Vol. I · No. 46The command line sectionSat, 10 Oct 2026
Linux · interfaces & addressing

ifconfig

the classic interface tool

ifconfig shows each network interface with its addresses and counters. It has been superseded by the ip command and is no longer installed by default, but older guides, scripts and other Unix systems still use it, so it is worth being able to read.

Learn ip addr for new work; recognise ifconfig when you meet it.

Shows
Interfaces
addresses, MAC, counters
Replaced by
ip addr, ip link
from iproute2
Package
net-tools
not installed by default now
On Windows
ipconfig
a different command

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashnet-tools
$ ifconfig eth0
1eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
2 inet 192.168.1.42 netmask 255.255.255.0 broadcast 192.168.1.255
inet6 fe80::5054:ff:fe12:3456 prefixlen 64 scopeid 0x20<link>
3 ether 52:54:00:12:34:56 txqueuelen 1000 (Ethernet)
4 RX packets 184220 bytes 201938471 (201.9 MB)
TX packets 96114 bytes 11820342 (11.8 MB)
Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range
Reading the output

What the numbered lines are telling you

1
State and MTU

UP means enabled and RUNNING means a cable or link is present. 1500 bytes is the usual Ethernet MTU.

2
The IPv4 address

The netmask is written out in full here; 255.255.255.0 is the same as the /24 that ip addr shows.

3
The MAC address

"ether" is the hardware address of the interface.

4
Traffic counters

Packets and bytes received and sent since the interface came up. Errors and drops appear on these lines when there are any.

Switches

A switch changes how the command behaves. These are the ones used day to day; man ifconfig lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-a
Show all interfaces, including those that are down.
-s
Short: a one-line summary per interface.
IFACE up
Enable an interface. "down" disables it.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

ip addr show eth0

The modern equivalent of the command above.

ifconfig -a

Shows every interface, including ones that are down.

sudo ifconfig eth0 down

Disables an interface. "ip link set eth0 down" is the current form.

ip -br addr

One line per interface — the quickest overview.

In cybersecurity

An interface listing shows every network the machine is attached to.

PROMISC in the flags

An interface in promiscuous mode is accepting traffic not addressed to it — normal while tcpdump runs, suspicious otherwise.

Unexpected interfaces

A tun or tap interface means a VPN or tunnel is up. One nobody set up may be a path out of the network.

A MAC address is not proof

It can be changed with one command, so access control based on MAC addresses alone is easily bypassed.

Protocols it shows

IPv4IPv6Ethernet

Read alongside

ip addrLists every interface with the IPv4 and IPv6 addresses assigned to it, and adds or removes them.ip linkShows and changes the layer-2 state of each interface — up or down, MTU, MAC address and carrier.