iproute2 – Collection of Utilities for Controlling TCP/IP

Table of Contents#

1. Overview of iproute2 Utilities
2. Managing Network Interfaces
3. Working with Routing Tables
4. Traffic Control
5. ARP and Neighbor Management
6. Common Practices and Best Practices
7. Example Usage Scenarios
8. Conclusion
9. References

Overview of iproute2 Utilities#

The iproute2 package consists of several command-line utilities, with the most commonly used one being the ip command. Other important utilities include tc (for traffic control), ss (for socket statistics), and bridge (for bridge management). The full package also includes devlink (for device driver configuration), tipc (for Transparent Inter-Process Communication), rdma (for Remote Direct Memory Access), dcb (for Data Center Bridging), nstat/rtstat/lnstat (for network and routing statistics), and ip netns (for network namespace management).

• ip: This is the core utility in iproute2. It can be used to manage network interfaces, routing tables, ARP entries, and more. The ip command has a modular syntax, where the first argument specifies the object to be managed (e.g., link, addr, route), followed by sub-commands and options.
• tc: The Traffic Control utility is used to shape, police, and schedule network traffic. It allows administrators to prioritize certain types of traffic, limit bandwidth usage, and implement quality-of-service (QoS) policies.
• ss: This tool is used to display socket statistics. It is the modern replacement for netstat and provides more detailed information about network sockets, including TCP internal information such as congestion window size, round-trip time, and memory usage.
• bridge: The bridge utility is used for managing Ethernet bridges. Ethernet bridges are used to connect multiple network segments. The bridge tool is primarily used for managing the bridge forwarding table and port VLAN filtering attributes. Creating VLAN interfaces (like eth0.10) requires the use of the ip link command.

Managing Network Interfaces#

Viewing Interfaces#

To view information about all network interfaces on the system, you can use the following command:

ip link show

This command will display details such as the interface name, MAC address, and interface status (up or down).

Enabling and Disabling Interfaces#

To enable an interface, for example, the eth0 interface, use the following command:

ip link set eth0 up

To disable the interface, switch the up keyword to down:

ip link set eth0 down

Assigning IP Addresses#

You can assign an IP address to an interface using the ip addr command. For example, to assign the IP address 192.168.1.100 with a subnet mask of 255.255.255.0 to the eth0 interface:

ip addr add 192.168.1.100/24 dev eth0

To remove an IP address from an interface:

ip addr del 192.168.1.100/24 dev eth0

Working with Routing Tables#

Viewing Routing Tables#

To view the current routing table, use the following command:

ip route show

This will display information such as the destination network, the gateway (if any), the interface used to reach the destination, and the routing metric.

Adding and Removing Routes#

To add a default gateway, for example, 192.168.1.1, use the following command:

ip route add default via 192.168.1.1

To add a static route to a specific network, say 10.0.0.0/8 through the gateway 192.168.1.2:

ip route add 10.0.0.0/8 via 192.168.1.2

To remove a route, replace add with del in the above commands. For example, to remove the default gateway:

ip route del default via 192.168.1.1

Traffic Control#

Bandwidth Limiting#

One of the common uses of the tc command is to limit the bandwidth of an interface. The following example limits the outgoing bandwidth of the eth0 interface to 1 Mbps:

tc qdisc add dev eth0 root tbf rate 1mbit burst 32kbit latency 400ms

This creates a Token Bucket Filter (TBF) qdisc at the root of the eth0 interface.

Traffic Prioritization#

You can prioritize certain types of traffic using tc. For example, to give traffic from a specific IP address a higher priority, you can use a combination of Hierarchical Token Bucket (HTB) queuing and filters.

# Create a root qdisc
tc qdisc add dev eth0 root handle 1: htb default 10
# Create classes
tc class add dev eth0 parent 1: classid 1:1 htb rate 10mbit
tc class add dev eth0 parent 1:1 classid 1:10 htb rate 1mbit
tc class add dev eth0 parent 1:1 classid 1:11 htb rate 9mbit
# Create a filter to direct traffic from a specific IP to the high - priority class
tc filter add dev eth0 protocol ip parent 1: prio 1 u32 match ip src 192.168.1.100 flowid 1:11

ARP and Neighbor Management#

Viewing ARP Table#

To view the Address Resolution Protocol (ARP) table, use the following command:

ip neigh show

This will display the mapping between IP addresses and MAC addresses for the devices on the local network.

Adding and Deleting ARP Entries#

To add a static ARP entry, for example, mapping the IP address 192.168.1.200 to the MAC address 00:11:22:33:44:55 on the eth0 interface:

ip neigh add 192.168.1.200 lladdr 00:11:22:33:44:55 dev eth0

To delete an ARP entry:

ip neigh del 192.168.1.200 dev eth0

Common Practices and Best Practices#

• Backup Configuration: Before making any major changes to network interfaces or routing tables, it is advisable to backup the existing configuration. This can be done by taking a snapshot of the output of ip link show, ip addr show, and ip route show.
• Testing Changes: Always test any changes in a non-production environment first. This helps to identify any potential issues before applying the changes to a live network.
• Documentation: Keep detailed documentation of all network configurations, including IP addresses, routing rules, and traffic control policies. This makes it easier to troubleshoot problems and maintain the network in the long run.
• Use Descriptive Names: When creating traffic control classes or filters, use descriptive names to make the configuration more understandable.

Example Usage Scenarios#

Setting up a Router#

Suppose you have a system with two network interfaces: eth0 connected to the Internet and eth1 connected to a local network. You can set up this system as a router using iproute2 commands.

# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# Set up a default route to the Internet
ip route add default via <Internet gateway IP> dev eth0
# Add a static route to the local network
ip route add <Local network IP>/<Subnet mask> dev eth1

Isolating Traffic with VLANs#

If you want to isolate traffic between different departments in a company using VLANs, you can use the ip link and bridge commands. To maintain VLAN isolation, do not add multiple VLAN interfaces to the same bridge, as this would allow them to communicate at layer 2. Instead, keep VLAN interfaces independent for layer 3 routing or bridge each VLAN to a separate bridge:

# Create separate bridges for each VLAN
ip link add br10 type bridge
ip link add br20 type bridge
# Create VLAN interfaces
ip link add link eth0 name eth0.10 type vlan id 10
ip link add link eth0 name eth0.20 type vlan id 20
# Add each VLAN interface to its own bridge
ip link set eth0.10 master br10
ip link set eth0.20 master br20
# Enable the bridges and VLAN interfaces
ip link set br10 up
ip link set br20 up
ip link set eth0.10 up
ip link set eth0.20 up

Conclusion#

iproute2 is a powerful and versatile collection of utilities for controlling TCP/IP networks. It provides a wide range of functionalities for managing network interfaces, routing tables, traffic control, and ARP entries. By understanding and using the different commands in iproute2, network administrators can effectively configure and manage their networks, ensuring optimal performance and security.

References#

• iproute2 Wikipedia page: https://en.wikipedia.org/wiki/Iproute2
• Task-centered iproute2 user guide: https://baturin.org/docs/iproute2/
• Linux man pages for ip, tc, ss, and bridge commands (available via man ip, man tc, man ss, man bridge).
• Linux Advanced Routing & Traffic Control HOWTO: https://lartc.org/lartc.html