30.255

If you use unusual subnet sizes, you can work out the number yourself or find a nice IP calculator like http://jodies.de/ipcalc to do the thinking for you. By providing a single IP address, the number of bytes in the netmask (e.g., 24 if your netmask is 255.255.255.0), you can get your netmask, network, broadcast, first and last host IPs, and subnet size all calculated for you. Then you can be extra comfortable before running a command like this one:

ifconfig eth0 10.20.30.2 netmask 255.255.255.240 broadcast 10.20.30.15

The 240 in this netmask represents the first four bits (128 + 64 + 32 + 16) in the address while the 15 in the broadcast represents the last four (8 + 4 + 2 + 1) indicating the break between the network and host portions of each IP address. Then again, these addresses depend on the particular subnet you’re working with. If the host you’re working with is 10.20.30.129, you’ll see a different broadcast address.

The netmasks you’re likely to see for subnets include these:

For groups of 128 (126 machines) - 255.255.255.128 (/25)
For groups of 64 (62 machines) - 255.255.255.192 (/26)
For groups of 32 (30 machines) - 255.255.255.224 (/27)
For groups of 16 (14 machines) - 255.255.255.240 (/28)
For groups of 8 (6 machines) - 255.255.255.248 (/29)
For groups of 4 (2 machines) - 255.255.255.252 (/30)

You can use ifconfig to set an interface to promiscuous mode with a command such as this:

ifconfig eth0 promisc

Promiscuous mode means the network interface will be able to capture all traffic on the network segment rather than just traffic intended for it. In general, this isn’t a good idea as it enables sniffing, though there are probably times when that is just what you need to do.

Rather than just a command to report on assigned IP addresses, ifconfig can tell you how busy your network interface is, if it permits sniffing, if your network is so busy that packets are colliding, and whether the interface is running into errors.