Skip to content

Interfaces and Ip Address

The first thing to understand about a Linux machine’s network configuration is that an IP address does not exist by itself. It is associated with a network interface, and that interface is the point where Linux connects to a network.

In the previous lesson, we followed the simplified path from an application through the kernel, IP, routing, and finally the network interface. Now we’ll look closely at the interface and addressing pieces using two commands you’ll use constantly when administering Linux systems: ip link and ip addr.

What Is A Network Interface?

A network interface is Linux’s representation of a network connection.

A physical machine might have:

  • an Ethernet adapter
  • a Wi-Fi adapter
  • a loopback interface
  • one or more virtual interfaces

A virtual machine or server may have several virtual Ethernet interfaces even though there is no physical cable corresponding to each one.

You can see the interfaces known to Linux with:

ip link

A typical system might show something similar to:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 ...
2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 ...
3: wlp2s0: <BROADCAST,MULTICAST> mtu 1500 ...

The exact names and details will vary from machine to machine.

The important part is the interface name:

lo
enp3s0
wlp2s0

These names are what you’ll use with many networking commands.

What Is lo?

The lo interface is the loopback interface.

It represents the machine communicating with itself.

You will commonly see:

lo

with the address:

127.0.0.1

The loopback interface is not connected to your physical network. Traffic sent to 127.0.0.1 stays inside the machine.

For example:

ping 127.0.0.1

does not test whether your Wi-Fi or Ethernet connection works.

It tests whether the local networking stack can communicate with itself.

This distinction becomes useful when debugging:

127.0.0.1 works
    ↓
Local networking stack is responding

But...

192.168.1.20 doesn't work
    ↓
Something involving the actual network interface may be wrong

The loopback interface is therefore a normal and important part of Linux networking, not something you should disable because it doesn’t represent a physical adapter.

What Are Names Like enp3s0 And wlp2s0?

Modern Linux systems often use predictable network interface names rather than always calling the first Ethernet interface eth0 and the first wireless interface wlan0.

You might see:

enp3s0
ens18
wlp2s0

The names encode information about where the interface comes from or how the system identifies it.

You do not need to memorize the naming scheme.

The practical rule is:

Use the interface names your own system gives you.

For example, don’t assume that your Ethernet interface is eth0.

Check first:

ip link

Then use the actual name shown by your system.

ip link: Looking At Interfaces

Let’s break down a simplified interface entry:

2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 ...

There are several useful pieces here.

Interface Name 

enp3s0

This is the name Linux uses for the interface.

Interface State

You may see flags such as:

UP
LOWER_UP

They describe different aspects of the interface’s state.

UP means the interface has been administratively enabled.

LOWER_UP indicates that the underlying link is considered operational.

For an Ethernet connection, LOWER_UP generally corresponds to a working physical link such as a connected cable.

For wireless, the details depend on the wireless state and driver.

The distinction matters because an interface can be administratively enabled while the underlying link is not actually available.

Conceptually:

UP
│
└── Linux has enabled the interface

LOWER_UP
│
└── The underlying link is operational

So don’t interpret UP alone as “the Internet works.”

It only tells you about the interface state.

MTU

You may also see:

mtu 1500

MTU means Maximum Transmission Unit.

It is the largest packet size that the interface can normally transmit at that layer without fragmentation or other handling.

For ordinary Ethernet, 1500 is a common value.

You don’t need to change the MTU for normal networking administration. The useful thing at this stage is simply recognizing that it is part of the interface configuration.

ip addr: Looking At Addresses

Now run:

ip addr

This includes the interfaces you saw with ip link, but also shows their configured addresses.

A simplified example:

2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> ...
    link/ether 00:11:22:33:44:55 ...
    inet 192.168.1.20/24 ...
    inet6 fe80::211:22ff:fe33:4455/64 ...

The important lines here are:

link/ether 00:11:22:33:44:55
inet 192.168.1.20/24
inet6 fe80::211:22ff:fe33:4455/64

The link/ether line shows the interface’s Ethernet hardware address.

The inet line shows an IPv4 address.

The inet6 line shows an IPv6 address.

For now, we’ll concentrate mainly on IPv4 while keeping IPv6 visible so you recognize it when you encounter it.

What Does /24 Mean?

When you see:

192.168.1.20/24

the /24 is the prefix length.

It tells us how much of the address represents the network portion.

For /24, the corresponding subnet mask is:

255.255.255.0

So:

192.168.1.20/24

belongs to:

192.168.1.0/24

A simplified view is:

192.168.1.20/24

192.168.1 | 20
   network | host

The exact concept becomes especially important when we look at routing.

For example, if your interface has:

192.168.1.20/24

then Linux knows that addresses in:

192.168.1.0/24

are on the directly connected network.

That information contributes to the routes Linux installs for the interface.

IP Address And Interface Are Different Things

This distinction is worth making explicit.

An interface:

enp3s0

is the network connection represented by Linux.

An IP address:

192.168.1.20/24

is network-layer addressing assigned to that interface.

You can think of it as:

enp3s0
    │
    ├── MAC address
    │
    ├── IPv4 address
    │
    └── IPv6 address

An interface can have more than one IP address.

That means this is perfectly possible:

enp3s0
    ├── 192.168.1.20/24
    └── 192.168.1.50/24

You should therefore avoid thinking:

“An interface is an IP address.”

It isn’t.

The interface is the network attachment; addresses are configured on it.

IPv4 And IPv6

Linux can use both IPv4 and IPv6.

IPv4 addresses look like:

192.168.1.20

IPv6 addresses look like:

2001:db8::20

You will commonly see IPv6 addresses even if most of your current work is IPv4.

For example:

ip addr

might show:

inet 192.168.1.20/24
inet6 fe80::211:22ff:fe33:4455/64

The IPv6 address beginning with fe80:: is a link-local address. It is automatically associated with an interface and is used for communication on the local network segment.

You don’t need to configure or memorize IPv6 addressing in depth for this course, but you should become comfortable recognizing that:

inet

means IPv4, while:

inet6

means IPv6.

IPv4 Address Types You Will Encounter

Not every IPv4 address has the same scope.

For example:

127.0.0.1

is loopback.

Private addresses commonly include:

10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

These are intended for private networks and are commonly found inside homes, offices, cloud networks, and virtualized environments.

A machine might therefore have:

192.168.1.20

inside its local network while communicating with public Internet addresses through a router.

This is normal.

How Does Linux Know Which Interface To Use?

The interface itself does not decide where packets should go.

The routing table does.

Suppose you have:

enp3s0 → 192.168.1.20/24

Linux can derive that the local network is:

192.168.1.0/24

and will normally have a connected route for it.

If you also have:

default via 192.168.1.1

then traffic for destinations outside the local network can be sent to the default gateway.

You can see the resulting routes with:

ip route

For example:

192.168.1.0/24 dev enp3s0 proto kernel scope link src 192.168.1.20
default via 192.168.1.1 dev enp3s0

Don’t worry about every field yet. The important relationship is:

IP address
    ↓
defines local network
    ↓
routing table
    ↓
determines where traffic goes

We’ll examine routing in detail next.

A Practical Inspection Exercise

Let’s inspect your own machine.

First list the interfaces:

ip link

Then inspect their addresses:

ip addr

You can also ask for a more compact address view:

ip -br addr

You might see something like:

lo        UNKNOWN        127.0.0.1/8 ::1/128
enp3s0    UP             192.168.1.20/24 fe80::211:22ff:fe33:4455/64

This format is useful when you want the important information without all the details.

From the output, identify:

  1. the loopback interface
  2. the interface currently carrying your network connection
  3. its IPv4 address
  4. its IPv4 prefix length
  5. whether it has an IPv6 address

Do not assume the interface name in the example is the one on your machine.

Checking One Interface

Both commands can focus on a particular interface.

For example:

ip link show enp3s0

and:

ip addr show enp3s0

Replace enp3s0 with the interface name on your system.

This is particularly useful on machines with many interfaces.

For example, a server might have:

lo
enp1s0
enp2s0

and inspecting everything at once can become noisy.

What Does “Network Is Up” Actually Mean?

People often say:

“The network interface is up.”

That statement can mean several different things, and they should not be confused.

Consider these separate questions:

Is the interface enabled?
        ↓
Is the underlying link operational?
        ↓
Does the interface have an IP address?
        ↓
Is there a route?
        ↓
Can the machine reach the gateway?
        ↓
Can it reach another host?
        ↓
Can DNS resolve names?
        ↓
Can an application connect to the destination port?

A machine can pass one of these checks while failing another.

For example:

Interface: UP
IP address: present
Routing: correct
DNS: working
Application connection: failing

In that situation, saying “the network is down” would be misleading.

The interface and IP configuration can be completely healthy while a remote service is unavailable.

This layered way of thinking will become important when we reach the Debugging topic.

Interfaces, IP Addresses, And The Network Stack

We can now refine the model from the previous lesson:

    flowchart LR
    A["Application"] --> S["Socket"]
    S --> K["Linux Kernel"]
    K --> IP["IP"]
    IP --> R["Routing"]
    R --> I["Network Interface"]
    I --> N["Network"]

    I --- A1["IP addresses"]

The interface is where Linux connects the networking stack to an actual network.

The IP address gives that interface an identity at the IP layer.

Routing determines where packets should go.

The kernel coordinates these pieces.

This is why ip link and ip addr are such fundamental commands: they expose two different parts of the same networking picture.

A Useful Mental Model

When you inspect a Linux machine, think in this order:

1. What interfaces exist?
        ↓
2. Which interface is actually usable?
        ↓
3. What addresses are configured?
        ↓
4. What network does each address belong to?
        ↓
5. What routes does Linux have?

The first two questions are mainly about interfaces.

The third and fourth are about addressing.

The fifth takes us into routing.

That progression is much more useful than memorizing individual command output fields.

What’s Next

An IP address tells Linux what network an interface belongs to, but it does not by itself answer where every packet should go.

For that, Linux uses a routing table.

Next we’ll look at ip route and build a simple Linux router so you can see how a machine can connect two different networks and forward packets between them.

Last updated on
Linux Networking OverviewRouting (ip route)