ip-netns

title: ip-netns(8)

summary: process network namespace management

text:
# ip-netns(8)

## NAME
ip-netns - process network namespace management

## SYNOPSIS

ip [ OPTIONS ] netns { COMMAND | help }

ip netns [ list ]

ip netns add NETNSNAME

ip netns attach NETNSNAME PID

ip [-all] netns del [ NETNSNAME ]

ip netns set NETNSNAME NETNSID

NETNSID := auto | POSITIVE-INT

ip netns identify [ PID ]

ip netns pids NETNSNAME

ip [-all] netns exec [ NETNSNAME ] command...

ip netns monitor

ip netns list-id [ target-nsid POSITIVE-INT ] [ nsid POSITIVE-INT ]

## DESCRIPTION
A network namespace is logically another copy of the network stack, with its own routes, firewall rules, and network devices.

By default a process inherits its network namespace from its parent. Initially all the processes share the same default network namespace from the init process.

By convention a named network namespace is an object at /var/run/netns/NAME that can be opened. The file descriptor resulting from opening /var/run/netns/NAME refers to the specified network namespace. Holding that file descriptor open keeps the network namespace alive. The file descriptor can be used with the setns(2) system call to change the network namespace associated with a task.

For applications that are aware of network namespaces, the convention is to look for global network configuration files first in /etc/netns/NAME/ then in /etc/. For example, if you want a different version of /etc/resolv.conf for a network namespace used to isolate your vpn you would name it /etc/netns/myvpn/resolv.conf.

ip netns exec automates handling of this configuration, file convention for network namespace unaware applications, by creating a mount namespace and bind mounting all of the per network namespace configure files into their traditional location in /etc.

ip netns list - show all of the named network namespaces

This command displays all of the network namespaces in /var/run/netns

ip netns add NAME - create a new named network namespace

If NAME is available in /var/run/netns this command creates a new network namespace and assigns NAME.

ip netns attach NAME PID - create a new named network namespace

If NAME is available in /var/run/netns this command attaches the network namespace of the process PID to NAME as if it were created with ip netns.

ip [-all] netns delete [ NAME ] - delete the name of a network namespace(s)

If NAME is present in /var/run/netns it is umounted and the mount point is removed. If this is the last user of the network namespace the network namespace will be freed and all physical devices will be moved to the default one, otherwise the network namespace persists until it has no more users. ip netns delete may fail if the mount point is in use in another mount namespace.

If -all option was specified then all the network namespace names will be removed.

It is possible to lose the physical device when it was moved to netns and then this netns was deleted with a running process:

$ ip netns add net0

$ ip link set dev eth0 netns net0

$ ip netns exec net0 SOME_PROCESS_IN_BACKGROUND

$ ip netns del net0

and eth0 will appear in the default netns only after SOME_PROCESS_IN_BACKGROUND will exit or will be killed. To prevent this the processes running in net0 should be killed before deleting the netns:

$ ip netns pids net0 | xargs kill

$ ip netns del net0

ip netns set NAME NETNSID - assign an id to a peer network namespace

This command assigns a id to a peer network namespace. This id is valid only in the current network namespace. If the keyword "auto" is specified an available nsid will be chosen. This id will be used by the kernel in some netlink messages. If no id is assigned when the kernel needs it, it will be automatically assigned by the kernel. Once it is assigned, it's not possible to change it.

ip netns identify [PID] - Report network namespaces names for process

This command walks through /var/run/netns and finds all the network namespace names for network namespace of the specified process, if PID is not specified then the current process will be used.

ip netns pids NAME - Report processes in the named network namespace

This command walks through proc and finds all of the process who have the named network namespace as their primary network namespace.

ip [-all] netns exec [ NAME ] cmd ... - Run cmd in the named network namespace

This command allows applications that are network namespace unaware to be run in something other than the default network namespace with all of the configuration for the specified network namespace appearing in the customary global locations. A network namespace and bind mounts are used to move files from their network namespace specific location to their default locations without affecting other processes.

If -all option was specified then cmd will be executed synchronously on the each named network namespace even if cmd fails on some of them. Network namespace name is printed on each cmd executing.

ip netns monitor - Report as network namespace names are added and deleted

This command watches network namespace name addition and deletion events and prints a line for each event it sees.

ip netns list-id [target-nsid POSITIVE-INT] [nsid POSITIVE-INT] - list network namespace ids (nsid)

Network namespace ids are used to identify a peer network namespace. This command displays nsids of the current network namespace and provides the corresponding iproute2 netns name (from /var/run/netns) if any.

The target-nsid option enables to display nsids of the specified network namespace instead of the current network namespace. This target-nsid is a nsid from the current network namespace.

The nsid option enables to display only this nsid. It is a nsid from the current network namespace. In combination with the target-nsid option, it enables to convert a specific nsid from the current network namespace to a nsid of the target-nsid network namespace.

## EXAMPLES
ip netns list

Shows the list of current named network namespaces

ip netns add vpn

Creates a network namespace and names it vpn

ip netns exec vpn ip link set lo up

Bring up the loopback interface in the vpn network namespace.

ip netns add foo

ip netns add bar

ip netns set foo 12

ip netns set bar 13

ip -n foo netns set foo 22

ip -n foo netns set bar 23

ip -n bar netns set foo 32

ip -n bar netns set bar 33

ip netns list-id target-nsid 12

Shows the list of nsids from the network namespace foo.

ip netns list-id target-nsid 12 nsid 13 Get nsid of bar from the network namespace foo (result is 23).

## SEE ALSO
ip(8)

## AUTHOR
Original Manpage by Eric W. Biederman

Manpage revised by Nicolas Dichtel <nicolas.dichtel@6wind.com>


ip-nexthop

title: ip-nexthop(8)

summary: nexthop object management

text:
# ip-nexthop(8)

## NAME
ip-nexthop - nexthop object management

## SYNOPSIS

ip [ ip-OPTIONS ] nexthop { COMMAND | help }

ip nexthop { show | flush } SELECTOR

ip nexthop { add | replace } id ID NH

ip nexthop { get | del } id ID

ip nexthop bucket list BUCKET_SELECTOR

ip nexthop bucket get id ID index INDEX

SELECTOR := [ id ID ] [ dev DEV ] [ vrf NAME ] [ master DEV ] [ groups ] [ fdb ]

BUCKET_SELECTOR := SELECTOR | [ nhid ID ]

NH := { blackhole | [ via ADDRESS ] [ dev DEV ] [ onlink ] [ encap ENCAP ] [ fdb ] | group GROUP [ fdb ] [ type TYPE [ TYPE_ARGS ] ] }

ENCAP := [ ENCAP_MPLS ]

ENCAP_MPLS := mpls [ LABEL ] [ ttl TTL ]

GROUP := id[,weight[/...]

TYPE := { mpath | resilient }

TYPE_ARGS := [ RESILIENT_ARGS ]

RESILIENT_ARGS := [ buckets BUCKETS ] [ idle_timer IDLE ] [ unbalanced_timer UNBALANCED ]

## DESCRIPTION
ip nexthop is used to manipulate entries in the kernel's nexthop tables.

ip nexthop add id ID

add new nexthop entry

ip nexthop replace id ID

change the configuration of a nexthop or add new one

via [ FAMILY ] ADDRESS

the address of the nexthop router, in the address family FAMILY. Address family must match address family of nexthop instance.

dev NAME

is the output device.

onlink

pretend that the nexthop is directly attached to this link, even if it does not match any interface prefix.

encap ENCAPTYPE ENCAPHDR

attach tunnel encapsulation attributes to this route. ENCAPTYPE is a string specifying the supported encapsulation type. Namely:

mpls - encapsulation type MPLS

ENCAPHDR is a set of encapsulation attributes specific to the ENCAPTYPE.

mpls

MPLSLABEL - mpls label stack with labels separated by /

ttl TTL - TTL to use for MPLS header or 0 to inherit from IP header

group GROUP [ type TYPE [ TYPE_ARGS ] ]

create a nexthop group. Group specification is id with an optional weight (id,weight) and a '/' as a separator between entries. TYPE is a string specifying the nexthop group type. Namely:

mpath - Multipath nexthop group backed by the hash-threshold algorithm. The default when the type is unspecified.

resilient - Resilient nexthop group. Group is resilient to addition and deletion of nexthops.

TYPE_ARGS is a set of attributes specific to the TYPE.

resilient

buckets BUCKETS - Number of nexthop buckets. Cannot be changed for an existing group

idle_timer IDLE - Time in seconds in which a nexthop bucket does not see traffic and is therefore considered idle. Default is 120 seconds

unbalanced_timer UNBALANCED - Time in seconds in which a nexthop group is unbalanced and is therefore considered unbalanced. The kernel will try to rebalance unbalanced groups, which might result in some flows being reset. A value of 0 means that no rebalancing will take place. Default is 0 seconds

blackhole

create a blackhole nexthop

fdb

nexthop and nexthop groups for use with layer-2 fdb entries. A fdb nexthop group can only have fdb nexthops. Example: Used to represent a vxlan remote vtep ip. layer-2 vxlan fdb entry pointing to an ecmp nexthop group containing multiple remote vtep ips.

ip nexthop delete id ID

delete nexthop with given id.

ip nexthop show

show the contents of the nexthop table or the nexthops selected by some criteria.

dev DEV

show the nexthops using the given device.

vrf NAME

show the nexthops using devices associated with the vrf name

master DEV

show the nexthops using devices enslaved to given master device

groups

show only nexthop groups

fdb

show only fdb nexthops and nexthop groups

ip nexthop flush

flushes nexthops selected by some criteria. Criteria options are the same as show.

ip nexthop get id ID

get a single nexthop by id

ip nexthop bucket show

show the contents of the nexthop bucket table or the nexthop buckets selected by some criteria.

id ID

show the nexthop buckets that belong to a nexthop group with a given id

nhid ID

show the nexthop buckets that hold a nexthop with a given id

dev DEV

show the nexthop buckets using the given device

vrf NAME

show the nexthop buckets using devices associated with the vrf name

master DEV

show the nexthop buckets using devices enslaved to given master device

ip nexthop bucket get id ID index INDEX

get a single nexthop bucket by nexthop group id and bucket index

## EXAMPLES
ip nexthop ls

Show all nexthop entries in the kernel.

ip nexthop add id 1 via 192.168.1.1 dev eth0

Adds an IPv4 nexthop with id 1 using the gateway 192.168.1.1 out device eth0.

ip nexthop add id 2 encap mpls 200/300 via 10.1.1.1 dev eth0

Adds an IPv4 nexthop with mpls encapsulation attributes attached to it.

ip nexthop add id 3 group 1/2

Adds a nexthop with id 3. The nexthop is a group using nexthops with ids 1 and 2 at equal weight.

ip nexthop add id 4 group 1,5/2,11

Adds a nexthop with id 4. The nexthop is a group using nexthops with ids 1 and 2 with nexthop 1 at weight 5 and nexthop 2 at weight 11.

ip nexthop add id 5 via 192.168.1.2 fdb

Adds a fdb nexthop with id 5.

ip nexthop add id 7 group 5/6 fdb

Adds a fdb nexthop group with id 7. A fdb nexthop group can only have fdb nexthops.

ip nexthop add id 10 group 1/2 type resilient buckets 32

Add a resilient nexthop group with id 10 and 32 nexthop buckets.

## SEE ALSO
ip(8)

## AUTHOR
Original Manpage by David Ahern <dsahern@kernel.org>


ip-ntable

title: ip-ntable(8)

text:
# ip-ntable(8)

## NAME
ip-ntable - neighbour table configuration

## SYNOPSIS

ip [ OPTIONS ] ntable { COMMAND | help }

ip ntable change name NAME [ dev DEV ] [ thresh1 VAL ] [ thresh2 VAL ] [ thresh3 VAL ] [ gc_int MSEC ] [ base_reachable MSEC ] [ retrans MSEC ] [ gc_stale MSEC ] [ delay_probe MSEC ] [ queue LEN ] [ app_probs VAL ] [ ucast_probes VAL ] [ mcast_probes VAL ] [ anycast_delay MSEC ] [ proxy_delay MSEC ] [ proxy_queue LEN ] [ locktime MSEC ]

ip ntable show [ dev DEV ] [ name NAME ]

## DESCRIPTION
ip ntable controls the parameters for the neighbour tables.

### ip ntable show - list the ip neighbour tables
This commands displays neighbour table parameters and statistics.

dev DEV

only list the table attached to this device.

name NAME

only lists the table with the given name.

### ip ntable change - modify table parameter
This command allows modifying table parameters such as timers and queue lengths.

name NAME

the name of the table to modify.

dev DEV

the name of the device to modify the table values.

## EXAMPLES
ip ntable show dev eth0

Shows the neighbour table (IPv4 ARP and IPv6 ndisc) parameters on device eth0.

ip ntable change name arp_cache queue 8 dev eth0

Changes the number of packets queued while address is being resolved from the default value (3) to 8 packets.

## SEE ALSO
ip(8)

## AUTHOR
Manpage by Stephen Hemminger


ip-route

title: ip-route(8)

summary: routing table management

text:
# ip-route(8)

## NAME
ip-route - routing table management

## SYNOPSIS

ip [ ip-OPTIONS ] route { COMMAND | help }

ip route { show | flush } SELECTOR

ip route save SELECTOR

ip route restore

ip route get ROUTE_GET_FLAGS ADDRESS [ from ADDRESS iif STRING ] [ oif STRING ] [ mark MARK ] [ tos TOS ] [ vrf NAME ] [ ipproto PROTOCOL ] [ sport NUMBER ] [ dport NUMBER ]

ip route { add | del | change | append | replace } ROUTE

SELECTOR := [ root PREFIX ] [ match PREFIX ] [ exact PREFIX ] [ table TABLE_ID ] [ vrf NAME ] [ proto RTPROTO ] [ type TYPE ] [ scope SCOPE ]

ROUTE := NODE_SPEC [ INFO_SPEC ]

NODE_SPEC := [ TYPE ] PREFIX [ tos TOS ] [ table TABLE_ID ] [ proto RTPROTO ] [ scope SCOPE ] [ metric METRIC ] [ ttl-propagate { enabled | disabled } ]

INFO_SPEC := { NH | nhid ID } OPTIONS FLAGS [ nexthop NH ] ...

NH := [ encap ENCAP ] [ via [ FAMILY ] ADDRESS ] [ dev STRING ] [ weight NUMBER ] NHFLAGS

FAMILY := [ inet | inet6 | mpls | bridge | link ]

OPTIONS := FLAGS [ mtu NUMBER ] [ advmss NUMBER ] [ as [ to ] ADDRESS ] rtt TIME ] [ rttvar TIME ] [ reordering NUMBER ] [ window NUMBER ] [ cwnd NUMBER ] [ ssthresh NUMBER ] [ realms REALM ] [ rto_min TIME ] [ initcwnd NUMBER ] [ initrwnd NUMBER ] [ features FEATURES ] [ quickack BOOL ] [ congctl NAME ] [ pref PREF ] [ expires TIME ] [ fastopen_no_cookie BOOL ]

TYPE := [ unicast | local | broadcast | multicast | throw | unreachable | prohibit | blackhole | nat ]

TABLE_ID := [ local| main | default | all | NUMBER ]

SCOPE := [ host | link | global | NUMBER ]

NHFLAGS := [ onlink | pervasive ]

RTPROTO := [ kernel | boot | static | NUMBER ]

FEATURES := [ ecn | ]

PREF := [ low | medium | high ]

ENCAP := [ ENCAP_MPLS | ENCAP_IP | ENCAP_BPF | ENCAP_SEG6 | ENCAP_SEG6LOCAL ]

ENCAP_MPLS := mpls [ LABEL ] [ ttl TTL ]

ENCAP_IP := ip id TUNNEL_ID dst REMOTE_IP [ src SRC ] [ tos TOS ] [ ttl TTL ]

ENCAP_BPF := bpf [ in PROG ] [ out PROG ] [ xmit PROG ] [ headroom SIZE ]

ENCAP_SEG6 := seg6 mode [ encap | inline | l2encap ] segs SEGMENTS [ hmac KEYID ]

ENCAP_SEG6LOCAL := seg6local action SEG6_ACTION [ SEG6_ACTION_PARAM ]

ROUTE_GET_FLAGS := [ fibmatch ]

## DESCRIPTION
ip route is used to manipulate entries in the kernel routing tables.

Route types:

unicast - the route entry describes real paths to the destinations covered by the route prefix.

unreachable - these destinations are unreachable. Packets are discarded and the ICMP message host unreachable is generated. The local senders get an EHOSTUNREACH error.

blackhole - these destinations are unreachable. Packets are discarded silently. The local senders get an EINVAL error.

prohibit - these destinations are unreachable. Packets are discarded and the ICMP message communication administratively prohibited is generated. The local senders get an EACCES error.

local - the destinations are assigned to this host. The packets are looped back and delivered locally.

broadcast - the destinations are broadcast addresses. The packets are sent as link broadcasts.

throw - a special control route used together with policy rules. If such a route is selected, lookup in this table is terminated pretending that no route was found. Without policy routing it is equivalent to the absence of the route in the routing table. The packets are dropped and the ICMP message net unreachable is generated. The local senders get an ENETUNREACH error.

nat - a special NAT route. Destinations covered by the prefix are considered to be dummy (or external) addresses which require translation to real (or internal) ones before forwarding. The addresses to translate to are selected with the attribute via. Warning: Route NAT is no longer supported in Linux 2.6.

anycast - not implemented the destinations are anycast addresses assigned to this host. They are mainly equivalent to local with one difference: such addresses are invalid when used as the source address of any packet.

multicast - a special type used for multicast routing. It is not present in normal routing tables.

Route tables: Linux-2.x can pack routes into several routing tables identified by a number in the range from 1 to 2^32-1 or by name from the file /etc/iproute2/rt_tables By default all normal routes are inserted into the main table (ID 254) and the kernel only uses this table when calculating routes. Values (0, 253, 254, and 255) are reserved for built-in use.

Actually, one other table always exists, which is invisible but even more important. It is the local table (ID 255). This table consists of routes for local and broadcast addresses. The kernel maintains this table automatically and the administrator usually need not modify it or even look at it.

The multiple routing tables enter the game when policy routing is used.

ip route add

add new route

ip route change

change route

ip route replace

change or add new one

to TYPE PREFIX (default)

the destination prefix of the route. If TYPE is omitted, ip assumes type unicast. Other values of TYPE are listed above. PREFIX is an IP or IPv6 address optionally followed by a slash and the prefix length. If the length of the prefix is missing, ip assumes a full-length host route. There is also a special PREFIX default - which is equivalent to IP 0/0 or to IPv6 ::/0.

tos TOS

dsfield TOS

the Type Of Service (TOS) key. This key has no associated mask and the longest match is understood as: First, compare the TOS of the route and of the packet. If they are not equal, then the packet may still match a route with a zero TOS. TOS is either an 8 bit hexadecimal number or an identifier from /etc/iproute2/rt_dsfield.

metric NUMBER

preference NUMBER

the preference value of the route. NUMBER is an arbitrary 32bit number, where routes with lower values are preferred.

table TABLEID

the table to add this route to. TABLEID may be a number or a string from the file /etc/iproute2/rt_tables. If this parameter is omitted, ip assumes the main table, with the exception of local, broadcast and nat routes, which are put into the local table by default.

vrf NAME

the vrf name to add this route to. Implicitly means the table associated with the VRF.

dev NAME

the output device name.

via [ FAMILY ] ADDRESS

the address of the nexthop router, in the address family FAMILY. Actually, the sense of this field depends on the route type. For normal unicast routes it is either the true next hop router or, if it is a direct route installed in BSD compatibility mode, it can be a local address of the interface. For NAT routes it is the first address of the block of translated IP destinations.

src ADDRESS

the source address to prefer when sending to the destinations covered by the route prefix.

realm REALMID

the realm to which this route is assigned. REALMID may be a number or a string from the file /etc/iproute2/rt_realms.

mtu MTU

mtu lock MTU

the MTU along the path to the destination. If the modifier lock is not used, the MTU may be updated by the kernel due to Path MTU Discovery. If the modifier lock is used, no path MTU discovery will be tried, all packets will be sent without the DF bit in IPv4 case or fragmented to MTU for IPv6.

window NUMBER

the maximal window for TCP to advertise to these destinations, measured in bytes. It limits maximal data bursts that our TCP peers are allowed to send to us.

rtt TIME

the initial RTT ('Round Trip Time') estimate. If no suffix is specified the units are raw values passed directly to the routing code to maintain compatibility with previous releases. Otherwise if a suffix of s, sec or secs is used to specify seconds and ms, msec or msecs to specify milliseconds.

rttvar TIME (Linux 2.3.15+ only)

the initial RTT variance estimate. Values are specified as with rtt above.

rto_min TIME (Linux 2.6.23+ only)

the minimum TCP Retransmission TimeOut to use when communicating with this destination. Values are specified as with rtt above.

ssthresh NUMBER (Linux 2.3.15+ only)

an estimate for the initial slow start threshold.

cwnd NUMBER (Linux 2.3.15+ only)

the clamp for congestion window. It is ignored if the lock flag is not used.

initcwnd NUMBER (Linux 2.5.70+ only)

the initial congestion window size for connections to this destination. Actual window size is this value multiplied by the MSS (``Maximal Segment Size'') for same connection. The default is zero, meaning to use the values specified in RFC2414.

initrwnd NUMBER (Linux 2.6.33+ only)

the initial receive window size for connections to this destination. Actual window size is this value multiplied by the MSS of the connection. The default value is zero, meaning to use Slow Start value.

features FEATURES (Linux3.18+only)

Enable or disable per-route features. Only available feature at this time is ecn to enable explicit congestion notification when initiating connections to the given destination network. When responding to a connection request from the given network, ecn will also be used even if the net.ipv4.tcp_ecn sysctl is set to 0.

quickack BOOL (Linux 3.11+ only)

Enable or disable quick ack for connections to this destination.

fastopen_no_cookie BOOL (Linux 4.15+ only)

Enable TCP Fastopen without a cookie for connections to this destination.

congctl NAME (Linux 3.20+ only)

congctl lock NAME (Linux 3.20+ only)

Sets a specific TCP congestion control algorithm only for a given destination. If not specified, Linux keeps the current global default TCP congestion control algorithm, or the one set from the application. If the modifier lock is not used, an application may nevertheless overwrite the suggested congestion control algorithm for that destination. If the modifier lock is used, then an application is not allowed to overwrite the specified congestion control algorithm for that destination, thus it will be enforced/guaranteed to use the proposed algorithm.

advmss NUMBER (Linux 2.3.15+ only)

the MSS ('Maximal Segment Size') to advertise to these destinations when establishing TCP connections. If it is not given, Linux uses a default value calculated from the first hop device MTU. (If the path to these destination is asymmetric, this guess may be wrong.)

reordering NUMBER (Linux 2.3.15+ only)

Maximal reordering on the path to this destination. If it is not given, Linux uses the value selected with sysctl variable net/ipv4/tcp_reordering.

nexthop NEXTHOP

the nexthop of a multipath route. NEXTHOP is a complex value with its own syntax similar to the top level argument lists:

via [ FAMILY ] ADDRESS - is the nexthop router.

dev NAME - is the output device.

weight NUMBER - is a weight for this element of a multipath route reflecting its relative bandwidth or quality.

The internal buffer used in iproute2 limits the maximum number of nexthops that may be specified in one go. If only ADDRESS is given, the current buffer size allows for 144 IPv6 nexthops and 253 IPv4 ones. For IPv4, this effectively limits the number of nexthops possible per route. With IPv6, further nexthops may be appended to the same route via ip route append command.

scope SCOPE_VAL

the scope of the destinations covered by the route prefix. SCOPE_VAL may be a number or a string from the file /etc/iproute2/rt_scopes. If this parameter is omitted, ip assumes scope global for all gatewayed unicast routes, scope link for direct unicast and broadcast routes and scope host for local routes.

protocol RTPROTO

the routing protocol identifier of this route. RTPROTO may be a number or a string from the file /etc/iproute2/rt_protos. If the routing protocol ID is not given, ip assumes protocol boot (i.e. it assumes the route was added by someone who doesn't understand what they are doing). Several protocol values have a fixed interpretation. Namely:

redirect - the route was installed due to an ICMP redirect.

kernel - the route was installed by the kernel during autoconfiguration.

boot - the route was installed during the bootup sequence. If a routing daemon starts, it will purge all of them.

static - the route was installed by the administrator to override dynamic routing. Routing daemon will respect them and, probably, even advertise them to its peers.

ra - the route was installed by Router Discovery protocol.

The rest of the values are not reserved and the administrator is free to assign (or not to assign) protocol tags.

onlink

pretend that the nexthop is directly attached to this link, even if it does not match any interface prefix.

pref PREF

the IPv6 route preference. PREF is a string specifying the route preference as defined in RFC4191 for Router Discovery messages. Namely:

low - the route has a lowest priority

medium - the route has a default priority

high - the route has a highest priority

nhid ID

use nexthop object with given id as nexthop specification.

encap ENCAPTYPE ENCAPHDR

attach tunnel encapsulation attributes to this route. ENCAPTYPE is a string specifying the supported encapsulation type. Namely:

mpls - encapsulation type MPLS

ip - IP encapsulation (Geneve, GRE, VXLAN, ...)

bpf - Execution of BPF program

seg6 - encapsulation type IPv6 Segment Routing

seg6local - local SRv6 segment processing

ENCAPHDR is a set of encapsulation attributes specific to the ENCAPTYPE.

mpls

MPLSLABEL - mpls label stack with labels separated by /

ttl TTL - TTL to use for MPLS header or 0 to inherit from IP header

ip

id TUNNEL_ID dst REMOTE_IP [ src SRC ] [ tos TOS ] [ ttl TTL ] [ key ] [ csum ] [ seq ]

bpf

in PROG - BPF program to execute for incoming packets

out PROG - BPF program to execute for outgoing packets

xmit PROG - BPF program to execute for transmitted packets

headroom SIZE - Size of header BPF program will attach (xmit)

seg6

mode inline - Directly insert Segment Routing Header after IPv6 header

mode encap - Encapsulate packet in an outer IPv6 header with SRH

mode l2encap - Encapsulate ingress L2 frame within an outer IPv6 header and SRH

SEGMENTS - List of comma-separated IPv6 addresses

KEYID - Numerical value in decimal representation. See ip-sr(8).

seg6local

SEG6_ACTION [ SEG6_ACTION_PARAM ] - Operation to perform on matching packets. The following actions are currently supported (Linux 4.14+ only).

End - Regular SRv6 processing as intermediate segment endpoint. This action only accepts packets with a non-zero Segments Left value. Other matching packets are dropped.

End.X nh6 NEXTHOP - Regular SRv6 processing as intermediate segment endpoint. Additionally, forward processed packets to given next-hop. This action only accepts packets with a non-zero Segments Left value. Other matching packets are dropped.

End.DX6 nh6 NEXTHOP - Decapsulate inner IPv6 packet and forward it to the specified next-hop. If the argument is set to ::, then the next-hop is selected according to the local selection rules. This action only accepts packets with either a zero Segments Left value or no SRH at all, and an inner IPv6 packet. Other matching packets are dropped.

End.B6 srh segs SEGMENTS [ hmac KEYID ] - Insert the specified SRH immediately after the IPv6 header, update the DA with the first segment of the newly inserted SRH, then forward the resulting packet. The original SRH is not modified. This action only accepts packets with a non-zero Segments Left value. Other matching packets are dropped.

End.B6.Encaps srh segs SEGMENTS [ hmac KEYID ] - Regular SRv6 processing as intermediate segment endpoint. Additionally, encapsulate the matching packet within an outer IPv6 header followed by the specified SRH. The destination address of the outer IPv6 header is set to the first segment of the new SRH. The source address is set as described in ip-sr(8).

expires TIME (Linux 4.4+ only)

the route will be deleted after the expires time. Only support IPv6 at present.

ttl-propagate { enabled | disabled }

Control whether TTL should be propagated from any encap into the un-encapsulated packet, overriding any global configuration. Only supported for MPLS at present.

ip route delete

delete route

ip route del has the same arguments as ip route add, but their semantics are a bit different. Key values (to, tos, preference and table) select the route to delete. If optional attributes are present, ip verifies that they coincide with the attributes of the route to delete. If no route with the given key and attributes was found, ip route del fails.

ip route show

list routes

the command displays the contents of the routing tables or the route(s) selected by some criteria.

to SELECTOR (default)

only select routes from the given range of destinations. SELECTOR consists of an optional modifier (root, match or exact) and a prefix. root PREFIX selects routes with prefixes not shorter than PREFIX. F.e. root 0/0 selects the entire routing table. match PREFIX selects routes with prefixes not longer than PREFIX. F.e. match 10.0/16 selects 10.0/16, 10/8 and 0/0, but it does not select 10.1/16 and 10.0.0/24. And exact PREFIX (or just PREFIX) selects routes with this exact prefix. If neither of these options are present, ip assumes root 0/0 i.e. it lists the entire table.

tos TOS

dsfield TOS

only select routes with the given TOS.

table TABLEID

show the routes from this table(s). The default setting is to show table main. TABLEID may either be the ID of a real table or one of the special values:

all - list all of the tables.

cache - dump the routing cache.

vrf NAME

show the routes for the table associated with the vrf name

cloned

cached

list cloned routes i.e. routes which were dynamically forked from other routes because some route attribute (f.e. MTU) was updated. Actually, it is equivalent to table cache.

from SELECTOR

the same syntax as for to, but it binds the source address range rather than destinations. Note that the from option only works with cloned routes.

protocol RTPROTO

only list routes of this protocol.

scope SCOPE_VAL

only list routes with this scope.

type TYPE

only list routes of this type.

dev NAME

only list routes going via this device.

via [ FAMILY ] PREFIX

only list routes going via the nexthop routers selected by PREFIX.

src PREFIX

only list routes with preferred source addresses selected by PREFIX.

realm REALMID

realms FROMREALM/TOREALM

only list routes with these realms.

ip route flush

flush routing tables

this command flushes routes selected by some criteria.

The arguments have the same syntax and semantics as the arguments of ip route show, but routing tables are not listed but purged. The only difference is the default action: show dumps all the IP main routing table but flush prints the helper page.

With the -statistics option, the command becomes verbose. It prints out the number of deleted routes and the number of rounds made to flush the routing table. If the option is given twice, ip route flush also dumps all the deleted routes in the format described in the previous subsection.

ip route get

get a single route

this command gets a single route to a destination and prints its contents exactly as the kernel sees it.

fibmatch

Return full fib lookup matched route. Default is to return the resolved dst entry

to ADDRESS (default)

the destination address.

from ADDRESS

the source address.

tos TOS

dsfield TOS

the Type Of Service.

iif NAME

the device from which this packet is expected to arrive.

oif NAME

force the output device on which this packet will be routed.

mark MARK

the firewall mark (fwmark)

vrf NAME

force the vrf device on which this packet will be routed.

ipproto PROTOCOL

ip protocol as seen by the route lookup

sport NUMBER

source port as seen by the route lookup

dport NUMBER

destination port as seen by the route lookup

connected

if no source address (option from) was given, relookup the route with the source set to the preferred address received from the first lookup. If policy routing is used, it may be a different route.

Note that this operation is not equivalent to ip route show. show shows existing routes. get resolves them and creates new clones if necessary. Essentially, get is equivalent to sending a packet along this path. If the iif argument is not given, the kernel creates a route to output packets towards the requested destination. This is equivalent to pinging the destination with a subsequent ip route ls cache, however, no packets are actually sent. With the iif argument, the kernel pretends that a packet arrived from this interface and searches for a path to forward the packet.

ip route save

save routing table information to stdout

This command behaves like ip route show except that the output is raw data suitable for passing to ip route restore.

ip route restore

restore routing table information from stdin

This command expects to read a data stream as returned from ip route save. It will attempt to restore the routing table information exactly as it was at the time of the save, so any translation of information in the stream (such as device indexes) must be done first. Any existing routes are left unchanged. Any routes specified in the data stream that already exist in the table will be ignored.

## NOTES
Starting with Linux kernel version 3.6, there is no routing cache for IPv4 anymore. Hence ip route show cached will never print any entries on systems with this or newer kernel versions.

## EXAMPLES
ip ro

Show all route entries in the kernel.

ip route add default via 192.168.1.1 dev eth0

Adds a default route (for all addresses) via the local gateway 192.168.1.1 that can be reached on device eth0.

ip route add 10.1.1.0/30 encap mpls 200/300 via 10.1.1.1 dev eth0

Adds an ipv4 route with mpls encapsulation attributes attached to it.

ip -6 route add 2001:db8:1::/64 encap seg6 mode encap segs 2001:db8:42::1,2001:db8:ffff::2 dev eth0

Adds an IPv6 route with SRv6 encapsulation and two segments attached.

ip route add 10.1.1.0/30 nhid 10

Adds an ipv4 route using nexthop object with id 10.

## SEE ALSO
ip(8)

## AUTHOR
Original Manpage by Michail Litvak <mci@owl.openwall.com>


ip-rule

title: ip-rule(8)

summary: routing policy database management

text:
# ip-rule(8)

## NAME
ip-rule - routing policy database management

## SYNOPSIS

ip [ OPTIONS ] rule { COMMAND | help }

ip rule [ list [ SELECTOR ]]

ip rule { add | del } SELECTOR ACTION

ip rule { flush | save | restore }

SELECTOR := [ not ] [ from PREFIX ] [ to PREFIX ] [ tos TOS ] [ fwmark FWMARK[/MASK] ] [ iif STRING ] [ oif STRING ] [ pref NUMBER ] [ l3mdev ] [ uidrange NUMBER-NUMBER ] [ ipproto PROTOCOL ] [ sport [ NUMBER | NUMBER-NUMBER ] ] [ dport [ NUMBER | NUMBER-NUMBER ] ] [ tun_id TUN_ID ]

ACTION := [ table TABLE_ID ] [ protocol PROTO ] [ nat ADDRESS ] [ realms [SRCREALM/]DSTREALM ] [ goto NUMBER ] SUPPRESSOR

SUPPRESSOR := [ suppress_prefixlength NUMBER ] [ suppress_ifgroup GROUP ]

TABLE_ID := [ local | main | default | NUMBER ]

## DESCRIPTION
ip rule manipulates rules in the routing policy database control the route selection algorithm.

Classic routing algorithms used in the Internet make routing decisions based only on the destination address of packets (and in theory, but not in practice, on the TOS field).

In some circumstances we want to route packets differently depending not only on destination addresses, but also on other packet fields: source address, IP protocol, transport protocol ports or even packet payload. This task is called 'policy routing'.

To solve this task, the conventional destination based routing table, ordered according to the longest match rule, is replaced with a 'routing policy database' (or RPDB), which selects routes by executing some set of rules.

Each policy routing rule consists of a selector and an action predicate. The RPDB is scanned in order of decreasing priority (note that lower number means higher priority, see the description of PREFERENCE below). The selector of each rule is applied to {source address, destination address, incoming interface, tos, fwmark} and, if the selector matches the packet, the action is performed. The action predicate may return with success. In this case, it will either give a route or failure indication and the RPDB lookup is terminated. Otherwise, the RPDB program continues with the next rule.

Semantically, the natural action is to select the nexthop and the output device.

At startup time the kernel configures the default RPDB consisting of three rules:

1.

Priority: 0, Selector: match anything, Action: lookup routing table local (ID 255). The local table is a special routing table containing high priority control routes for local and broadcast addresses.

2.

Priority: 32766, Selector: match anything, Action: lookup routing table main (ID 254). The main table is the normal routing table containing all non-policy routes. This rule may be deleted and/or overridden with other ones by the administrator.

3.

Priority: 32767, Selector: match anything, Action: lookup routing table default (ID 253). The default table is empty. It is reserved for some post-processing if no previous default rules selected the packet. This rule may also be deleted.

Each RPDB entry has additional attributes. F.e. each rule has a pointer to some routing table. NAT and masquerading rules have an attribute to select new IP address to translate/masquerade. Besides that, rules have some optional attributes, which routes have, namely realms. These values do not override those contained in the routing tables. They are only used if the route did not select any attributes.

The RPDB may contain rules of the following types:

unicast - the rule prescribes to return the route found in the routing table referenced by the rule. blackhole - the rule prescribes to silently drop the packet.

unreachable - the rule prescribes to generate a 'Network is unreachable' error.

prohibit - the rule prescribes to generate 'Communication is administratively prohibited' error.

nat - the rule prescribes to translate the source address of the IP packet into some other value.

ip rule add - insert a new rule

ip rule delete - delete a rule

type TYPE (default)

the type of this rule. The list of valid types was given in the previous subsection.

from PREFIX

select the source prefix to match.

to PREFIX

select the destination prefix to match.

iif NAME

select the incoming device to match. If the interface is loopback, the rule only matches packets originating from this host. This means that you may create separate routing tables for forwarded and local packets and, hence, completely segregate them.

oif NAME

select the outgoing device to match. The outgoing interface is only available for packets originating from local sockets that are bound to a device.

tos TOS

dsfield TOS

select the TOS value to match.

fwmark MARK

select the fwmark value to match.

uidrange NUMBER-NUMBER

select the uid value to match.

ipproto PROTOCOL

select the ip protocol value to match.

sport NUMBER | NUMBER-NUMBER

select the source port value to match. supports port range.

dport NUMBER | NUMBER-NUMBER

select the destination port value to match. supports port range.

priority PREFERENCE

the priority of this rule. PREFERENCE is an unsigned integer value, higher number means lower priority, and rules get processed in order of increasing number. Each rule should have an explicitly set unique priority value. The options preference and order are synonyms with priority.

table TABLEID

the routing table identifier to lookup if the rule selector matches. It is also possible to use lookup instead of table.

protocol PROTO

the routing protocol who installed the rule in question. As an example when zebra installs a rule it would get RTPROT_ZEBRA as the installing protocol.

suppress_prefixlength NUMBER

reject routing decisions that have a prefix length of NUMBER or less.

suppress_ifgroup GROUP

reject routing decisions that use a device belonging to the interface group GROUP.

realms FROM/TO

Realms to select if the rule matched and the routing table lookup succeeded. Realm TO is only used if the route did not select any realm.

nat ADDRESS

The base of the IP address block to translate (for source addresses). The ADDRESS may be either the start of the block of NAT addresses (selected by NAT routes) or a local host address (or even zero). In the last case the router does not translate the packets, but masquerades them to this address. Using map-to instead of nat means the same thing. Warning: Changes to the RPDB made with these commands do not become active immediately. It is assumed that after a script finishes a batch of updates, it flushes the routing cache with ip route flush cache.

ip rule flush - also dumps all the deleted rules.

protocol PROTO

Select the originating protocol.

ip rule show - list rules

This command has no arguments. The options list or lst are synonyms with show.

ip rule save

protocol PROTO

Select the originating protocol.

save rules table information to stdout

This command behaves like ip rule show except that the output is raw data suitable for passing to ip rule restore.

ip rule restore

restore rules table information from stdin

This command expects to read a data stream as returned from ip rule save. It will attempt to restore the rules table information exactly as it was at the time of the save. Any rules already in the table are left unchanged, and duplicates are not ignored.

## SEE ALSO
ip(8)

## AUTHOR
Original Manpage by Michail Litvak <mci@owl.openwall.com>


ip-sr

title: ip-sr(8)

summary: IPv6 Segment Routing management

text:
# ip-sr(8)

## NAME
ip-sr - IPv6 Segment Routing management

## SYNOPSIS

ip sr { COMMAND | help }

ip sr hmac show

ip sr hmac set KEYID ALGO

ip sr tunsrc show

ip sr tunsrc set ADDRESS

## DESCRIPTION
The ip sr command is used to configure IPv6 Segment Routing (SRv6) internal parameters.

Those parameters include the mapping between an HMAC key ID and its associated hashing algorithm and secret, and the IPv6 address to use as source for encapsulated packets.

The ip sr hmac set command prompts for a passphrase that will be used as the HMAC secret for the corresponding key ID. A blank passphrase removes the mapping. The currently supported algorithms for ALGO are sha1 and sha256.

If the tunnel source is set to the address :: (which is the default), then an address of the egress interface will be selected. As this operation may hinder performances, it is recommended to set a non-default address.

## EXAMPLES

### Configure an HMAC mapping for key ID 42 and hashing algorithm SHA-256

```
# ip sr hmac set 42 sha256
```

### Set the tunnel source address to 2001:db8::1

```
# ip sr tunsrc set 2001:db8::1
```

## SEE ALSO
ip-route(8)

## AUTHOR
David Lebrun <david.lebrun@uclouvain.be>


title: ip-tcp_metrics(8)

summary: management for TCP Metrics

text:
# ip-tcp_metrics(8)

## NAME
ip-tcp_metrics - management for TCP Metrics

## SYNOPSIS

ip [ OPTIONS ] tcp_metrics { COMMAND | help }

ip tcp_metrics { show | flush } SELECTOR

ip tcp_metrics delete [ address ] ADDRESS

SELECTOR := [ [ address ] PREFIX ]

## DESCRIPTION
ip tcp_metrics is used to manipulate entries in the kernel that keep TCP information for IPv4 and IPv6 destinations. The entries are created when TCP sockets want to share information for destinations and are stored in a cache keyed by the destination address. The saved information may include values for metrics (initially obtained from routes), recent TSVAL for TIME-WAIT recycling purposes, state for the Fast Open feature, etc. For performance reasons the cache can not grow above configured limit and the older entries are replaced with fresh information, sometimes reclaimed and used for new destinations. The kernel never removes entries, they can be flushed only with this tool.

### ip tcp_metrics show - show cached entries
address PREFIX (default)

IPv4/IPv6 prefix or address. If no prefix is provided all entries are shown.

The output may contain the following information:

age <S.MMM>sec - time after the entry was created, reset or updated with metrics from sockets. The entry is reset and refreshed on use with metrics from route if the metrics are not updated in last hour. Not all cached values reset the age on update.

cwnd <N> - CWND metric value

fo_cookie <HEX-STRING> - Cookie value received in SYN-ACK to be used by Fast Open for next SYNs

fo_mss <N> - MSS value received in SYN-ACK to be used by Fast Open for next SYNs

fo_syn_drops <N>/<S.MMM>sec ago - Number of drops of initial outgoing Fast Open SYNs with data detected by monitoring the received SYN-ACK after SYN retransmission. The seconds show the time after last SYN drop and together with the drop count can be used to disable Fast Open for some time.

reordering <N> - Reordering metric value

rtt <N>us - RTT metric value

rttvar <N>us - RTTVAR metric value

ssthresh <SSTHRESH> - SSTHRESH metric value

tw_ts <TSVAL>/<SEC>sec ago - recent TSVAL and the seconds after saving it into TIME-WAIT socket

### ip tcp_metrics delete - delete single entry
address ADDRESS (default)

IPv4/IPv6 address. The address is a required argument.

### ip tcp_metrics flush - flush entries
This command flushes the entries selected by some criteria.

This command has the same arguments as show.

## EXAMPLES
ip tcp_metrics show address 192.168.0.0/24

Shows the entries for destinations from subnet

ip tcp_metrics show 192.168.0.0/24

The same but address keyword is optional

ip tcp_metrics

Show all is the default action

ip tcp_metrics delete 192.168.0.1

Removes the entry for 192.168.0.1 from cache.

ip tcp_metrics flush 192.168.0.0/24

Removes entries for destinations from subnet

ip tcp_metrics flush all

Removes all entries from cache

ip -6 tcp_metrics flush all

Removes all IPv6 entries from cache keeping the IPv4 entries.

## SEE ALSO
ip(8)

## AUTHOR
Original Manpage by Julian Anastasov <ja@ssi.bg>


ip-token

title: ip-token(8)

summary: tokenized interface identifier support

text:
# ip-token(8)

## NAME
ip-token - tokenized interface identifier support

## SYNOPSIS

ip token { COMMAND | help }

ip token set TOKEN dev DEV

ip token del dev DEV

ip token get [ dev DEV ]

ip token [ list ]

## DESCRIPTION
IPv6 tokenized interface identifier support is used for assigning well-known host-part addresses to nodes whilst still obtaining a global network prefix from Router advertisements. The primary target for tokenized identifiers are server platforms where addresses are usually manually configured, rather than using DHCPv6 or SLAAC. By using tokenized identifiers, hosts can still determine their network prefix by use of SLAAC, but more readily be automatically renumbered should their network prefix change [1]. Tokenized IPv6 Identifiers are described in the draft [1]: <draft-chown-6man-tokenised-ipv6-identifiers-02>.

### ip token set - set an interface token
set the interface token to the kernel.

TOKEN

the interface identifier token address.

dev DEV

the networking interface.

### ip token del - delete an interface token
delete the interface token from the kernel.

dev DEV

the networking interface.

### ip token get - get the interface token from the kernel
show a tokenized interface identifier of a particular networking device. Arguments: coincide with the arguments of ip token set but the TOKEN must be left out.

### ip token list - list all interface tokens
list all tokenized interface identifiers for the networking interfaces from the kernel.

## SEE ALSO
ip(8)

## AUTHOR
Manpage by Daniel Borkmann


ip-tunnel

title: ip-tunnel(8)

text:
# ip-tunnel(8)

## NAME
ip-tunnel - tunnel configuration

## SYNOPSIS

ip tunnel help

ip [ OPTIONS ] tunnel { add | change | del | show | prl | 6rd } [ NAME ]

[ mode MODE ] [ remote ADDR ] [ local ADDR ]

[ [i|o]seq ] [ [i|o]key KEY ] [ [i|o]csum ] ]

[ encaplimit ELIM ] [ ttl|hoplimit TTL ]

[ tos TOS ] [ flowlabel FLOWLABEL ]

[ prl-default ADDR ] [ prl-nodefault ADDR ] [ prl-delete ADDR ]

[ 6rd-prefix ADDR ] [ 6rd-relay_prefix ADDR ] [ 6rd-reset ]

[ [no]pmtudisc ] [ [no]ignore-df ] [ [no]allow-localremote ]

[ dev PHYS_DEV ]

MODE := { ipip | gre | sit | isatap | vti | ip6ip6 | ipip6 | ip6gre | vti6 | any }

ADDR := { IP_ADDRESS | any }

TOS := { STRING | 00..ff | inherit | inherit/STRING | inherit/00..ff }

ELIM := { none | 0..255 }

TTL := { 1..255 | inherit }

KEY := { DOTTED_QUAD | NUMBER }

## DESCRIPTION
tunnel objects are tunnels, encapsulating packets in IP packets and then sending them over the IP infrastructure. The encapsulating (or outer) address family is specified by the -f option. The default is IPv4.

ip tunnel add

add a new tunnel

ip tunnel change

change an existing tunnel

ip tunnel delete

destroy a tunnel

name NAME (default)

select the tunnel device name.

mode MODE

set the tunnel mode. Available modes depend on the encapsulating address family.

Modes for IPv4 encapsulation available: ipip, sit, isatap, vti, and gre.

Modes for IPv6 encapsulation available: ip6ip6, ipip6, ip6gre, vti6, and any.

remote ADDRESS

set the remote endpoint of the tunnel.

local ADDRESS

set the fixed local address for tunneled packets. It must be an address on another interface of this host.

ttl N

hoplimit N

set a fixed TTL (IPv4) or hoplimit (IPv6) N on tunneled packets. N is a number in the range 1--255. 0 is a special value meaning that packets inherit the TTL value. The default value for IPv4 tunnels is: inherit. The default value for IPv6 tunnels is: 64.

tos T

dsfield T

tclass T

set the type of service (IPv4) or traffic class (IPv6) field on tunneled packets, which can be specified as either a two-digit hex value (e.g. c0) or a predefined string (e.g. internet). The value inherit causes the field to be copied from the original IP header. The values inherit/STRING or inherit/00..ff will set the field to STRING or 00..ff when tunneling non-IP packets. The default value is 00.

dev NAME

bind the tunnel to the device NAME so that tunneled packets will only be routed via this device and will not be able to escape to another device when the route to endpoint changes.

nopmtudisc

disable Path MTU Discovery on this tunnel. It is enabled by default. Note that a fixed ttl is incompatible with this option: tunneling with a fixed ttl always makes pmtu discovery.

ignore-df

enable IPv4 DF suppression on this tunnel. Normally datagrams that exceed the MTU will be fragmented; the presence of the DF flag inhibits this, resulting instead in an ICMP Unreachable (Fragmentation Required) message. Enabling this attribute causes the DF flag to be ignored.

key K

ikey K

okey K

( only GRE tunnels ) use keyed GRE with key K. K is either a number or an IP address-like dotted quad. The key parameter sets the key to use in both directions. The ikey and okey parameters set different keys for input and output.

csum, icsum, ocsum

( only GRE tunnels ) generate/require checksums for tunneled packets. The ocsum flag calculates checksums for outgoing packets. The icsum flag requires that all input packets have the correct checksum. The csum flag is equivalent to the combination icsum ocsum.

seq, iseq, oseq

( only GRE tunnels ) serialize packets. The oseq flag enables sequencing of outgoing packets. The iseq flag requires that all input packets are serialized. The seq flag is equivalent to the combination iseq oseq. It doesn't work. Don't use it.

encaplim ELIM

( only IPv6 tunnels ) set a fixed encapsulation limit. Default is 4.

flowlabel FLOWLABEL

( only IPv6 tunnels ) set a fixed flowlabel.

allow-localremote

( only IPv6 tunnels ) allow remote endpoint on the local host.

ip tunnel prl

potential router list (ISATAP only)

dev NAME

mandatory device name.

prl-default ADDR

prl-nodefault ADDR

prl-delete ADDR

Add or delete ADDR as a potential router or default router.

ip tunnel show

list tunnels This command has no arguments.

## SEE ALSO
ip(8)

## AUTHOR
Original Manpage by Michail Litvak <mci@owl.openwall.com>


ip-vrf

title: ip-vrf(8)

summary: run a command against a vrf

text:
# ip-vrf(8)

## NAME
ip-vrf - run a command against a vrf

## SYNOPSIS

ip vrf { COMMAND | help }

ip vrf show [ NAME ]

ip vrf identify [ PID ]

ip vrf pids NAME

ip vrf exec [ NAME ] command...

## DESCRIPTION
A VRF provides traffic isolation at layer 3 for routing, similar to how a VLAN is used to isolate traffic at layer 2. Fundamentally, a VRF is a separate routing table. Network devices are associated with a VRF by enslaving the device to the VRF. At that point network addresses assigned to the device are local to the VRF with host and connected routes moved to the table associated with the VRF.

A process can specify a VRF using several APIs -- binding the socket to the VRF device using SO_BINDTODEVICE, setting the VRF association using IP_UNICAST_IF or IPV6_UNICAST_IF, or specifying the VRF for a specific message using IP_PKTINFO or IPV6_PKTINFO.

By default a process is not bound to any VRF. An association can be set explicitly by making the program use one of the APIs mentioned above or implicitly using a helper to set SO_BINDTODEVICE for all IPv4 and IPv6 sockets (AF_INET and AF_INET6) when the socket is created. This ip-vrf command is a helper to run a command against a specific VRF with the VRF association inherited parent to child.

ip vrf show [ NAME ] - Show all configured VRF

This command lists all VRF and their corresponding table ids. If NAME is given, then only that VRF and table id is shown. The latter command is useful for scripting where the table id for a VRF is needed.

ip vrf exec [ NAME ] cmd ... - Run cmd against the named VRF

This command allows applications that are VRF unaware to be run against a VRF other than the default VRF (main table). A command can be run against the default VRF by passing the "default" as the VRF name. This is useful if the current shell is associated with another VRF (e.g, Management VRF).

This command requires the system to be booted with cgroup v2 (e.g. with systemd, add systemd.unified_cgroup_hierarchy=1 to the kernel command line).

This command also requires to be ran as root or with the CAP_SYS_ADMIN, CAP_NET_ADMIN and CAP_DAC_OVERRIDE capabilities. If built with libcap and if capabilities are added to the ip binary program via setcap, the program will drop them as the first thing when invoked, unless the command is vrf exec.

NOTE: capabilities will NOT be dropped if CAP_NET_ADMIN is set to INHERITABLE to avoid breaking programs with ambient capabilities that call ip. Do not set the INHERITABLE flag on the ip binary itself.

ip vrf identify [PID] - Report VRF association for process

This command shows the VRF association of the specified process. If PID is not specified then the id of the current process is used.

ip vrf pids NAME - Report processes associated with the named VRF

This command shows all process ids that are associated with the given VRF.

## CAVEATS
This command requires a kernel compiled with CGROUPS and CGROUP_BPF enabled.

The VRF helper *only* affects network layer sockets.

## EXAMPLES
ip vrf exec red ssh 10.100.1.254

Executes ssh to 10.100.1.254 against the VRF red table.

## SEE ALSO
ip(8), ip-link(8), ip-address(8), ip-route(8), ip-neighbor(8)

## AUTHOR
Original Manpage by David Ahern


ip-xfrm

title: ip-xfrm(8)

summary: transform configuration

text:
# ip-xfrm(8)

## NAME
ip-xfrm - transform configuration

## SYNOPSIS

ip [ OPTIONS ] xfrm { COMMAND | help }

ip xfrm XFRM-OBJECT { COMMAND | help }

XFRM-OBJECT := state | policy | monitor

ip xfrm state { add | update } ID [ ALGO-LIST ] [ mode MODE ] [ mark MARK [ mask MASK ] ] [ reqid REQID ] [ seq SEQ ] [ replay-window SIZE ] [ replay-seq SEQ ] [ replay-oseq SEQ ] [ replay-seq-hi SEQ ] [ replay-oseq-hi SEQ ] [ flag FLAG-LIST ] [ sel SELECTOR ] [ LIMIT-LIST ] [ encap ENCAP ] [ coa ADDR[/PLEN] ] [ ctx CTX ] [ extra-flag EXTRA-FLAG-LIST ] [ output-mark OUTPUT-MARK [ mask MASK ] ] [ if_id IF-ID ] [ tfcpad LENGTH ]

ip xfrm state allocspi ID [ mode MODE ] [ mark MARK [ mask MASK ] ] [ reqid REQID ] [ seq SEQ ] [ min SPI max SPI ]

ip xfrm state { delete | get } ID [ mark MARK [ mask MASK ] ]

ip [ -4 | -6 ] xfrm state deleteall [ ID ] [ mode MODE ] [ reqid REQID ] [ flag FLAG-LIST ]

ip [ -4 | -6 ] xfrm state list [ ID ] [ nokeys ] [ mode MODE ] [ reqid REQID ] [ flag FLAG-LIST ]

ip xfrm state flush [ proto XFRM-PROTO ]

ip xfrm state count

ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM-PROTO ] [ spi SPI ]

XFRM-PROTO := esp | ah | comp | route2 | hao

ALGO-LIST := [ ALGO-LIST ] ALGO

ALGO := { enc | auth } ALGO-NAME ALGO-KEYMAT |

auth-trunc ALGO-NAME ALGO-KEYMAT ALGO-TRUNC-LEN |

aead ALGO-NAME ALGO-KEYMAT ALGO-ICV-LEN |

comp ALGO-NAME

MODE := transport | tunnel | beet | ro | in_trigger

FLAG-LIST := [ FLAG-LIST ] FLAG

FLAG := noecn | decap-dscp | nopmtudisc | wildrecv | icmp | af-unspec | align4 | esn

SELECTOR := [ src ADDR[/PLEN] ] [ dst ADDR[/PLEN] ] [ dev DEV ]

[ UPSPEC ]

UPSPEC := proto { PROTO |

{ tcp | udp | sctp | dccp } [ sport PORT ] [ dport PORT ] |

{ icmp | ipv6-icmp | mobility-header } [ type NUMBER ] [ code NUMBER ] |

gre [ key { DOTTED-QUAD | NUMBER } ] }

LIMIT-LIST := [ LIMIT-LIST ] limit LIMIT

LIMIT := { time-soft | time-hard | time-use-soft | time-use-hard } SECONDS |

{ byte-soft | byte-hard } SIZE |

{ packet-soft | packet-hard } COUNT

ENCAP := { espinudp | espinudp-nonike | espintcp } SPORT DPORT OADDR

EXTRA-FLAG-LIST := [ EXTRA-FLAG-LIST ] EXTRA-FLAG

EXTRA-FLAG := dont-encap-dscp | oseq-may-wrap

ip xfrm policy { add | update } SELECTOR dir DIR [ ctx CTX ] [ mark MARK [ mask MASK ] ] [ index INDEX ] [ ptype PTYPE ] [ action ACTION ] [ priority PRIORITY ] [ flag FLAG-LIST ] [ if_id IF-ID ] [ LIMIT-LIST ] [ TMPL-LIST ]

ip xfrm policy { delete | get } { SELECTOR | index INDEX } dir DIR [ ctx CTX ] [ mark MARK [ mask MASK ] ] [ ptype PTYPE ] [ if_id IF-ID ]

ip [ -4 | -6 ] xfrm policy { deleteall | list } [ nosock ] [ SELECTOR ] [ dir DIR ] [ index INDEX ] [ ptype PTYPE ] [ action ACTION ] [ priority PRIORITY ] [ flag FLAG-LIST]

ip xfrm policy flush [ ptype PTYPE ]

ip xfrm policy count

ip xfrm policy set [ hthresh4 LBITS RBITS ] [ hthresh6 LBITS RBITS ]

SELECTOR := [ src ADDR[/PLEN] ] [ dst ADDR[/PLEN] ] [ dev DEV ] [ UPSPEC ]

UPSPEC := proto { PROTO |

{ tcp | udp | sctp | dccp } [ sport PORT ] [ dport PORT ] |

{ icmp | ipv6-icmp | mobility-header } [ type NUMBER ] [ code NUMBER ] |

gre [ key { DOTTED-QUAD | NUMBER } ] }

DIR := in | out | fwd

PTYPE := main | sub

ACTION := allow | block

FLAG-LIST := [ FLAG-LIST ] FLAG

FLAG := localok | icmp

LIMIT-LIST := [ LIMIT-LIST ] limit LIMIT

LIMIT := { time-soft | time-hard | time-use-soft | time-use-hard } SECONDS |

{ byte-soft | byte-hard } SIZE |

{ packet-soft | packet-hard } COUNT

TMPL-LIST := [ TMPL-LIST ] tmpl TMPL

TMPL := ID [ mode MODE ] [ reqid REQID ] [ level LEVEL ]

ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM-PROTO ] [ spi SPI ]

XFRM-PROTO := esp | ah | comp | route2 | hao

MODE := transport | tunnel | beet | ro | in_trigger

LEVEL := required | use

ip xfrm monitor [ all-nsid ] [ nokeys ] [ all

| LISTofXFRM-OBJECTS ]

LISTofXFRM-OBJECTS := [ LISTofXFRM-OBJECTS ] XFRM-OBJECT

XFRM-OBJECT := acquire | expire | SA | policy | aevent | report

## DESCRIPTION
xfrm is an IP framework for transforming packets (such as encrypting their payloads). This framework is used to implement the IPsec protocol suite (with the state object operating on the Security Association Database, and the policy object operating on the Security Policy Database). It is also used for the IP Payload Compression Protocol and features of Mobile IPv6.

ip xfrm state add

add new state into xfrm

ip xfrm state update

update existing state in xfrm

ip xfrm state allocspi

allocate an SPI value

ip xfrm state delete

delete existing state in xfrm

ip xfrm state get

get existing state in xfrm

ip xfrm state deleteall

delete all existing state in xfrm

ip xfrm state list

print out the list of existing state in xfrm

ip xfrm state flush

flush all state in xfrm

ip xfrm state count

count all existing state in xfrm

ID

is specified by a source address, destination address, transform protocol XFRM-PROTO, and/or Security Parameter Index SPI. (For IP Payload Compression, the Compression Parameter Index or CPI is used for SPI.)

XFRM-PROTO

specifies a transform protocol: IPsec Encapsulating Security Payload (esp), IPsec Authentication Header (ah), IP Payload Compression (comp), Mobile IPv6 Type 2 Routing Header (route2), or Mobile IPv6 Home Address Option (hao).

ALGO-LIST

contains one or more algorithms to use. Each algorithm ALGO is specified by:

•

the algorithm type: encryption (enc), authentication (auth or auth-trunc), authenticated encryption with associated data (aead), or compression (comp)

•

the algorithm name ALGO-NAME (see below)

•

(for all except comp) the keying material ALGO-KEYMAT, which may include both a key and a salt or nonce value; refer to the corresponding RFC

•

(for auth-trunc only) the truncation length ALGO-TRUNC-LEN in bits

•

(for aead only) the Integrity Check Value length ALGO-ICV-LEN in bits

Encryption algorithms include ecb(cipher_null), cbc(des), cbc(des3_ede), cbc(cast5), cbc(blowfish), cbc(aes), cbc(serpent), cbc(camellia), cbc(twofish), and rfc3686(ctr(aes)). Authentication algorithms include digest_null, hmac(md5), hmac(sha1), hmac(sha256), hmac(sha384), hmac(sha512), hmac(rmd160), and xcbc(aes).

Authenticated encryption with associated data (AEAD) algorithms include rfc4106(gcm(aes)), rfc4309(ccm(aes)), and rfc4543(gcm(aes)).

Compression algorithms include deflate, lzs, and lzjh.

MODE

specifies a mode of operation for the transform protocol. IPsec and IP Payload Compression modes are transport, tunnel, and (for IPsec ESP only) Bound End-to-End Tunnel (beet). Mobile IPv6 modes are route optimization (ro) and inbound trigger (in_trigger).

FLAG-LIST

contains one or more of the following optional flags: noecn, decap-dscp, nopmtudisc, wildrecv, icmp, af-unspec, align4, or esn.

SELECTOR

selects the traffic that will be controlled by the policy, based on the source address, the destination address, the network device, and/or UPSPEC.

UPSPEC

selects traffic by protocol. For the tcp, udp, sctp, or dccp protocols, the source and destination port can optionally be specified. For the icmp, ipv6-icmp, or mobility-header protocols, the type and code numbers can optionally be specified. For the gre protocol, the key can optionally be specified as a dotted-quad or number. Other protocols can be selected by name or number PROTO.

LIMIT-LIST

sets limits in seconds, bytes, or numbers of packets.

ENCAP

encapsulates packets with protocol espinudp, espinudp-nonike, or espintcp, using source port SPORT, destination port DPORT , and original address OADDR.

MARK

used to match xfrm policies and states

OUTPUT-MARK

used to set the output mark to influence the routing of the packets emitted by the state

IF-ID

xfrm interface identifier used to in both xfrm policies and states

ip xfrm policy add

add a new policy

ip xfrm policy update

update an existing policy

ip xfrm policy delete

delete an existing policy

ip xfrm policy get

get an existing policy

ip xfrm policy deleteall

delete all existing xfrm policies

ip xfrm policy list

print out the list of xfrm policies

ip xfrm policy flush

flush policies

nosock

filter (remove) all socket policies from the output.

SELECTOR

selects the traffic that will be controlled by the policy, based on the source address, the destination address, the network device, and/or UPSPEC.

UPSPEC

selects traffic by protocol. For the tcp, udp, sctp, or dccp protocols, the source and destination port can optionally be specified. For the icmp, ipv6-icmp, or mobility-header protocols, the type and code numbers can optionally be specified. For the gre protocol, the key can optionally be specified as a dotted-quad or number. Other protocols can be selected by name or number PROTO.

DIR

selects the policy direction as in, out, or fwd.

CTX

sets the security context.

PTYPE

can be main (default) or sub.

ACTION

can be allow (default) or block.

PRIORITY

is a number that defaults to zero.

FLAG-LIST

contains one or both of the following optional flags: local or icmp.

LIMIT-LIST

sets limits in seconds, bytes, or numbers of packets.

TMPL-LIST

is a template list specified using ID, MODE, REQID, and/or LEVEL.

ID

is specified by a source address, destination address, transform protocol XFRM-PROTO, and/or Security Parameter Index SPI. (For IP Payload Compression, the Compression Parameter Index or CPI is used for SPI.)

XFRM-PROTO

specifies a transform protocol: IPsec Encapsulating Security Payload (esp), IPsec Authentication Header (ah), IP Payload Compression (comp), Mobile IPv6 Type 2 Routing Header (route2), or Mobile IPv6 Home Address Option (hao).

MODE

specifies a mode of operation for the transform protocol. IPsec and IP Payload Compression modes are transport, tunnel, and (for IPsec ESP only) Bound End-to-End Tunnel (beet). Mobile IPv6 modes are route optimization (ro) and inbound trigger (in_trigger).

LEVEL

can be required (default) or use.

ip xfrm policy count

count existing policies

Use one or more -s options to display more details, including policy hash table information.

ip xfrm policy set

configure the policy hash table

Security policies whose address prefix lengths are greater than or equal policy hash table thresholds are hashed. Others are stored in the policy_inexact chained list.

LBITS

specifies the minimum local address prefix length of policies that are stored in the Security Policy Database hash table.

RBITS

specifies the minimum remote address prefix length of policies that are stored in the Security Policy Database hash table.

ip xfrm monitor

state monitoring for xfrm objects

The xfrm objects to monitor can be optionally specified.

If the all-nsid option is set, the program listens to all network namespaces that have a nsid assigned into the network namespace were the program is running. A prefix is displayed to show the network namespace where the message originates. Example:

[nsid 1]Flushed state proto 0

## AUTHOR
Manpage revised by David Ward <david.ward@ll.mit.edu>

Manpage revised by Christophe Gouault <christophe.gouault@6wind.com>

Manpage revised by Nicolas Dichtel <nicolas.dichtel@6wind.com>


lnstat

title: lnstat(8)

summary: unified linux network statistics

text:
# lnstat(8)

## NAME
lnstat - unified linux network statistics

## SYNOPSIS
lnstat [options]

## DESCRIPTION
This manual page documents briefly the lnstat command.

lnstat is a generalized and more feature-complete replacement for the old rtstat program. It is commonly used to periodically print a selection of statistical values exported by the kernel. In addition to routing cache statistics, it supports any kind of statistics the linux kernel exports via a file in /proc/net/stat/.

Each file in /proc/net/stat/ contains a header line listing the column names. These names are used by lnstat as keys for selecting which statistics to print. For every CPU present in the system, a line follows which lists the actual values for each column of the file. lnstat sums these values up (which in fact are counters) before printing them. After each interval, only the difference to the last value is printed.

Files and columns may be selected by using the -f and -k parameters. By default, all columns of all files are printed.

## OPTIONS
lnstat supports the following options.

-h, --help

Show summary of options.

-V, --version

Show version of program.

-c, --count <count>

Print <count> number of intervals.

-d, --dump

Dump list of available files/keys.

-f, --file <file>

Statistics file to use, may be specified multiple times. By default all files in /proc/net/stat are scanned.

-i, --interval <intv>

Set interval to 'intv' seconds.

-j, --json

Display results in JSON format

-k, --keys k,k,k,...

Display only keys specified. Each key k is of the form [file:]key. If <file> is given, the search for the given key is limited to that file. Otherwise the first file containing the searched key is being used.

-s, --subject [0-2]

Specify display of subject/header. '0' means no header at all, '1' prints a header only at start of the program and '2' prints a header every 20 lines.

-w, --width n,n,n,...

Width for each field.

## USAGE EXAMPLES
\# lnstat -d

Get a list of supported statistics files.

\# lnstat -k arp_cache:entries,rt_cache:in_hit,arp_cache:destroys

Select the specified files and keys.

\# lnstat -i 10

Use an interval of 10 seconds.

\# lnstat -f ip_conntrack

Use only the specified file for statistics.

\# lnstat -s 0

Do not print a header at all.

\# lnstat -s 20

Print a header at start and every 20 lines.

\# lnstat -c -1 -i 1 -f rt_cache -k entries,in_hit,in_slow_tot

Display statistics for keys entries, in_hit and in_slow_tot of field rt_cache every second.

## FILES
/proc/net/stat/arp_cache, /proc/net/stat/ndisc_cache

Statistics around neighbor cache and ARP. arp_cache is for IPv4, ndisc_cache is the same for IPv6. entries Number of entries in the neighbor table.

allocs How many neighbor entries have been allocated.

destroys How many neighbor entries have been removed.

hash_grows How often the neighbor (hash) table was increased.

lookups How many lookups were performed.

hits How many lookups were successful.

res_failed How many neighbor lookups failed.

rcv_probes_mcast How many multicast neighbor solicitations were received. (IPv6 only.)

rcv_probes_ucast How many unicast neighbor solicitations were received. (IPv6 only.)

periodic_gc_runs How many garbage collection runs were executed.

forced_gc_runs How many forced garbage collection runs were executed. Happens when adding an entry and the table is too full.

unresolved_discards How many neighbor table entries were discarded due to lookup failure.

table_fulls Number of table overflows. Happens if table is full and forced GC run (see forced_gc_runs) has failed.

/proc/net/stat/ip_conntrack, /proc/net/stat/nf_conntrack

Conntrack related counters. ip_conntrack is for backwards compatibility with older userspace only and shows the same data as nf_conntrack. entries Number of entries in conntrack table.

searched Number of conntrack table lookups performed.

found Number of searched entries which were successful.

new Number of conntrack entries added which were not expected before.

invalid Number of packets seen which can not be tracked.

ignore Number of packets seen which are already connected to a conntrack entry.

delete Number of conntrack entries which were removed.

delete_list Number of conntrack entries which were put to dying list.

insert Number of entries inserted into the list.

insert_failed Number of entries for which list insertion was attempted but failed (happens if the same entry is already present).

drop Number of packets dropped due to conntrack failure. Either new conntrack entry allocation failed, or protocol helper dropped the packet.

early_drop Number of dropped conntrack entries to make room for new ones, if maximum table size was reached.

icmp_error Number of packets which could not be tracked due to error situation. This is a subset of invalid.

expect_new Number of conntrack entries added after an expectation for them was already present.

expect_create Number of expectations added.

expect_delete Number of expectations deleted.

search_restart Number of conntrack table lookups which had to be restarted due to hashtable resizes.

/proc/net/stat/rt_cache

Routing cache statistics. entries Number of entries in routing cache.

in_hit Number of route cache hits for incoming packets. Deprecated since IP route cache removal, therefore always zero.

in_slow_tot Number of routing cache entries added for input traffic.

in_slow_mc Number of multicast routing cache entries added for input traffic.

in_no_route Number of input packets for which no routing table entry was found.

in_brd Number of matched input broadcast packets.

in_martian_dst Number of incoming martian destination packets.

in_martian_src Number of incoming martian source packets.

out_hit Number of route cache hits for outgoing packets. Deprecated since IP route cache removal, therefore always zero.

out_slow_tot Number of routing cache entries added for output traffic.

out_slow_mc Number of multicast routing cache entries added for output traffic.

gc_total Total number of garbage collection runs. Deprecated since IP route cache removal, therefore always zero.

gc_ignored Number of ignored garbage collection runs due to minimum GC interval not reached and routing cache not full. Deprecated since IP route cache removal, therefore always zero.

gc_goal_miss Number of garbage collector goal misses. Deprecated since IP route cache removal, therefore always zero.

gc_dst_overflow Number of destination cache overflows. Deprecated since IP route cache removal, therefore always zero.

in_hlist_search Number of hash table list traversals for input traffic. Deprecated since IP route cache removal, therefore always zero.

out_hlist_search Number of hash table list traversals for output traffic. Deprecated since IP route cache removal, therefore always zero.

## SEE ALSO
ip(8)

## AUTHOR
lnstat was written by Harald Welte <laforge@gnumonks.org>.

This manual page was written by Michael Prokop <mika@grml.org> for the Debian project (but may be used by others).


rdma

title: rdma(8)

summary: RDMA tool

text:
# rdma(8)

## NAME
rdma - RDMA tool

## SYNOPSIS

rdma [ OPTIONS ] OBJECT { COMMAND | help }

rdma [ -force ] -batch filename

OBJECT := { dev | link | resource | system | statistic }

OPTIONS := { -V[ersion] | -d[etails] } -j[son] } -p[retty] }

## OPTIONS
-V, -Version

Print the version of the rdma tool and exit.

-b, -batch <FILENAME>

Read commands from provided file or standard input and invoke them. First failure will cause termination of rdma.

-force

Don't terminate rdma on errors in batch mode. If there were any errors during execution of the commands, the application return code will be non zero.

-d, --details

Output detailed information. Adding a second -d includes driver-specific details.

-r, --raw

Output includes driver-specific details in raw format.

-p, --pretty

When combined with -j generate a pretty JSON output.

-j, --json

Generate JSON output.

### OBJECT
dev

- RDMA device.

link

- RDMA port related.

resource

- RDMA resource configuration.

sys

- RDMA subsystem related.

statistic

- RDMA counter statistic related.

The names of all objects may be written in full or abbreviated form, for example stats can be abbreviated as stat or just s.

### COMMAND
Specifies the action to perform on the object. The set of possible actions depends on the object type. As a rule, it is possible to show (or list ) objects, but some objects do not allow all of these operations or have some additional commands. The help command is available for all objects. It prints out a list of available commands and argument syntax conventions.

If no command is given, some default command is assumed. Usually it is list or, if the objects of this class cannot be listed, help.

## EXIT STATUS
Exit status is 0 if command was successful or a positive integer upon failure.

## SEE ALSO
rdma-dev(8), rdma-link(8), rdma-resource(8), rdma-system(8), rdma-statistic(8),

## REPORTING BUGS
Report any bugs to the Linux RDMA mailing list <linux-rdma@vger.kernel.org> where the development and maintenance is primarily done. You do not have to be subscribed to the list to send a message there.

## AUTHOR
Leon Romanovsky <leonro@mellanox.com>


rdma-dev

title: rdma-dev(8)

summary: RDMA device configuration

text:
# rdma-dev(8)

## NAME
rdma-dev - RDMA device configuration

## SYNOPSIS

rdma [ OPTIONS ] dev { COMMAND | help }

OPTIONS := { -V[ersion] | -d[etails] }

rdma dev show [ DEV ]

rdma dev set [ DEV ] name NEWNAME

rdma dev set [ DEV ] netns NSNAME

rdma dev set [ DEV ] adaptive-moderation [on/off]

rdma dev help

## DESCRIPTION

### rdma dev show - display RDMA device attributes
DEV - specifies the RDMA device to show. If this argument is omitted all devices are listed.

## EXAMPLES
rdma dev

Shows the state of all RDMA devices on the system.

rdma dev show mlx5_3

Shows the state of specified RDMA device.

rdma dev set mlx5_3 name rdma_0

Renames the mlx5_3 device to rdma_0.

rdma dev set mlx5_3 netns foo

Changes the network namespace of RDMA device to foo where foo is previously created using iproute2 ip command.

rdma dev set mlx5_3 adaptive-moderation [on/off]

Sets the state of adaptive interrupt moderation for the RDMA device.

This is a global setting for the RDMA device but the value is printed for each CQ individually because the state is constant from CQ allocation.

## SEE ALSO
ip(8), rdma(8), rdma-link(8), rdma-resource(8), rdma-system(8), rdma-statistic(8),

## AUTHOR
Leon Romanovsky <leonro@mellanox.com>


rdma-link

title: rdma-link(8)

summary: rdma link configuration

text:
# rdma-link(8)

## NAME
rdma-link - rdma link configuration

## SYNOPSIS

devlink [ OPTIONS ] link { COMMAND | help }

OPTIONS := { -V[ersion] | -d[etails] }

rdma link show [ DEV/PORT_INDEX ]

rdma link add NAME type TYPE netdev NETDEV

rdma link delete NAME

rdma link help

## DESCRIPTION

### rdma link show - display rdma link attributes
DEV/PORT_INDEX - specifies the RDMA link to show. If this argument is omitted all links are listed.

### rdma link add NAME type TYPE netdev NETDEV - add an rdma link for the specified type to the network device
NAME - specifies the new name of the rdma link to add

TYPE - specifies which rdma type to use. Link types:

rxe - Soft RoCE driver

siw - Soft iWARP driver

NETDEV - specifies the network device to which the link is bound

### rdma link delete NAME - delete an rdma link
NAME - specifies the name of the rdma link to delete

## EXAMPLES
rdma link show

Shows the state of all rdma links on the system.

rdma link show mlx5_2/1

Shows the state of specified rdma link.

rdma link add rxe_eth0 type rxe netdev eth0

Adds a RXE link named rxe_eth0 to network device eth0

rdma link del rxe_eth0

Removes RXE link rxe_eth0

## SEE ALSO
rdma(8), rdma-dev(8), rdma-resource(8), rdma-statistic(8),

## AUTHOR
Leon Romanovsky <leonro@mellanox.com>


rdma-resource

title: rdma-resource(8)

summary: rdma resource configuration

text:
# rdma-resource(8)

## NAME
rdma-resource - rdma resource configuration

## SYNOPSIS

rdma [ OPTIONS ] RESOURCE { COMMAND | help }

RESOURCE := { cm_id | cq | mr | pd | qp }

OPTIONS := { -j[son] | -d[etails] }

rdma resource show [ DEV/PORT_INDEX ]

rdma resource help

## DESCRIPTION

### rdma resource show - display rdma resource tracking information
DEV/PORT_INDEX - specifies the RDMA link to show. If this argument is omitted all links are listed.

## EXAMPLES
rdma resource show

Shows summary for all devices on the system.

rdma resource show mlx5_2

Shows the state of specified rdma device.

rdma res show qp link mlx5_4

Get all QPs for the specific device.

rdma res show qp link mlx5_4/1

Get QPs of specific port.

rdma res show qp link mlx5_4/0

Provide illegal port number (0 is illegal).

rdma res show qp link mlx5_4/-

Get QPs which have not assigned port yet.

rdma res show qp link mlx5_4/- -d

Detailed view.

rdma res show qp link mlx5_4/- -dd

Detailed view including driver-specific details.

rdma res show qp link mlx5_4/1 lqpn 0-6

Limit to specific Local QPNs.

rdma res show qp link mlx5_4/1 lqpn 6 -r

Driver specific details in raw format.

rdma resource show cm_id dst-port 7174

Show CM_IDs with destination ip port of 7174.

rdma resource show cm_id src-addr 172.16.0.100

Show CM_IDs bound to local ip address 172.16.0.100

rdma resource show cq pid 30489

Show CQs belonging to pid 30489

## SEE ALSO
rdma(8), rdma-dev(8), rdma-link(8), rdma-statistic(8),

## AUTHOR
Leon Romanovsky <leonro@mellanox.com>


rdma-statistic

title: rdma-statistic(8)

summary: RDMA statistic counter configuration

text:
# rdma-statistic(8)

## NAME
rdma-statistic - RDMA statistic counter configuration

## SYNOPSIS

rdma [ OPTIONS ] statistic { COMMAND | help }

rdma statistic { OBJECT } show

rdma statistic [ OBJECT ] show link [ DEV/PORT_INDX ] [ FILTER_NAME FILTER_VALUE ]

rdma statistic OBJECT mode

rdma statistic OBJECT set COUNTER_SCOPE [ DEV/PORT_INDEX ] auto { CRITERIA | off }

rdma statistic OBJECT bind COUNTER_SCOPE [ DEV/PORT_INDEX ] [ OBJECT-ID ] [ COUNTER-ID ]

rdma statistic OBJECT unbind COUNTER_SCOPE [ DEV/PORT_INDEX ] [ COUNTER-ID ] [ OBJECT-ID ]

COUNTER_SCOPE := { link | dev }

OBJECT := { qp | mr }

CRITERIA := { type | pid }

FILTER_NAME := { cntn | lqpn | pid | qp-type }

## DESCRIPTION

### rdma statistic [object] show - Queries the specified RDMA device for RDMA and driver-specific statistics. Show the default hw counters if object is not specified
DEV - specifies counters on this RDMA device to show.

PORT_INDEX - specifies counters on this RDMA port to show.

FILTER_NAME - specifies a filter to show only the results matching it.

### rdma statistic <object> set - configure counter statistic auto-mode for a specific device/port
In auto mode all objects belong to one category are bind automatically to a single counter set. The "off" is global for all auto modes together. Not applicable for MR's.

### rdma statistic <object> bind - manually bind an object (e.g., a qp) with a counter
When bound the statistics of this object are available in this counter. Not applicable for MR's.

### rdma statistic <object> unbind - manually unbind an object (e.g., a qp) from the counter previously bound
When unbound the statistics of this object are no longer available in this counter; And if object id is not specified then all objects on this counter will be unbound. Not applicable for MR's.

COUNTER-ID - specifies the id of the counter to be bound. If this argument is omitted then a new counter will be allocated.

## EXAMPLES
rdma statistic show

Shows the state of the default counter of all RDMA devices on the system.

rdma statistic show link mlx5_2/1

Shows the state of the default counter of specified RDMA port

rdma statistic qp show

Shows the state of all qp counters of all RDMA devices on the system.

rdma statistic qp show link mlx5_2/1

Shows the state of all qp counters of specified RDMA port.

rdma statistic qp show link mlx5_2 pid 30489

Shows the state of all qp counters of specified RDMA port and belonging to pid 30489

rdma statistic qp show link mlx5_2 qp-type UD

Shows the state of all qp counters of specified RDMA port and with QP type UD

rdma statistic qp mode

List current counter mode on all devices

rdma statistic qp mode link mlx5_2/1

List current counter mode of device mlx5_2 port 1

rdma statistic qp set link mlx5_2/1 auto type on

On device mlx5_2 port 1, for each new user QP bind it with a counter automatically. Per counter for QPs with same qp type.

rdma statistic qp set link mlx5_2/1 auto pid on

On device mlx5_2 port 1, for each new user QP bind it with a counter automatically. Per counter for QPs with same pid.

rdma statistic qp set link mlx5_2/1 auto pid,type on

On device mlx5_2 port 1, for each new user QP bind it with a counter automatically. Per counter for QPs with same pid and same type.

rdma statistic qp set link mlx5_2/1 auto off

Turn-off auto mode on device mlx5_2 port 1. The allocated counters can be manually accessed.

rdma statistic qp bind link mlx5_2/1 lqpn 178

On device mlx5_2 port 1, allocate a counter and bind the specified qp on it

rdma statistic qp unbind link mlx5_2/1 cntn 4 lqpn 178

On device mlx5_2 port 1, bind the specified qp on the specified counter

rdma statistic qp unbind link mlx5_2/1 cntn 4

On device mlx5_2 port 1, unbind all QPs on the specified counter. After that this counter will be released automatically by the kernel.

rdma statistic show mr

List all currently allocated MR's and their counters.

rdma statistic show mr mrn 6

Dump a specific MR statistics with mrn 6. Dumps nothing if does not exists.

## SEE ALSO
rdma(8), rdma-dev(8), rdma-link(8), rdma-resource(8),

## AUTHORS
Mark Zhang <markz@mellanox.com>

Erez Alfasi <ereza@mellanox.com>


rdma-system

title: rdma-system(8)

summary: RDMA subsystem configuration

text:
# rdma-system(8)

## NAME
rdma-system - RDMA subsystem configuration

## SYNOPSIS

rdma [ OPTIONS ] sys { COMMAND | help }

OPTIONS := { -V[ersion] | -d[etails] }

rdma system show

rdma system set netns NEWMODE

rdma system help

## DESCRIPTION

### rdma system show - display RDMA subsystem network namespace mode
NEWMODE - specifies the RDMA subsystem mode. Either exclusive or shared. When user wants to assign dedicated RDMA device to a particular network namespace, exclusive mode should be set before creating any network namespace. If there are active network namespaces and if one or more RDMA devices exist, changing mode from shared to exclusive returns error code EBUSY.

When RDMA subsystem is in shared mode, RDMA device is accessible in all network namespace. When RDMA device isolation among multiple network namespaces is not needed, shared mode can be used.

It is preferred to not change the subsystem mode when there is active RDMA traffic running, even though it is supported.

## EXAMPLES
rdma system show

Shows the state of RDMA subsystem network namespace mode on the system.

rdma system set netns exclusive

Sets the RDMA subsystem in network namespace exclusive mode. In this mode RDMA devices are visible only in single network namespace.

rdma system set netns shared

Sets the RDMA subsystem in network namespace shared mode. In this mode RDMA devices are shared among network namespaces.

## SEE ALSO
rdma(8), rdma-link(8), rdma-resource(8), network_namespaces(7), namespaces(7),

## AUTHOR
Parav Pandit <parav@mellanox.com>


routel

title: routel(8)

summary: list routes with pretty output format

text:
# routel(8)

## NAME
routel - list routes with pretty output format

routef - flush routes

## SYNTAX
routel [tablenr [raw ip args...]]

routef

## DESCRIPTION
These programs are a set of helper scripts you can use instead of raw iproute2 commands.

The routel script will list routes in a format that some might consider easier to interpret then the ip route list equivalent.

The routef script does not take any arguments and will simply flush the routing table down the drain. Beware! This means deleting all routes which will make your network unusable!

## AUTHORS
The routel script was written by Stephen R. van den Berg <srb@cuci.nl>, 1999/04/18 and donated to the public domain.

This manual page was written by Andreas Henriksson <andreas@fatal.se>, for the Debian GNU/Linux system.

## SEE ALSO
ip(8)


rtacct

title: rtacct(8)

text:
# rtacct(8)

## NAME
nstat, rtacct - network statistics tools.

## SYNOPSIS
Usage: nstat [ -h?vVzrnasd:t:jp ] [ PATTERN [ PATTERN ] ]

Usage: rtacct [ -h?vVzrnasd:t: ] [ ListOfRealms ]

## DESCRIPTION
nstat and rtacct are simple tools to monitor kernel snmp counters and network interface statistics.

nstat can filter kernel snmp counters by name with one or several specified wildcards. Wildcards are case-insensitive and can include special symbols ? and *

## OPTIONS
-h, --help Print help

-V, --version

Print version

-z, --zeros

Dump zero counters too. By default they are not shown.

-r, --reset

Reset history.

-n, --nooutput

Do not display anything, only update history.

-a, --ignore

Dump absolute values of counters. The default is to calculate increments since the previous use.

-s, --noupdate

Do not update history, so that the next time you will see counters including values accumulated to the moment of this measurement too.

-j, --json

Display results in JSON format.

-p, --pretty

When combined with --json, pretty print the output.

-d, --scan <INTERVAL>

Run in daemon mode collecting statistics. <INTERVAL> is interval between measurements in seconds.

-t, --interval <INTERVAL>

Time interval to average rates. Default value is 60 seconds.

## SEE ALSO
lnstat(8)


rtmon

title: rtmon(8)

summary: listens to and monitors RTnetlink

text:
# rtmon(8)

## NAME
rtmon - listens to and monitors RTnetlink

## SYNOPSIS
rtmon [ options ] file FILE [ all | LISTofOBJECTS ]

## DESCRIPTION
This manual page documents briefly the rtmon command.

rtmon listens on netlink socket and monitors routing table changes.

rtmon can be started before the first network configuration command is issued. For example if you insert:

rtmon file /var/log/rtmon.log

in a startup script, you will be able to view the full history later. Certainly, it is possible to start rtmon at any time. It prepends the history with the state snapshot dumped at the moment of starting.

## OPTIONS
rtmon supports the following options:

-Version

Print version and exit.

help

Show summary of options.

file FILE [ all | LISTofOBJECTS ]

Log output to FILE. LISTofOBJECTS is the list of object types that we want to monitor. It may contain 'link', 'address', 'route' and 'all'. 'link' specifies the network device, 'address' the protocol (IP or IPv6) address on a device, 'route' the routing table entry and 'all' does what the name says.

-family [ inet | inet6 | link | help ]

Specify protocol family. 'inet' is IPv4, 'inet6' is IPv6, 'link' means that no networking protocol is involved and 'help' prints usage information.

-4

Use IPv4. Shortcut for -family inet.

-6

Use IPv6. Shortcut for -family inet6.

-0

Use a special family identifier meaning that no networking protocol is involved. Shortcut for -family link.

## USAGE EXAMPLES
\# rtmon file /var/log/rtmon.log

Log to file /var/log/rtmon.log, then run:

\# ip monitor file /var/log/rtmon.log

to display logged output from file.

## SEE ALSO
ip(8)

## AUTHOR
rtmon was written by Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>.

This manual page was written by Michael Prokop <mika@grml.org>, for the Debian project (but may be used by others).


rtpr

title: rtpr(8)

summary: replace backslashes with newlines.

text:
# rtpr(8)

## NAME
rtpr - replace backslashes with newlines.

## DESCRIPTION
rtpr is a trivial shell script which converts backslashes in standard input to newlines. It's sole purpose is to be fed with input from ip when executed with it's --oneline flag.

## EXAMPLES
ip --oneline address show | rtpr

Undo oneline converted ip-address output.

## SEE ALSO
ip(8)

## AUTHORS
Stephen Hemminger <shemming@brocade.com>