ip addr
what this host calls itselfip addr prints each network interface with the addresses bound to it — the MAC on the link, the IPv4 address and prefix, and the IPv6 addresses the kernel configured for itself. It replaced ifconfig, which cannot show more than one address per interface properly.
An address belongs to an interface, not to the machine — one host is as many addresses as it has links.
At the terminal
Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.
What the numbered lines are telling you
UP means an administrator enabled the interface. LOWER_UP means the link itself has carrier — a cable is in and the far end answers. UP without LOWER_UP is an unplugged port.
The MAC this interface puts in every Ethernet frame it sends, followed by the broadcast address frames to everyone are sent to.
/24 says the first 24 bits name the network, so 192.168.1.0 to 192.168.1.255 is on-link. "dynamic" says the address came from DHCP rather than being typed in.
valid_lft counts down the seconds until the address must be renewed or dropped. A statically configured address reads "forever".
The kernel assigns one to every IPv6-capable interface without asking anyone. "scope link" means it is never routed off this segment.
Switches
A switch changes how the command behaves. These are the ones used day to day; man ip lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.
-br- Brief: one line per interface — name, state and addresses. Written "ip -br addr".
-4- Show only IPv4 addresses.
-6- Show only IPv6 addresses.
-c- Colour the output, so addresses and states stand out.
-s- Add statistics: packets, bytes and errors per interface.
-j- Print JSON, for scripts. Add -p to make it readable.
Variations worth knowing
The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.
ip -br addrOne line per interface — name, state and addresses. The form to reach for first.
ip -4 addr show dev eth0Only the IPv4 addresses of one interface; -6 does the same for IPv6.
ip addr add 192.168.1.50/24 dev eth0Binds a second address to the interface. Lost at reboot unless the network manager also knows it.
ip addr del 192.168.1.50/24 dev eth0Removes exactly that address and prefix, leaving the others in place.
In cybersecurity
The address list is the first thing an attacker reads after landing on a host, because it maps every network the machine can reach. It is equally the first thing a defender should read.
A tun, tap or wg interface nobody remembers creating is a tunnel out of the network. Account for every one.
A machine with an address in two segments is a bridge between them, whatever the firewall diagram says.
An extra address on a live interface can impersonate a neighbour or quietly host a service. ifconfig would not have shown it.
Link-local and autoconfigured IPv6 addresses appear by default. If the firewall only filters IPv4, they are an open side door.
An address added by hand vanishes at reboot — convenient for an intruder, and a reason to compare live state with the configuration.
The link/ether value is trivially changed. Port security and DHCP reservations that trust it are trusting a claim.