ip-ntable

title: ip-ntable(8)

text:
# ip-ntable(8)

## NAME
ip-ntable - neighbour table configuration

## SYNOPSIS

ip [ OPTIONS ] ntable { COMMAND | help }

ip ntable change name NAME [ dev DEV ] [ thresh1 VAL ] [ thresh2 VAL ] [ thresh3 VAL ] [ gc_int MSEC ] [ base_reachable MSEC ] [ retrans MSEC ] [ gc_stale MSEC ] [ delay_probe MSEC ] [ queue LEN ] [ app_probs VAL ] [ ucast_probes VAL ] [ mcast_probes VAL ] [ mcast_reprobes VAL ] [ anycast_delay MSEC ] [ proxy_delay MSEC ] [ proxy_queue LEN ] [ locktime MSEC ]

ip ntable show [ dev DEV ] [ name NAME ]

## DESCRIPTION
ip ntable controls the parameters for the neighbour tables.

### ip ntable show - list the ip neighbour tables
This commands displays neighbour table parameters and statistics.

dev DEV

only list the table attached to this device.

name NAME

only lists the table with the given name.

### ip ntable change - modify table parameter
This command allows modifying table parameters such as timers and queue lengths.

name NAME

the name of the table to modify.

dev DEV

the name of the device to modify the table values.

## EXAMPLES
ip ntable show dev eth0

Shows the neighbour table (IPv4 ARP and IPv6 ndisc) parameters on device eth0.

ip ntable change name arp_cache queue 8 dev eth0

Changes the number of packets queued while address is being resolved from the default value (3) to 8 packets.

## SEE ALSO
ip(8)

## AUTHOR
Manpage by Stephen Hemminger


ip-route

title: ip-route(8)

summary: routing table management

text:
# ip-route(8)

## NAME
ip-route - routing table management

## SYNOPSIS

ip [ ip-OPTIONS ] route { COMMAND | help }

ip route { show | flush } SELECTOR

ip route save SELECTOR

ip route restore

ip route get ROUTE_GET_FLAGS [ to ] ADDRESS [ from ADDRESS iif STRING ] [ oif STRING ] [ mark MARK ] [ tos TOS ] [ vrf NAME ] [ ipproto PROTOCOL ] [ sport NUMBER ] [ dport NUMBER ] [ as ADDRESS ] [ flowlabel FLOWLABEL ]

ip route { add | del | change | append | replace } ROUTE

SELECTOR := [ root PREFIX ] [ match PREFIX ] [ exact PREFIX ] [ table TABLE_ID ] [ vrf NAME ] [ proto RTPROTO ] [ type TYPE ] [ scope SCOPE ]

ROUTE := NODE_SPEC [ INFO_SPEC ]

NODE_SPEC := [ TYPE ] PREFIX [ tos TOS ] [ table TABLE_ID ] [ proto RTPROTO ] [ scope SCOPE ] [ metric METRIC ] [ ttl-propagate { enabled | disabled } ]

INFO_SPEC := { NH | nhid ID } OPTIONS FLAGS [ nexthop NH ] ...

NH := [ encap ENCAP ] [ via [ FAMILY ] ADDRESS ] [ dev STRING ] [ weight NUMBER ] NHFLAGS

FAMILY := [ inet | inet6 | mpls | bridge | link ]

OPTIONS := FLAGS [ mtu NUMBER ] [ advmss NUMBER ] [ as [ to ] ADDRESS ] rtt TIME ] [ rttvar TIME ] [ reordering NUMBER ] [ window NUMBER ] [ cwnd NUMBER ] [ ssthresh NUMBER ] [ realms REALM ] [ rto_min TIME ] [ initcwnd NUMBER ] [ initrwnd NUMBER ] [ features FEATURES ] [ quickack BOOL ] [ congctl NAME ] [ pref PREF ] [ expires TIME ] [ fastopen_no_cookie BOOL ]

TYPE := [ unicast | local | broadcast | multicast | throw | unreachable | prohibit | blackhole | nat ]

TABLE_ID := [ local| main | default | all | NUMBER ]

SCOPE := [ host | link | global | NUMBER ]

NHFLAGS := [ onlink | pervasive ]

RTPROTO := [ kernel | boot | static | NUMBER ]

FEATURES := [ ecn | ]

PREF := [ low | medium | high ]

ENCAP := [ ENCAP_MPLS | ENCAP_IP | ENCAP_BPF | ENCAP_SEG6 | ENCAP_SEG6LOCAL | ENCAP_IOAM6 ]

ENCAP_MPLS := mpls [ LABEL ] [ ttl TTL ]

ENCAP_IP := ip id TUNNEL_ID dst REMOTE_IP [ src SRC ] [ tos TOS ] [ ttl TTL ] [ key ] [ csum ] [ seq ] [ GENEVE_OPTS | VXLAN_OPTS | ERSPAN_OPTS ]

ENCAP_BPF := bpf [ in PROG ] [ out PROG ] [ xmit PROG ] [ headroom SIZE ]

ENCAP_SEG6 := seg6 mode [ encap | encap.red | inline | l2encap | l2encap.red ] segs SEGMENTS [ hmac KEYID ]

ENCAP_SEG6LOCAL := seg6local action SEG6_ACTION [ SEG6_ACTION_PARAM ] [ count ]

ENCAP_IOAM6 := ioam6 [ freq K/N ] mode [ inline | encap | auto ] [ tunsrc ADDRESS ] [ tundst ADDRESS ] trace prealloc type IOAM6_TRACE_TYPE ns IOAM6_NAMESPACE size IOAM6_TRACE_SIZE

ROUTE_GET_FLAGS := ROUTE_GET_FLAG [ ROUTE_GET_FLAGS ]

ROUTE_GET_FLAG := [ connected | fibmatch | notify ]

## DESCRIPTION
ip route is used to manipulate entries in the kernel routing tables.

Route types:

unicast - the route entry describes real paths to the destinations covered by the route prefix.

unreachable - these destinations are unreachable. Packets are discarded and the ICMP message host unreachable is generated. The local senders get an EHOSTUNREACH error.

blackhole - these destinations are unreachable. Packets are discarded silently. The local senders get an EINVAL error.

prohibit - these destinations are unreachable. Packets are discarded and the ICMP message communication administratively prohibited is generated. The local senders get an EACCES error.

local - the destinations are assigned to this host. The packets are looped back and delivered locally.

broadcast - the destinations are broadcast addresses. The packets are sent as link broadcasts.

throw - a special control route used together with policy rules. If such a route is selected, lookup in this table is terminated pretending that no route was found. Without policy routing it is equivalent to the absence of the route in the routing table. The packets are dropped and the ICMP message net unreachable is generated. The local senders get an ENETUNREACH error.

nat - a special NAT route. Destinations covered by the prefix are considered to be dummy (or external) addresses which require translation to real (or internal) ones before forwarding. The addresses to translate to are selected with the attribute via. Warning: Route NAT is no longer supported in Linux 2.6.

anycast - not implemented the destinations are anycast addresses assigned to this host. They are mainly equivalent to local with one difference: such addresses are invalid when used as the source address of any packet.

multicast - a special type used for multicast routing. It is not present in normal routing tables.

Route tables: Linux-2.x can pack routes into several routing tables identified by a number in the range from 1 to 2^32-1 or by name from /usr/share/iproute2/rt_tables or /etc/iproute2/rt_tables (has precedence if exists). By default all normal routes are inserted into the main table (ID 254) and the kernel only uses this table when calculating routes. Values (0, 253, 254, and 255) are reserved for built-in use.

Actually, one other table always exists, which is invisible but even more important. It is the local table (ID 255). This table consists of routes for local and broadcast addresses. The kernel maintains this table automatically and the administrator usually need not modify it or even look at it.

The multiple routing tables enter the game when policy routing is used.

ip route add

add new route

ip route change

change route

ip route replace

change or add new one

to TYPE PREFIX (default)

the destination prefix of the route. If TYPE is omitted, ip assumes type unicast. Other values of TYPE are listed above. PREFIX is an IP or IPv6 address optionally followed by a slash and the prefix length. If the length of the prefix is missing, ip assumes a full-length host route. There is also a special PREFIX default - which is equivalent to IP 0/0 or to IPv6 ::/0.

tos TOS

dsfield TOS

the Type Of Service (TOS) key. This key has no associated mask and the longest match is understood as: First, compare the TOS of the route and of the packet. If they are not equal, then the packet may still match a route with a zero TOS. TOS is either an 8 bit hexadecimal number or an identifier from /usr/share/iproute2/rt_dsfield or /etc/iproute2/rt_dsfield (has precedence if exists).

metric NUMBER

preference NUMBER

the preference value of the route. NUMBER is an arbitrary 32bit number, where routes with lower values are preferred.

table TABLEID

the table to add this route to. TABLEID may be a number or a string from /usr/share/iproute2/rt_tables or /etc/iproute2/rt_tables (has precedence if exists). If this parameter is omitted, ip assumes the main table, with the exception of local, broadcast and nat routes, which are put into the local table by default.

vrf NAME

the vrf name to add this route to. Implicitly means the table associated with the VRF.

dev NAME

the output device name.

via [ FAMILY ] ADDRESS

the address of the nexthop router, in the address family FAMILY. Actually, the sense of this field depends on the route type. For normal unicast routes it is either the true next hop router or, if it is a direct route installed in BSD compatibility mode, it can be a local address of the interface. For NAT routes it is the first address of the block of translated IP destinations.

src ADDRESS

the source address to prefer when sending to the destinations covered by the route prefix.

realm REALMID

the realm to which this route is assigned. REALMID may be a number or a string from /usr/share/iproute2/rt_realms or /etc/iproute2/rt_realms (has precedence if exists).

mtu MTU

mtu lock MTU

the MTU along the path to the destination. If the modifier lock is not used, the MTU may be updated by the kernel due to Path MTU Discovery. If the modifier lock is used, no path MTU discovery will be tried, all packets will be sent without the DF bit in IPv4 case or fragmented to MTU for IPv6.

window NUMBER

the maximal window for TCP to advertise to these destinations, measured in bytes. It limits maximal data bursts that our TCP peers are allowed to send to us.

rtt TIME

the initial RTT ('Round Trip Time') estimate. If no suffix is specified the units are raw values passed directly to the routing code to maintain compatibility with previous releases. Otherwise if a suffix of s, sec or secs is used to specify seconds and ms, msec or msecs to specify milliseconds.

rttvar TIME (Linux 2.3.15+ only)

the initial RTT variance estimate. Values are specified as with rtt above.

rto_min TIME (Linux 2.6.23+ only)

the minimum TCP Retransmission TimeOut to use when communicating with this destination. Values are specified as with rtt above.

ssthresh NUMBER (Linux 2.3.15+ only)

an estimate for the initial slow start threshold.

cwnd NUMBER (Linux 2.3.15+ only)

the clamp for congestion window. It is ignored if the lock flag is not used.

initcwnd NUMBER (Linux 2.5.70+ only)

the initial congestion window size for connections to this destination. Actual window size is this value multiplied by the MSS (``Maximal Segment Size'') for same connection. The default is zero, meaning to use the values specified in RFC2414.

initrwnd NUMBER (Linux 2.6.33+ only)

the initial receive window size for connections to this destination. Actual window size is this value multiplied by the MSS of the connection. The default value is zero, meaning to use Slow Start value.

features FEATURES (Linux3.18+only)

Enable or disable per-route features. Only available feature at this time is ecn to enable explicit congestion notification when initiating connections to the given destination network. When responding to a connection request from the given network, ecn will also be used even if the net.ipv4.tcp_ecn sysctl is set to 0.

quickack BOOL (Linux 3.11+ only)

Enable or disable quick ack for connections to this destination.

fastopen_no_cookie BOOL (Linux 4.15+ only)

Enable TCP Fastopen without a cookie for connections to this destination.

congctl NAME (Linux 3.20+ only)

congctl lock NAME (Linux 3.20+ only)

Sets a specific TCP congestion control algorithm only for a given destination. If not specified, Linux keeps the current global default TCP congestion control algorithm, or the one set from the application. If the modifier lock is not used, an application may nevertheless overwrite the suggested congestion control algorithm for that destination. If the modifier lock is used, then an application is not allowed to overwrite the specified congestion control algorithm for that destination, thus it will be enforced/guaranteed to use the proposed algorithm.

advmss NUMBER (Linux 2.3.15+ only)

the MSS ('Maximal Segment Size') to advertise to these destinations when establishing TCP connections. If it is not given, Linux uses a default value calculated from the first hop device MTU. (If the path to these destination is asymmetric, this guess may be wrong.)

reordering NUMBER (Linux 2.3.15+ only)

Maximal reordering on the path to this destination. If it is not given, Linux uses the value selected with sysctl variable net/ipv4/tcp_reordering.

nexthop NEXTHOP

the nexthop of a multipath route. NEXTHOP is a complex value with its own syntax similar to the top level argument lists:

via [ FAMILY ] ADDRESS - is the nexthop router.

dev NAME - is the output device.

weight NUMBER - is a weight for this element of a multipath route reflecting its relative bandwidth or quality.

The internal buffer used in iproute2 limits the maximum number of nexthops that may be specified in one go. If only ADDRESS is given, the current buffer size allows for 144 IPv6 nexthops and 253 IPv4 ones. For IPv4, this effectively limits the number of nexthops possible per route. With IPv6, further nexthops may be appended to the same route via ip route append command.

scope SCOPE_VAL

the scope of the destinations covered by the route prefix. SCOPE_VAL may be a number or a string from /usr/share/iproute2/rt_scopes or /etc/iproute2/rt_scopes (has precedence if exists). If this parameter is omitted, ip assumes scope global for all gatewayed unicast routes, scope link for direct unicast and broadcast routes and scope host for local routes.

protocol RTPROTO

the routing protocol identifier of this route. RTPROTO may be a number or a string from /usr/share/iproute2/rt_protos or /etc/iproute2/rt_protos (has precedence if exists). If the routing protocol ID is not given, ip assumes protocol boot (i.e. it assumes the route was added by someone who doesn't understand what they are doing). Several protocol values have a fixed interpretation. Namely:

redirect - the route was installed due to an ICMP redirect.

kernel - the route was installed by the kernel during autoconfiguration.

boot - the route was installed during the bootup sequence. If a routing daemon starts, it will purge all of them.

static - the route was installed by the administrator to override dynamic routing. Routing daemon will respect them and, probably, even advertise them to its peers.

ra - the route was installed by Router Discovery protocol.

The rest of the values are not reserved and the administrator is free to assign (or not to assign) protocol tags.

onlink

pretend that the nexthop is directly attached to this link, even if it does not match any interface prefix.

pref PREF

the IPv6 route preference. PREF is a string specifying the route preference as defined in RFC4191 for Router Discovery messages. Namely:

low - the route has a lowest priority

medium - the route has a default priority

high - the route has a highest priority

nhid ID

use nexthop object with given id as nexthop specification.

encap ENCAPTYPE ENCAPHDR

attach tunnel encapsulation attributes to this route. ENCAPTYPE is a string specifying the supported encapsulation type. Namely:

mpls - encapsulation type MPLS

ip - IP encapsulation (Geneve, GRE, VXLAN, ...)

bpf - Execution of BPF program

seg6 - encapsulation type IPv6 Segment Routing

seg6local - local SRv6 segment processing

ioam6 - encapsulation type IPv6 IOAM

xfrm - encapsulation type XFRM

ENCAPHDR is a set of encapsulation attributes specific to the ENCAPTYPE.

mpls

MPLSLABEL - mpls label stack with labels separated by /

ttl TTL - TTL to use for MPLS header or 0 to inherit from IP header

ip

id TUNNEL_ID - Tunnel ID (for example VNI in VXLAN tunnel)

dst REMOTE_IP - Outer header destination IP address (IPv4 or IPv6)

src SRC - Outer header source IP address (IPv4 or IPv6)

tos TOS - Outer header TOS

ttl TTL - Outer header TTL

key - Outer header flags with key in GRE tunnel

csum - Outer header flags with csum in GRE tunnel

seq - Outer header flags with seq in GRE tunnel

GENEVE_OPTS - Specified in the form CLASS:TYPE:DATA, where CLASS is represented as a 16bit hexadecimal value, TYPE as an 8bit hexadecimal value and DATA as a variable length hexadecimal value. Additionally multiple options may be listed using a comma delimiter.

VXLAN_OPTS - Specified in the form GBP, as a 32bit number. Multiple options is not supported.

ERSPAN_OPTS - Specified in the form VERSION:INDEX:DIR:HWID, where VERSION is represented as a 8bit number, INDEX as an 32bit number, DIR and HWID as a 8bit number. Multiple options is not supported. Note INDEX is used when VERSION is 1, and DIR and HWID are used when VERSION is 2.

bpf

in PROG - BPF program to execute for incoming packets

out PROG - BPF program to execute for outgoing packets

xmit PROG - BPF program to execute for transmitted packets

headroom SIZE - Size of header BPF program will attach (xmit)

seg6

mode inline - Directly insert Segment Routing Header after IPv6 header

mode encap - Encapsulate packet in an outer IPv6 header with SRH

mode encap.red - Encapsulate packet in an outer IPv6 header with SRH applying the reduced segment list. When there is only one segment and the HMAC is not present, the SRH is omitted.

mode l2encap - Encapsulate ingress L2 frame within an outer IPv6 header and SRH

mode l2encap.red - Encapsulate ingress L2 frame within an outer IPv6 header and SRH applying the reduced segment list. When there is only one segment and the HMAC is not present, the SRH is omitted.

SEGMENTS - List of comma-separated IPv6 addresses

KEYID - Numerical value in decimal representation. See ip-sr(8).

seg6local

SEG6_ACTION [ SEG6_ACTION_PARAM ] [ count ] - Operation to perform on matching packets. The optional count attribute is used to collect statistics on the processing of actions. Three counters are implemented: 1) packets correctly processed; 2) bytes correctly processed; 3) packets that cause a processing error (i.e., missing SID List, wrong SID List, etc). To retrieve the counters related to an action use the -s flag in the show command. The following actions are currently supported (Linux 4.14+ only).

End [ flavors FLAVORS ] - Regular SRv6 processing as intermediate segment endpoint. This action only accepts packets with a non-zero Segments Left value. Other matching packets are dropped. The presence of flavors can change the regular processing of an End behavior according to the user-provided Flavor operations and information carried in the packet. See Flavors parameters section.

End.X nh6 NEXTHOP [ flavors FLAVORS ] - Regular SRv6 processing as intermediate segment endpoint. Additionally, forward processed packets to given next-hop. This action only accepts packets with a non-zero Segments Left value. Other matching packets are dropped. The presence of flavors can change the regular processing of an End.X behavior according to the user-provided Flavor operations and information carried in the packet. See Flavors parameters section.

End.DX6 nh6 NEXTHOP - Decapsulate inner IPv6 packet and forward it to the specified next-hop. If the argument is set to ::, then the next-hop is selected according to the local selection rules. This action only accepts packets with either a zero Segments Left value or no SRH at all, and an inner IPv6 packet. Other matching packets are dropped.

End.DT6 { table | vrftable } TABLEID - Decapsulate the inner IPv6 packet and forward it according to the specified lookup table. TABLEID is either a number or a string from /usr/share/iproute2/rt_tables or /etc/iproute2/rt_tables (has precedence if exists). If vrftable is used, the argument must be a VRF device associated with the table id. Moreover, the VRF table associated with the table id must be configured with the VRF strict mode turned on (net.vrf.strict_mode=1). This action only accepts packets with either a zero Segments Left value or no SRH at all, and an inner IPv6 packet. Other matching packets are dropped.

End.DT4 vrftable TABLEID - Decapsulate the inner IPv4 packet and forward it according to the specified lookup table. TABLEID is either a number or a string from /usr/share/iproute2/rt_tables or /etc/iproute2/rt_tables (has precedence if exists). The argument must be a VRF device associated with the table id. Moreover, the VRF table associated with the table id must be configured with the VRF strict mode turned on (net.vrf.strict_mode=1). This action only accepts packets with either a zero Segments Left value or no SRH at all, and an inner IPv4 packet. Other matching packets are dropped.

End.DT46 vrftable TABLEID - Decapsulate the inner IPv4 or IPv6 packet and forward it according to the specified lookup table. TABLEID is either a number or a string from /usr/share/iproute2/rt_tables or /etc/iproute2/rt_tables (has precedence if exists). The argument must be a VRF device associated with the table id. Moreover, the VRF table associated with the table id must be configured with the VRF strict mode turned on (net.vrf.strict_mode=1). This action only accepts packets with either a zero Segments Left value or no SRH at all, and an inner IPv4 or IPv6 packet. Other matching packets are dropped.

End.B6 srh segs SEGMENTS [ hmac KEYID ] - Insert the specified SRH immediately after the IPv6 header, update the DA with the first segment of the newly inserted SRH, then forward the resulting packet. The original SRH is not modified. This action only accepts packets with a non-zero Segments Left value. Other matching packets are dropped.

End.B6.Encaps srh segs SEGMENTS [ hmac KEYID ] - Regular SRv6 processing as intermediate segment endpoint. Additionally, encapsulate the matching packet within an outer IPv6 header followed by the specified SRH. The destination address of the outer IPv6 header is set to the first segment of the new SRH. The source address is set as described in ip-sr(8).

Flavors parameters

The flavors represent additional operations that can modify or extend a subset of the existing behaviors.

flavors OPERATION[,OPERATION] [ATTRIBUTES]

OPERATION := { psp | usp | usd | next-csid }

ATTRIBUTES := { KEY VALUE } [ ATTRIBUTES ]

KEY := { lblen | nflen }

psp - The Penultimate Segment Pop (PSP) copies the last SID from the SID List (carried by the outermost SRH) into the IPv6 Destination Address (DA) and removes (i.e. pops) the SRH from the IPv6 header. The PSP operation takes place only at a penultimate SR Segment Endpoint node (e.g., the Segment Left must be one) and does not happen at non-penultimate endpoint nodes. This flavor is currently only supported by End behavior.

usp - Ultimate Segment Pop of the SRH (not yet supported in kernel)

usd - Ultimate Segment Decapsulation (not yet supported in kernel)

next-csid - The NEXT-C-SID mechanism offers the possibility of encoding several SRv6 segments within a single 128 bit SID address. The NEXT-C-SID flavor can be configured to support user-provided Locator-Block and Locator-Node Function lengths. If Locator-Block and/or Locator-Node Function lengths are not provided by the user during configuration of an SRv6 End behavior instance with NEXT-C-SID flavor, the default value is 32-bit for Locator-Block and 16-bit for Locator-Node Function.

lblen VALUE - defines the Locator-Block length for NEXT-C-SID flavor. The Locator-Block length must be greater than 0 and evenly divisible by 8. This attribute can be used only with NEXT-C-SID flavor.

nflen VALUE - defines the Locator-Node Function length for NEXT-C-SID flavors. The Locator-Node Function length must be greater than 0 and evenly divisible by 8. This attribute can be used only with NEXT-C-SID flavor.

ioam6

freq K/N - Inject IOAM in K packets every N packets (default is 1/1).

mode inline - Directly insert IOAM after IPv6 header (default mode).

mode encap - Encapsulate packet in an outer IPv6 header with IOAM.

mode auto - Automatically use inline mode for local packets and encap mode for in-transit packets.

tunsrc ADDRESS - IPv6 address of the tunnel source (outer header), not used with inline mode. It is optional: if not provided, the tunnel source address is chosen automatically.

tundst ADDRESS - IPv6 address of the tunnel destination (outer header), not used with inline mode.

type IOAM6_TRACE_TYPE - List of IOAM data required in the trace, represented by a bitfield (24 bits).

ns IOAM6_NAMESPACE - Numerical value to represent an IOAM namespace. See ip-ioam(8).

size IOAM6_TRACE_SIZE - Size, in octets, of the pre-allocated trace data block.

xfrm

if_id IF_ID [ link_dev LINK_DEV ]

expires TIME (Linux 4.4+ only)

the route will be deleted after the expires time. Only support IPv6 at present.

ttl-propagate { enabled | disabled }

Control whether TTL should be propagated from any encap into the un-encapsulated packet, overriding any global configuration. Only supported for MPLS at present.

ip route delete

delete route

ip route del has the same arguments as ip route add, but their semantics are a bit different. Key values (to, tos, preference and table) select the route to delete. If optional attributes are present, ip verifies that they coincide with the attributes of the route to delete. If no route with the given key and attributes was found, ip route del fails.

ip route show

list routes

the command displays the contents of the routing tables or the route(s) selected by some criteria.

to SELECTOR (default)

only select routes from the given range of destinations. SELECTOR consists of an optional modifier (root, match or exact) and a prefix. root PREFIX selects routes with prefixes not shorter than PREFIX. F.e. root 0/0 selects the entire routing table. match PREFIX selects routes with prefixes not longer than PREFIX. F.e. match 10.0/16 selects 10.0/16, 10/8 and 0/0, but it does not select 10.1/16 and 10.0.0/24. And exact PREFIX (or just PREFIX) selects routes with this exact prefix. If neither of these options are present, ip assumes root 0/0 i.e. it lists the entire table.

tos TOS

dsfield TOS

only select routes with the given TOS.

table TABLEID

show the routes from this table(s). The default setting is to show table main. TABLEID may either be the ID of a real table or one of the special values:

all - list all of the tables.

cache - dump the routing cache.

vrf NAME

show the routes for the table associated with the vrf name

cloned

cached

list cloned routes i.e. routes which were dynamically forked from other routes because some route attribute (f.e. MTU) was updated. Actually, it is equivalent to table cache.

from SELECTOR

the same syntax as for to, but it binds the source address range rather than destinations. Note that the from option only works with cloned routes.

protocol RTPROTO

only list routes of this protocol.

scope SCOPE_VAL

only list routes with this scope.

type TYPE

only list routes of this type.

dev NAME

only list routes going via this device.

via [ FAMILY ] PREFIX

only list routes going via the nexthop routers selected by PREFIX.

src PREFIX

only list routes with preferred source addresses selected by PREFIX.

realm REALMID

realms FROMREALM/TOREALM

only list routes with these realms.

ip route flush

flush routing tables

this command flushes routes selected by some criteria.

The arguments have the same syntax and semantics as the arguments of ip route show, but routing tables are not listed but purged. The only difference is the default action: show dumps all the IP main routing table but flush prints the helper page.

With the -statistics option, the command becomes verbose. It prints out the number of deleted routes and the number of rounds made to flush the routing table. If the option is given twice, ip route flush also dumps all the deleted routes in the format described in the previous subsection.

ip route get

get a single route

this command gets a single route to a destination and prints its contents exactly as the kernel sees it.

fibmatch

Return full fib lookup matched route. Default is to return the resolved dst entry

to ADDRESS (default)

the destination address.

from ADDRESS

the source address.

tos TOS

dsfield TOS

the Type Of Service.

iif NAME

the device from which this packet is expected to arrive.

oif NAME

force the output device on which this packet will be routed.

mark MARK

the firewall mark (fwmark)

vrf NAME

force the vrf device on which this packet will be routed.

ipproto PROTOCOL

ip protocol as seen by the route lookup

sport NUMBER

source port as seen by the route lookup

dport NUMBER

destination port as seen by the route lookup

connected

if no source address (option from) was given, relookup the route with the source set to the preferred address received from the first lookup. If policy routing is used, it may be a different route.

flowlabel FLOWLABEL

ipv6 flow label as seen by the route lookup

Note that this operation is not equivalent to ip route show. show shows existing routes. get resolves them and creates new clones if necessary. Essentially, get is equivalent to sending a packet along this path. If the iif argument is not given, the kernel creates a route to output packets towards the requested destination. This is equivalent to pinging the destination with a subsequent ip route ls cache, however, no packets are actually sent. With the iif argument, the kernel pretends that a packet arrived from this interface and searches for a path to forward the packet.

ip route save

save routing table information to stdout

This command behaves like ip route show except that the output is raw data suitable for passing to ip route restore.

ip route restore

restore routing table information from stdin

This command expects to read a data stream as returned from ip route save. It will attempt to restore the routing table information exactly as it was at the time of the save, so any translation of information in the stream (such as device indexes) must be done first. Any existing routes are left unchanged. Any routes specified in the data stream that already exist in the table will be ignored.

## NOTES
Starting with Linux kernel version 3.6, there is no routing cache for IPv4 anymore. Hence ip route show cached will never print any entries on systems with this or newer kernel versions.

## EXAMPLES
ip ro

Show all route entries in the kernel.

ip route add default via 192.168.1.1 dev eth0

Adds a default route (for all addresses) via the local gateway 192.168.1.1 that can be reached on device eth0.

ip route add 10.1.1.0/30 encap mpls 200/300 via 10.1.1.1 dev eth0

Adds an ipv4 route with mpls encapsulation attributes attached to it.

ip -6 route add 2001:db8:1::/64 encap seg6 mode encap segs 2001:db8:42::1,2001:db8:ffff::2 dev eth0

Adds an IPv6 route with SRv6 encapsulation and two segments attached.

ip -6 route add 2001:db8:1::/64 encap seg6local action End.DT46 vrftable 100 dev vrf100

Adds an IPv6 route with SRv6 decapsulation and forward with lookup in VRF table.

ip -6 route add 2001:db8:1::/64 encap seg6local action End flavors psp dev eth0

Adds an IPv6 route with SRv6 End behavior with psp flavor enabled.

ip -6 route add 2001:db8:1::/64 encap seg6local action End flavors next-csid dev eth0

Adds an IPv6 route with SRv6 End behavior with next-csid flavor enabled.

ip -6 route add 2001:db8:1::/64 encap seg6local action End flavors next-csid lblen 48 nflen 16 dev eth0

Adds an IPv6 route with SRv6 End behavior with next-csid flavor enabled and user-provided Locator-Block and Locator-Node Function lengths.

ip -6 route add 2001:db8:1::/64 encap ioam6 freq 2/5 mode encap tundst 2001:db8:42::1 trace prealloc type 0x800000 ns 1 size 12 dev eth0

Adds an IPv6 route with an IOAM Pre-allocated Trace encapsulation (ip6ip6) that only includes the hop limit and the node id, configured for the IOAM namespace 1 and a pre-allocated data block of 12 octets (will be injected in 2 packets every 5 packets).

ip route add 10.1.1.0/30 nhid 10

Adds an ipv4 route using nexthop object with id 10.

## SEE ALSO
ip(8)

## AUTHOR
Original Manpage by Michail Litvak <mci@owl.openwall.com>

branch: sisyphus


ip-rule

title: ip-rule(8)

summary: routing policy database management

text:
# ip-rule(8)

## NAME
ip-rule - routing policy database management

## SYNOPSIS

ip [ OPTIONS ] rule { COMMAND | help }

ip rule [ show [ SELECTOR ]]

ip rule { add | del } SELECTOR ACTION

ip rule { flush | save | restore }

SELECTOR := [ not ] [ from PREFIX ] [ to PREFIX ] [ tos TOS ] [ dscp DSCP[/MASK] ] [ fwmark FWMARK[/MASK] ] [ iif STRING ] [ oif STRING ] [ priority PREFERENCE ] [ l3mdev ] [ uidrange NUMBER-NUMBER ] [ ipproto PROTOCOL ] [ sport [ NUMBER[/MASK] | NUMBER-NUMBER ] ] [ dport [ NUMBER[/MASK] | NUMBER-NUMBER ] ] [ tun_id TUN_ID ] [ flowlabel FLOWLABEL[/MASK] ]

ACTION := [ table TABLE_ID ] [ protocol PROTO ] [ nat ADDRESS ] [ realms [SRCREALM/]DSTREALM ] [ goto NUMBER ] SUPPRESSOR

SUPPRESSOR := [ suppress_prefixlength NUMBER ] [ suppress_ifgroup GROUP ]

TABLE_ID := [ local | main | default | NUMBER ]

## DESCRIPTION
ip rule manipulates rules in the routing policy database that controls the route selection algorithm.

Classic routing algorithms used in the Internet make routing decisions based only on the destination address of packets (and in theory, but not in practice, on the TOS field).

In some circumstances, we want to route packets differently depending not only on destination addresses but also on other packet fields: source address, IP protocol, transport protocol ports or even packet payload. This task is called 'policy routing'.

To solve this task, the conventional destination based routing table, ordered according to the longest match rule, is replaced with a 'routing policy database' (or RPDB), which selects routes by executing some set of rules.

Each policy routing rule consists of a selector and an action predicate. The RPDB is scanned in order of decreasing priority (note that a lower number means higher priority, see the description of PREFERENCE below). The selector of each rule is applied to {source address, destination address, incoming interface, tos, fwmark} and, if the selector matches the packet, the action is performed. The action predicate may return with success. In this case, it will either give a route or failure indication and the RPDB lookup is terminated. Otherwise, the RPDB program continues with the next rule.

Semantically, the natural action is to select the nexthop and the output device.

At startup time the kernel configures the default RPDB consisting of three rules:

1.

Priority: 0, Selector: match anything, Action: lookup routing table local (ID 255). The local table is a special routing table containing high priority control routes for local and broadcast addresses.

2.

Priority: 32766, Selector: match anything, Action: lookup routing table main (ID 254). The main table is the normal routing table containing all non-policy routes. This rule may be deleted and/or overridden with other ones by the administrator.

3.

Priority: 32767, Selector: match anything, Action: lookup routing table default (ID 253). The default table is empty. It is reserved for some post-processing if no previous default rules selected the packet. This rule may also be deleted.

Each RPDB entry has additional attributes. F.e. each rule has a pointer to some routing table. NAT and masquerading rules have an attribute to select new IP address to translate/masquerade. Besides that, rules have some optional attributes, which routes have, namely realms. These values do not override those contained in the routing tables. They are only used if the route did not select any attributes.

The RPDB may contain rules of the following types:

unicast - the rule returns the route found in the routing table referenced by the rule. blackhole - the rule causes a silent drop the packet.

unreachable - the rule generates a 'Network is unreachable' error.

prohibit - the rule generates 'Communication is administratively prohibited' error.

nat - the rule translates the source address of the IP packet into some other value.

ip rule add - insert a new rule

ip rule delete - delete a rule

type TYPE (default)

the type of this rule. The list of valid types was given in the previous subsection.

from PREFIX

select the source prefix to match.

to PREFIX

select the destination prefix to match.

iif NAME

select the incoming device to match. If the interface is loopback, the rule only matches packets originating from this host. This means that you may create separate routing tables for forwarded and local packets and, hence, completely separate them.

oif NAME

select the outgoing device to match. The outgoing interface is only available for packets originating from local sockets that are bound to a device.

tos TOS

dsfield TOS

select the TOS value to match.

dscp DSCP[/MASK]

select the DSCP value to match with an optional mask. DSCP values can be written either directly as numeric values (valid values are 0-63), or using symbolic names specified in /usr/share/iproute2/rt_dsfield or /etc/iproute2/rt_dsfield (has precedence if exists). However, note that the file specifies full 8-bit dsfield values, whereas ip rule will only use the higher six bits. ip rule show will similarly format DSCP values as symbolic names if possible. The command line option -N turns the show translation off.

fwmark MARK

select the fwmark value to match.

uidrange NUMBER-NUMBER

select the uid value to match.

ipproto PROTOCOL

select the ip protocol value to match.

sport NUMBER[/MASK] | NUMBER-NUMBER

select the source port value to match with an optional mask. Supports port range.

dport NUMBER[/MASK] | NUMBER-NUMBER

select the destination port value to match with an optional mask. Supports port range.

priority PREFERENCE

the priority of this rule. PREFERENCE is an unsigned integer value, higher number means lower priority, and rules get processed in order of increasing number. Each rule should have an explicitly set unique priority value. The options preference and order are synonyms with priority.

table TABLEID

the routing table identifier to lookup if the rule selector matches. It is also possible to use lookup instead of table.

protocol PROTO

the routing protocol who installed the rule in question. As an example when zebra installs a rule it would get RTPROT_ZEBRA as the installing protocol.

suppress_prefixlength NUMBER

reject routing decisions that have a prefix length of NUMBER or less.

suppress_ifgroup GROUP

reject routing decisions that use a device belonging to the interface group GROUP.

realms FROM/TO

Realms to select if the rule matched and the routing table lookup succeeded. Realm TO is only used if the route did not select any realm.

nat ADDRESS

The base of the IP address block to translate (for source addresses). The ADDRESS may be either the start of the block of NAT addresses (selected by NAT routes) or a local host address (or even zero). In the last case the router does not translate the packets, but masquerades them to this address. Using map-to instead of nat means the same thing.

flowlabel FLOWLABEL[/MASK]

select the IPv6 flow label to match with an optional mask. Warning: Changes to the RPDB made with these commands do not become active immediately. It is assumed that after a script finishes a batch of updates, it flushes the routing cache with ip route flush cache.

ip rule flush - also dumps all the deleted rules.

protocol PROTO

Select the originating protocol.

ip rule show - list rules

This command has no arguments. The options list or lst are synonyms with show.

ip rule save

protocol PROTO

Select the originating protocol.

save rules table information to stdout

This command behaves like ip rule show except that the output is raw data suitable for passing to ip rule restore.

ip rule restore

restore rules table information from stdin

This command expects to read a data stream as returned from ip rule save. It will attempt to restore the rules table information exactly as it was at the time of the save. Any rules already in the table are left unchanged, and duplicates are not ignored.

## SEE ALSO
ip(8)

## AUTHOR
Original Manpage by Michail Litvak <mci@owl.openwall.com>


ip-sr

title: ip-sr(8)

summary: IPv6 Segment Routing management

text:
# ip-sr(8)

## NAME
ip-sr - IPv6 Segment Routing management

## SYNOPSIS

ip sr { COMMAND | help }

ip sr hmac show

ip sr hmac set KEYID ALGO

ip sr tunsrc show

ip sr tunsrc set ADDRESS

## DESCRIPTION
The ip sr command is used to configure IPv6 Segment Routing (SRv6) internal parameters.

Those parameters include the mapping between an HMAC key ID and its associated hashing algorithm and secret, and the IPv6 address to use as source for encapsulated packets.

The ip sr hmac set command prompts for a newline-terminated "passphrase" that will be used as the HMAC secret for the corresponding key ID. This "passphrase" is not stretched, and it is used directly as the HMAC key. Therefore it must have enough entropy to be used as a key. For example, a correct use would be to use a passphrase that was generated using head -c 32 /dev/random | base64 -w 0.

A blank "passphrase" removes the mapping.

The currently supported algorithms for ALGO are sha1 and sha256.

If the tunnel source is set to the address :: (which is the default), then an address of the egress interface will be selected. As this operation may hinder performances, it is recommended to set a non-default address.

## EXAMPLES

### Configure an HMAC mapping for key ID 42 and hashing algorithm SHA-256

```
# ip sr hmac set 42 sha256
```

### Set the tunnel source address to 2001:db8::1

```
# ip sr tunsrc set 2001:db8::1
```

## SEE ALSO
ip-route(8)

## BUGS
ip sr hmac set does not stretch the passphrase.

## AUTHOR
David Lebrun <david.lebrun@uclouvain.be>


ip-stats

title: ip-stats(8)

summary: manage and show interface statistics

text:
# ip-stats(8)

## NAME
ip-stats - manage and show interface statistics

## SYNOPSIS

ip stats { COMMAND | help }

ip stats show [ dev DEV ] [ group GROUP [ subgroup SUBGROUP [ suite SUITE ] ... ] ... ] ...

ip stats set dev DEV l3_stats { on | off }

## DESCRIPTION
ip stats set

is used for toggling whether a certain HW statistics suite is collected on a given netdevice. The following statistics suites are supported:

l3_stats L3 stats reflect traffic that takes place in a HW device on an object that corresponds to the given software netdevice.

ip stats show

is used for showing stats on a given netdevice, or dumping statistics across all netdevices. By default, all stats are requested. It is possible to filter which stats are requested by using the group and subgroup keywords. It is possible to specify several groups, or several subgroups for one group. When no subgroups are given for a group, all the subgroups are requested.

The following groups are recognized:

group link - Link statistics. The same suite that "ip -s link show" shows.

group offload - A group that contains a number of HW-oriented statistics. See below for individual subgroups within this group.

group xstats - Extended statistics. A subgroup identifies the type of netdevice to show the statistics for.

group xstats_slave - Extended statistics for the slave of a netdevice of a given type. A subgroup identifies the type of master netdevice.

group afstats - A group for address-family specific netdevice statistics.

group offload subgroups:

subgroup cpu_hit - The cpu_hit statistics suite is useful on hardware netdevices. The link statistics on these devices reflect both the hardware- and software-datapath traffic. The cpu_hit statistics then only reflect software-datapath traffic.

subgroup hw_stats_info - This suite does not include traffic statistics, but rather communicates the state of other statistics. Through this subgroup, it is possible to discover whether a given statistic was enabled, and when it was, whether any device driver actually configured its device to collect these statistics. For example, l3_stats was enabled in the following case, but no driver has installed it:

\# ip stats show dev swp1 group offload subgroup hw_stats_info

56: swp1: group offload subgroup hw_stats_info

l3_stats on used off

After an L3 address is added to the netdevice, the counter will be installed:

\# ip addr add dev swp1 192.0.2.1/28

\# ip stats show dev swp1 group offload subgroup hw_stats_info

56: swp1: group offload subgroup hw_stats_info

l3_stats on used on

subgroup l3_stats - These statistics reflect L3 traffic that takes place in HW on an object that corresponds to the netdevice. Note that this suite is disabled by default and needs to be first enabled through ip stats set.

For example:

\# ip stats show dev swp2.200 group offload subgroup l3_stats

112: swp2.200: group offload subgroup l3_stats on used on

RX: bytes packets errors dropped mcast

8900 72 2 0 3

TX: bytes packets errors dropped

7176 58 0 0

Note how the l3_stats_info for the selected group is also part of the dump.

group xstats and group xstats_slave subgroups:

subgroup bridge - Various statistics on bridges and their slaves.

suite stp - STP statistics

suite mcast - IGMP / MLD statistics

suite vlan - per-VLAN traffic statistics

subgroup bond [ suite 802.3ad ] - Statistics for LACP traffic on bond devices and their slaves.

group afstats subgroups:

subgroup mpls - Statistics for MPLS traffic seen on the netdevice. For example:

\# ip stats show dev veth01 group afstats subgroup mpls

3: veth01: group afstats subgroup mpls

RX: bytes packets errors dropped noroute

0 0 0 0 0

TX: bytes packets errors dropped

216 2 0 0

## EXAMPLES
\# ip stats set dev swp1 l3_stats on

Enables collection of L3 HW statistics on swp1.

\# ip stats show group offload

Shows all offload statistics on all netdevices.

\# ip stats show dev swp1 group link

Shows link statistics on the given netdevice.

## SEE ALSO
ip(8), ip-link(8),

## AUTHOR
Manpage by Petr Machata.


title: ip-tcp_metrics(8)

summary: management for TCP Metrics

text:
# ip-tcp_metrics(8)

## NAME
ip-tcp_metrics - management for TCP Metrics

## SYNOPSIS

ip [ OPTIONS ] tcp_metrics { COMMAND | help }

ip tcp_metrics { show | flush } SELECTOR

ip tcp_metrics delete [ address ] ADDRESS

SELECTOR := [ [ address ] PREFIX ]

## DESCRIPTION
ip tcp_metrics is used to manipulate entries in the kernel that keep TCP information for IPv4 and IPv6 destinations. The entries are created when TCP sockets want to share information for destinations and are stored in a cache keyed by the destination address. The saved information may include values for metrics (initially obtained from routes), recent TSVAL for TIME-WAIT recycling purposes, state for the Fast Open feature, etc. For performance reasons the cache can not grow above configured limit and the older entries are replaced with fresh information, sometimes reclaimed and used for new destinations. The kernel never removes entries, they can be flushed only with this tool.

### ip tcp_metrics show - show cached entries
address PREFIX (default)

IPv4/IPv6 prefix or address. If no prefix is provided all entries are shown.

The output may contain the following information:

age <S.MMM>sec - time after the entry was created, reset or updated with metrics from sockets. The entry is reset and refreshed on use with metrics from route if the metrics are not updated in last hour. Not all cached values reset the age on update.

cwnd <N> - CWND metric value

fo_cookie <HEX-STRING> - Cookie value received in SYN-ACK to be used by Fast Open for next SYNs

fo_mss <N> - MSS value received in SYN-ACK to be used by Fast Open for next SYNs

fo_syn_drops <N>/<S.MMM>sec ago - Number of drops of initial outgoing Fast Open SYNs with data detected by monitoring the received SYN-ACK after SYN retransmission. The seconds show the time after last SYN drop and together with the drop count can be used to disable Fast Open for some time.

reordering <N> - Reordering metric value

rtt <N>us - RTT metric value

rttvar <N>us - RTTVAR metric value

ssthresh <SSTHRESH> - SSTHRESH metric value

tw_ts <TSVAL>/<SEC>sec ago - recent TSVAL and the seconds after saving it into TIME-WAIT socket

### ip tcp_metrics delete - delete single entry
address ADDRESS (default)

IPv4/IPv6 address. The address is a required argument.

### ip tcp_metrics flush - flush entries
This command flushes the entries selected by some criteria.

This command has the same arguments as show.

## EXAMPLES
ip tcp_metrics show address 192.168.0.0/24

Shows the entries for destinations from subnet

ip tcp_metrics show 192.168.0.0/24

The same but address keyword is optional

ip tcp_metrics

Show all is the default action

ip tcp_metrics delete 192.168.0.1

Removes the entry for 192.168.0.1 from cache.

ip tcp_metrics flush 192.168.0.0/24

Removes entries for destinations from subnet

ip tcp_metrics flush all

Removes all entries from cache

ip -6 tcp_metrics flush all

Removes all IPv6 entries from cache keeping the IPv4 entries.

## SEE ALSO
ip(8)

## AUTHOR
Original Manpage by Julian Anastasov <ja@ssi.bg>


ip-token

title: ip-token(8)

summary: tokenized interface identifier support

text:
# ip-token(8)

## NAME
ip-token - tokenized interface identifier support

## SYNOPSIS

ip token { COMMAND | help }

ip token set TOKEN dev DEV

ip token del dev DEV

ip token get [ dev DEV ]

ip token [ list ]

## DESCRIPTION
IPv6 tokenized interface identifier support is used for assigning well-known host-part addresses to nodes whilst still obtaining a global network prefix from Router advertisements. The primary target for tokenized identifiers are server platforms where addresses are usually manually configured, rather than using DHCPv6 or SLAAC. By using tokenized identifiers, hosts can still determine their network prefix by use of SLAAC, but more readily be automatically renumbered should their network prefix change [1]. Tokenized IPv6 Identifiers are described in the draft [1]: <draft-chown-6man-tokenised-ipv6-identifiers-02>.

### ip token set - set an interface token
set the interface token to the kernel.

TOKEN

the interface identifier token address.

dev DEV

the networking interface.

### ip token del - delete an interface token
delete the interface token from the kernel.

dev DEV

the networking interface.

### ip token get - get the interface token from the kernel
show a tokenized interface identifier of a particular networking device. Arguments: coincide with the arguments of ip token set but the TOKEN must be left out.

### ip token list - list all interface tokens
list all tokenized interface identifiers for the networking interfaces from the kernel.

## SEE ALSO
ip(8)

## AUTHOR
Manpage by Daniel Borkmann


ip-tunnel

title: ip-tunnel(8)

text:
# ip-tunnel(8)

## NAME
ip-tunnel - tunnel configuration

## SYNOPSIS

ip tunnel help

ip [ OPTIONS ] tunnel { add | change | del | show | prl | 6rd } [ NAME ]

[ mode MODE ] [ remote ADDR ] [ local ADDR ]

[ [i|o]seq ] [ [i|o]key KEY ] [ [i|o]csum ] ]

[ encaplimit ELIM ] [ ttl|hoplimit TTL ]

[ tos TOS ] [ flowlabel FLOWLABEL ]

[ prl-default ADDR ] [ prl-nodefault ADDR ] [ prl-delete ADDR ]

[ 6rd-prefix ADDR ] [ 6rd-relay_prefix ADDR ] [ 6rd-reset ]

[ [no]pmtudisc ] [ [no]ignore-df ] [ [no]allow-localremote ]

[ dev PHYS_DEV ]

MODE := { ipip | gre | sit | isatap | vti | ip6ip6 | ipip6 | ip6gre | vti6 | any }

ADDR := { IP_ADDRESS | any }

TOS := { STRING | 00..ff | inherit | inherit/STRING | inherit/00..ff }

ELIM := { none | 0..255 }

TTL := { 1..255 | inherit }

KEY := { DOTTED_QUAD | NUMBER }

## DESCRIPTION
tunnel objects are tunnels, encapsulating packets in IP packets and then sending them over the IP infrastructure. The encapsulating (or outer) address family is specified by the -f option. The default is IPv4.

ip tunnel add

add a new tunnel

ip tunnel change

change an existing tunnel

ip tunnel delete

destroy a tunnel

name NAME (default)

select the tunnel device name.

mode MODE

set the tunnel mode. Available modes depend on the encapsulating address family.

Modes for IPv4 encapsulation available: ipip, sit, isatap, vti, and gre.

Modes for IPv6 encapsulation available: ip6ip6, ipip6, ip6gre, vti6, and any.

remote ADDRESS

set the remote endpoint of the tunnel.

local ADDRESS

set the fixed local address for tunneled packets. It must be an address on another interface of this host.

ttl N

hoplimit N

set a fixed TTL (IPv4) or hoplimit (IPv6) N on tunneled packets. N is a number in the range 1--255. 0 is a special value meaning that packets inherit the TTL value. The default value for IPv4 tunnels is: inherit. The default value for IPv6 tunnels is: 64.

tos T

dsfield T

tclass T

set the type of service (IPv4) or traffic class (IPv6) field on tunneled packets, which can be specified as either a two-digit hex value (e.g. c0) or a predefined string (e.g. internet). The value inherit causes the field to be copied from the original IP header. The values inherit/STRING or inherit/00..ff will set the field to STRING or 00..ff when tunneling non-IP packets. The default value is 00.

dev NAME

bind the tunnel to the device NAME so that tunneled packets will only be routed via this device and will not be able to escape to another device when the route to endpoint changes.

nopmtudisc

disable Path MTU Discovery on this tunnel. It is enabled by default. Note that a fixed ttl is incompatible with this option: tunneling with a fixed ttl always makes pmtu discovery.

ignore-df

enable IPv4 DF suppression on this tunnel. Normally datagrams that exceed the MTU will be fragmented; the presence of the DF flag inhibits this, resulting instead in an ICMP Unreachable (Fragmentation Required) message. Enabling this attribute causes the DF flag to be ignored.

key K

ikey K

okey K

( only GRE tunnels ) use keyed GRE with key K. K is either a number or an IP address-like dotted quad. The key parameter sets the key to use in both directions. The ikey and okey parameters set different keys for input and output.

csum, icsum, ocsum

( only GRE tunnels ) generate/require checksums for tunneled packets. The ocsum flag calculates checksums for outgoing packets. The icsum flag requires that all input packets have the correct checksum. The csum flag is equivalent to the combination icsum ocsum.

seq, iseq, oseq

( only GRE tunnels ) serialize packets. The oseq flag enables sequencing of outgoing packets. The iseq flag requires that all input packets are serialized. The seq flag is equivalent to the combination iseq oseq. It doesn't work. Don't use it.

encaplimit ELIM

( only IPv6 tunnels ) set a fixed encapsulation limit. Default is 4.

flowlabel FLOWLABEL

( only IPv6 tunnels ) set a fixed flowlabel.

allow-localremote

( only IPv6 tunnels ) allow remote endpoint on the local host.

ip tunnel prl

potential router list (ISATAP only)

dev NAME

mandatory device name.

prl-default ADDR

prl-nodefault ADDR

prl-delete ADDR

Add or delete ADDR as a potential router or default router.

ip tunnel show

list tunnels This command has no arguments.

## SEE ALSO
ip(8)

## AUTHOR
Original Manpage by Michail Litvak <mci@owl.openwall.com>


ip-vrf

title: ip-vrf(8)

summary: run a command against a vrf

text:
# ip-vrf(8)

## NAME
ip-vrf - run a command against a vrf

## SYNOPSIS

ip vrf { COMMAND | help }

ip vrf show [ NAME ]

ip vrf identify [ PID ]

ip vrf pids NAME

ip vrf exec [ NAME ] command...

## DESCRIPTION
A VRF provides traffic isolation at layer 3 for routing, similar to how a VLAN is used to isolate traffic at layer 2. Fundamentally, a VRF is a separate routing table. Network devices are associated with a VRF by enslaving the device to the VRF. At that point network addresses assigned to the device are local to the VRF with host and connected routes moved to the table associated with the VRF.

A process can specify a VRF using several APIs -- binding the socket to the VRF device using SO_BINDTODEVICE, setting the VRF association using IP_UNICAST_IF or IPV6_UNICAST_IF, or specifying the VRF for a specific message using IP_PKTINFO or IPV6_PKTINFO.

By default a process is not bound to any VRF. An association can be set explicitly by making the program use one of the APIs mentioned above or implicitly using a helper to set SO_BINDTODEVICE for all IPv4 and IPv6 sockets (AF_INET and AF_INET6) when the socket is created. This ip-vrf command is a helper to run a command against a specific VRF with the VRF association inherited parent to child.

ip vrf show [ NAME ] - Show all configured VRF

This command lists all VRF and their corresponding table ids. If NAME is given, then only that VRF and table id is shown. The latter command is useful for scripting where the table id for a VRF is needed.

ip vrf exec [ NAME ] cmd ... - Run cmd against the named VRF

This command allows applications that are VRF unaware to be run against a VRF other than the default VRF (main table). A command can be run against the default VRF by passing the "default" as the VRF name. This is useful if the current shell is associated with another VRF (e.g, Management VRF).

This command requires the system to be booted with cgroup v2 (e.g. with systemd, add systemd.unified_cgroup_hierarchy=1 to the kernel command line).

This command also requires to be run as root. Alternatively it can be run by an unprivileged user if the following capabilities(7) are given:

CAP_BPF

To load the BPF program.

CAP_NET_ADMIN

To set the socket into the cgroup.

CAP_DAC_OVERRIDE

To create the cgroup subdir in /sys.

If these capabilities are added and if ip(8) is built with libcap(3) then these capabilities will be dropped before cmd is executed by ip vrf exec. For every other unprivileged invocation of ip(8) all capabilities will be dropped. NOTE: capabilities will NOT be dropped if CAP_NET_ADMIN is set to INHERITABLE to avoid breaking programs with ambient capabilities that call ip.

ip vrf identify [PID] - Report VRF association for process

This command shows the VRF association of the specified process. If PID is not specified then the id of the current process is used.

ip vrf pids NAME - Report processes associated with the named VRF

This command shows all process ids that are associated with the given VRF.

## CAVEATS
This command requires a kernel compiled with CGROUPS and CGROUP_BPF enabled.

The VRF helper *only* affects network layer sockets.

## EXAMPLES
ip vrf exec red ssh 10.100.1.254

Executes ssh to 10.100.1.254 against the VRF red table.

## SEE ALSO
ip(8), ip-link(8), ip-address(8), ip-route(8), ip-neighbor(8)

## AUTHOR
Original Manpage by David Ahern


ip-xfrm

title: ip-xfrm(8)

summary: transform configuration

text:
# ip-xfrm(8)

## NAME
ip-xfrm - transform configuration

## SYNOPSIS

ip [ OPTIONS ] xfrm { COMMAND | help }

ip xfrm XFRM-OBJECT { COMMAND | help }

XFRM-OBJECT := state | policy | monitor

ip xfrm state { add | update } ID [ ALGO-LIST ] [ mode MODE ] [ mark MARK [ mask MASK ] ] [ reqid REQID ] [ dir SA-DIR ] [ seq SEQ ] [ replay-window SIZE ] [ replay-seq SEQ ] [ replay-oseq SEQ ] [ replay-seq-hi SEQ ] [ replay-oseq-hi SEQ ] [ flag FLAG-LIST ] [ sel SELECTOR ] [ LIMIT-LIST ] [ encap ENCAP ] [ coa ADDR[/PLEN] ] [ ctx CTX ] [ extra-flag EXTRA-FLAG-LIST ] [ output-mark OUTPUT-MARK [ mask MASK ] ] [ if_id IF-ID ] [ offload [ crypto|packet ] dev DEV dir DIR ] [ tfcpad LENGTH ]

ip xfrm state allocspi ID [ mode MODE ] [ mark MARK [ mask MASK ] ] [ reqid REQID ] [ seq SEQ ] [ min SPI max SPI ]

ip xfrm state { delete | get } ID [ mark MARK [ mask MASK ] ]

ip [ -4 | -6 ] xfrm state deleteall [ ID ] [ mode MODE ] [ reqid REQID ] [ flag FLAG-LIST ]

ip [ -4 | -6 ] xfrm state list [ ID ] [ nokeys ] [ mode MODE ] [ reqid REQID ] [ flag FLAG-LIST ]

ip xfrm state flush [ proto XFRM-PROTO ]

ip xfrm state count

ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM-PROTO ] [ spi SPI ]

XFRM-PROTO := esp | ah | comp | route2 | hao

ALGO-LIST := [ ALGO-LIST ] ALGO

ALGO := { enc | auth } ALGO-NAME ALGO-KEYMAT |

auth-trunc ALGO-NAME ALGO-KEYMAT ALGO-TRUNC-LEN |

aead ALGO-NAME ALGO-KEYMAT ALGO-ICV-LEN |

comp ALGO-NAME

MODE := transport | tunnel | beet | ro | in_trigger

SA-DIR := in | out

FLAG-LIST := [ FLAG-LIST ] FLAG

FLAG := noecn | decap-dscp | nopmtudisc | wildrecv | icmp | af-unspec | align4 | esn

SELECTOR := [ src ADDR[/PLEN] ] [ dst ADDR[/PLEN] ] [ dev DEV ]

[ UPSPEC ]

UPSPEC := proto { PROTO |

{ tcp | udp | sctp | dccp } [ sport PORT ] [ dport PORT ] |

{ icmp | ipv6-icmp | mobility-header } [ type NUMBER ] [ code NUMBER ] |

gre [ key { DOTTED-QUAD | NUMBER } ] }

LIMIT-LIST := [ LIMIT-LIST ] limit LIMIT

LIMIT := { time-soft | time-hard | time-use-soft | time-use-hard } SECONDS |

{ byte-soft | byte-hard } SIZE |

{ packet-soft | packet-hard } COUNT

ENCAP := { espinudp | espinudp-nonike | espintcp } SPORT DPORT OADDR

EXTRA-FLAG-LIST := [ EXTRA-FLAG-LIST ] EXTRA-FLAG

EXTRA-FLAG := dont-encap-dscp | oseq-may-wrap

ip xfrm policy { add | update } SELECTOR dir DIR [ ctx CTX ] [ mark MARK [ mask MASK ] ] [ index INDEX ] [ ptype PTYPE ] [ action ACTION ] [ priority PRIORITY ] [ flag FLAG-LIST ] [ if_id IF-ID ] [ offload packet dev DEV ] [ LIMIT-LIST ] [ TMPL-LIST ]

ip xfrm policy { delete | get } { SELECTOR | index INDEX } dir DIR [ ctx CTX ] [ mark MARK [ mask MASK ] ] [ ptype PTYPE ] [ if_id IF-ID ]

ip [ -4 | -6 ] xfrm policy { deleteall | list } [ nosock ] [ SELECTOR ] [ dir DIR ] [ index INDEX ] [ ptype PTYPE ] [ action ACTION ] [ priority PRIORITY ] [ flag FLAG-LIST]

ip xfrm policy flush [ ptype PTYPE ]

ip xfrm policy count

ip xfrm policy set [ hthresh4 LBITS RBITS ] [ hthresh6 LBITS RBITS ]

ip xfrm policy setdefault DIR ACTION [ DIR ACTION ] [ DIR ACTION ]

ip xfrm policy getdefault

SELECTOR := [ src ADDR[/PLEN] ] [ dst ADDR[/PLEN] ] [ dev DEV ] [ UPSPEC ]

UPSPEC := proto { PROTO |

{ tcp | udp | sctp | dccp } [ sport PORT ] [ dport PORT ] |

{ icmp | ipv6-icmp | mobility-header } [ type NUMBER ] [ code NUMBER ] |

gre [ key { DOTTED-QUAD | NUMBER } ] }

DIR := in | out | fwd

PTYPE := main | sub

ACTION := allow | block

FLAG-LIST := [ FLAG-LIST ] FLAG

FLAG := localok | icmp

LIMIT-LIST := [ LIMIT-LIST ] limit LIMIT

LIMIT := { time-soft | time-hard | time-use-soft | time-use-hard } SECONDS |

{ byte-soft | byte-hard } SIZE |

{ packet-soft | packet-hard } COUNT

TMPL-LIST := [ TMPL-LIST ] tmpl TMPL

TMPL := ID [ mode MODE ] [ reqid REQID ] [ level LEVEL ]

ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM-PROTO ] [ spi SPI ]

XFRM-PROTO := esp | ah | comp | route2 | hao

MODE := transport | tunnel | beet | ro | in_trigger

LEVEL := required | use

ip xfrm monitor [ all-nsid ] [ nokeys ] [ all

| LISTofXFRM-OBJECTS ]

LISTofXFRM-OBJECTS := [ LISTofXFRM-OBJECTS ] XFRM-OBJECT

XFRM-OBJECT := acquire | expire | SA | policy | aevent | report

## DESCRIPTION
xfrm is an IP framework for transforming packets (such as encrypting their payloads). This framework is used to implement the IPsec protocol suite (with the state object operating on the Security Association Database, and the policy object operating on the Security Policy Database). It is also used for the IP Payload Compression Protocol and features of Mobile IPv6.

ip xfrm state add

add new state into xfrm

ip xfrm state update

update existing state in xfrm

ip xfrm state allocspi

allocate an SPI value

ip xfrm state delete

delete existing state in xfrm

ip xfrm state get

get existing state in xfrm

ip xfrm state deleteall

delete all existing state in xfrm

ip xfrm state list

print out the list of existing state in xfrm

ip xfrm state flush

flush all state in xfrm

ip xfrm state count

count all existing state in xfrm

ID

is specified by a source address, destination address, transform protocol XFRM-PROTO, and/or Security Parameter Index SPI. (For IP Payload Compression, the Compression Parameter Index or CPI is used for SPI.)

XFRM-PROTO

specifies a transform protocol: IPsec Encapsulating Security Payload (esp), IPsec Authentication Header (ah), IP Payload Compression (comp), Mobile IPv6 Type 2 Routing Header (route2), or Mobile IPv6 Home Address Option (hao).

ALGO-LIST

contains one or more algorithms to use. Each algorithm ALGO is specified by:

•

the algorithm type: encryption (enc), authentication (auth or auth-trunc), authenticated encryption with associated data (aead), or compression (comp)

•

the algorithm name ALGO-NAME (see below)

•

(for all except comp) the keying material ALGO-KEYMAT, which may include both a key and a salt or nonce value; refer to the corresponding RFC

•

(for auth-trunc only) the truncation length ALGO-TRUNC-LEN in bits

•

(for aead only) the Integrity Check Value length ALGO-ICV-LEN in bits

Encryption algorithms include ecb(cipher_null), cbc(des), cbc(des3_ede), cbc(cast5), cbc(blowfish), cbc(aes), cbc(serpent), cbc(camellia), cbc(twofish), and rfc3686(ctr(aes)). Authentication algorithms include digest_null, hmac(md5), hmac(sha1), hmac(sha256), hmac(sha384), hmac(sha512), hmac(rmd160), and xcbc(aes).

Authenticated encryption with associated data (AEAD) algorithms include rfc4106(gcm(aes)), rfc4309(ccm(aes)), and rfc4543(gcm(aes)).

Compression algorithms include deflate, lzs, and lzjh.

MODE

specifies a mode of operation for the transform protocol. IPsec and IP Payload Compression modes are transport, tunnel, and (for IPsec ESP only) Bound End-to-End Tunnel (beet). Mobile IPv6 modes are route optimization (ro) and inbound trigger (in_trigger).

FLAG-LIST

contains one or more of the following optional flags: noecn, decap-dscp, nopmtudisc, wildrecv, icmp, af-unspec, align4, or esn.

SELECTOR

selects the traffic that will be controlled by the policy, based on the source address, the destination address, the network device, and/or UPSPEC.

UPSPEC

selects traffic by protocol. For the tcp, udp, sctp, or dccp protocols, the source and destination port can optionally be specified. For the icmp, ipv6-icmp, or mobility-header protocols, the type and code numbers can optionally be specified. For the gre protocol, the key can optionally be specified as a dotted-quad or number. Other protocols can be selected by name or number PROTO.

LIMIT-LIST

sets limits in seconds, bytes, or numbers of packets.

ENCAP

encapsulates packets with protocol espinudp, espinudp-nonike, or espintcp, using source port SPORT, destination port DPORT , and original address OADDR.

MARK

used to match xfrm policies and states

OUTPUT-MARK

used to set the output mark to influence the routing of the packets emitted by the state

IF-ID

xfrm interface identifier used to in both xfrm policies and states

DEV

Network interface name used to offload policies and states

ip xfrm policy add

add a new policy

ip xfrm policy update

update an existing policy

ip xfrm policy delete

delete an existing policy

ip xfrm policy get

get an existing policy

ip xfrm policy deleteall

delete all existing xfrm policies

ip xfrm policy list

print out the list of xfrm policies

ip xfrm policy flush

flush policies

nosock

filter (remove) all socket policies from the output.

SELECTOR

selects the traffic that will be controlled by the policy, based on the source address, the destination address, the network device, and/or UPSPEC.

UPSPEC

selects traffic by protocol. For the tcp, udp, sctp, or dccp protocols, the source and destination port can optionally be specified. For the icmp, ipv6-icmp, or mobility-header protocols, the type and code numbers can optionally be specified. For the gre protocol, the key can optionally be specified as a dotted-quad or number. Other protocols can be selected by name or number PROTO.

DIR

selects the policy direction as in, out, or fwd.

CTX

sets the security context.

PTYPE

can be main (default) or sub.

ACTION

can be allow (default) or block.

PRIORITY

is a number that defaults to zero.

FLAG-LIST

contains one or both of the following optional flags: local or icmp.

LIMIT-LIST

sets limits in seconds, bytes, or numbers of packets.

TMPL-LIST

is a template list specified using ID, MODE, REQID, and/or LEVEL.

ID

is specified by a source address, destination address, transform protocol XFRM-PROTO, and/or Security Parameter Index SPI. (For IP Payload Compression, the Compression Parameter Index or CPI is used for SPI.)

XFRM-PROTO

specifies a transform protocol: IPsec Encapsulating Security Payload (esp), IPsec Authentication Header (ah), IP Payload Compression (comp), Mobile IPv6 Type 2 Routing Header (route2), or Mobile IPv6 Home Address Option (hao).

MODE

specifies a mode of operation for the transform protocol. IPsec and IP Payload Compression modes are transport, tunnel, and (for IPsec ESP only) Bound End-to-End Tunnel (beet). Mobile IPv6 modes are route optimization (ro) and inbound trigger (in_trigger).

LEVEL

can be required (default) or use.

ip xfrm policy count

count existing policies

Use one or more -s options to display more details, including policy hash table information.

ip xfrm policy set

configure the policy hash table

Security policies whose address prefix lengths are greater than or equal policy hash table thresholds are hashed. Others are stored in the policy_inexact chained list.

LBITS

specifies the minimum local address prefix length of policies that are stored in the Security Policy Database hash table.

RBITS

specifies the minimum remote address prefix length of policies that are stored in the Security Policy Database hash table.

ip xfrm monitor

state monitoring for xfrm objects

The xfrm objects to monitor can be optionally specified.

If the all-nsid option is set, the program listens to all network namespaces that have a nsid assigned into the network namespace were the program is running. A prefix is displayed to show the network namespace where the message originates. Example:

[nsid 1]Flushed state proto 0

## AUTHOR
Manpage revised by David Ward <david.ward@ll.mit.edu>

Manpage revised by Christophe Gouault <christophe.gouault@6wind.com>

Manpage revised by Nicolas Dichtel <nicolas.dichtel@6wind.com>


lnstat

title: lnstat(8)

summary: unified linux network statistics

text:
# lnstat(8)

## NAME
lnstat - unified linux network statistics

## SYNOPSIS
lnstat [options]

## DESCRIPTION
This manual page documents briefly the lnstat command.

lnstat is a generalized and more feature-complete replacement for the old rtstat program. It is commonly used to periodically print a selection of statistical values exported by the kernel. In addition to routing cache statistics, it supports any kind of statistics the linux kernel exports via a file in /proc/net/stat/.

Each file in /proc/net/stat/ contains a header line listing the column names. These names are used by lnstat as keys for selecting which statistics to print. For every CPU present in the system, a line follows which lists the actual values for each column of the file. lnstat sums these values up (which in fact are counters) before printing them. After each interval, only the difference to the last value is printed.

Files and columns may be selected by using the -f and -k parameters. By default, all columns of all files are printed.

## OPTIONS
lnstat supports the following options.

-h, --help

Show summary of options.

-V, --version

Show version of program.

-c, --count <count>

Print <count> number of intervals.

-d, --dump

Dump list of available files/keys.

-f, --file <file>

Statistics file to use, may be specified multiple times. By default all files in /proc/net/stat are scanned.

-i, --interval <intv>

Set interval to 'intv' seconds.

-j, --json

Display results in JSON format

-k, --keys k,k,k,...

Display only keys specified. Each key k is of the form [file:]key. If <file> is given, the search for the given key is limited to that file. Otherwise the first file containing the searched key is being used.

-s, --subject [0-2]

Specify display of subject/header. '0' means no header at all, '1' prints a header only at start of the program and '2' prints a header every 20 lines.

-w, --width n,n,n,...

Width for each field.

## USAGE EXAMPLES
\# lnstat -d

Get a list of supported statistics files.

\# lnstat -k arp_cache:entries,rt_cache:in_hit,arp_cache:destroys

Select the specified files and keys.

\# lnstat -i 10

Use an interval of 10 seconds.

\# lnstat -f ip_conntrack

Use only the specified file for statistics.

\# lnstat -s 0

Do not print a header at all.

\# lnstat -s 20

Print a header at start and every 20 lines.

\# lnstat -c -1 -i 1 -f rt_cache -k entries,in_hit,in_slow_tot

Display statistics for keys entries, in_hit and in_slow_tot of field rt_cache every second.

## FILES
/proc/net/stat/arp_cache, /proc/net/stat/ndisc_cache

Statistics around neighbor cache and ARP. arp_cache is for IPv4, ndisc_cache is the same for IPv6. entries Number of entries in the neighbor table.

allocs How many neighbor entries have been allocated.

destroys How many neighbor entries have been removed.

hash_grows How often the neighbor (hash) table was increased.

lookups How many lookups were performed.

hits How many lookups were successful.

res_failed How many neighbor lookups failed.

rcv_probes_mcast How many multicast neighbor solicitations were received. (IPv6 only.)

rcv_probes_ucast How many unicast neighbor solicitations were received. (IPv6 only.)

periodic_gc_runs How many garbage collection runs were executed.

forced_gc_runs How many forced garbage collection runs were executed. Happens when adding an entry and the table is too full.

unresolved_discards How many neighbor table entries were discarded due to lookup failure.

table_fulls Number of table overflows. Happens if table is full and forced GC run (see forced_gc_runs) has failed.

/proc/net/stat/ip_conntrack, /proc/net/stat/nf_conntrack

Conntrack related counters. ip_conntrack is for backwards compatibility with older userspace only and shows the same data as nf_conntrack. entries Number of entries in conntrack table.

searched Number of conntrack table lookups performed.

found Number of searched entries which were successful.

new Number of conntrack entries added which were not expected before.

invalid Number of packets seen which can not be tracked.

ignore Number of packets seen which are already connected to a conntrack entry.

delete Number of conntrack entries which were removed.

delete_list Number of conntrack entries which were put to dying list.

insert Number of entries inserted into the list.

insert_failed Number of entries for which list insertion was attempted but failed (happens if the same entry is already present).

drop Number of packets dropped due to conntrack failure. Either new conntrack entry allocation failed, or protocol helper dropped the packet.

early_drop Number of dropped conntrack entries to make room for new ones, if maximum table size was reached.

icmp_error Number of packets which could not be tracked due to error situation. This is a subset of invalid.

expect_new Number of conntrack entries added after an expectation for them was already present.

expect_create Number of expectations added.

expect_delete Number of expectations deleted.

search_restart Number of conntrack table lookups which had to be restarted due to hashtable resizes.

/proc/net/stat/rt_cache

Routing cache statistics. entries Number of entries in routing cache.

in_hit Number of route cache hits for incoming packets. Deprecated since IP route cache removal, therefore always zero.

in_slow_tot Number of routing cache entries added for input traffic.

in_slow_mc Number of multicast routing cache entries added for input traffic.

in_no_route Number of input packets for which no routing table entry was found.

in_brd Number of matched input broadcast packets.

in_martian_dst Number of incoming martian destination packets.

in_martian_src Number of incoming martian source packets.

out_hit Number of route cache hits for outgoing packets. Deprecated since IP route cache removal, therefore always zero.

out_slow_tot Number of routing cache entries added for output traffic.

out_slow_mc Number of multicast routing cache entries added for output traffic.

gc_total Total number of garbage collection runs. Deprecated since IP route cache removal, therefore always zero.

gc_ignored Number of ignored garbage collection runs due to minimum GC interval not reached and routing cache not full. Deprecated since IP route cache removal, therefore always zero.

gc_goal_miss Number of garbage collector goal misses. Deprecated since IP route cache removal, therefore always zero.

gc_dst_overflow Number of destination cache overflows. Deprecated since IP route cache removal, therefore always zero.

in_hlist_search Number of hash table list traversals for input traffic. Deprecated since IP route cache removal, therefore always zero.

out_hlist_search Number of hash table list traversals for output traffic. Deprecated since IP route cache removal, therefore always zero.

## SEE ALSO
ip(8)

## AUTHOR
lnstat was written by Harald Welte <laforge@gnumonks.org>.

This manual page was written by Michael Prokop <mika@grml.org> for the Debian project (but may be used by others).


netshaper

title: netshaper(8)

text:
# netshaper(8)

## NAME
netshaper - show / manipulate network device hardware shaping configuration

## SYNOPSIS

netshaper [ OPTIONS ] { COMMAND | help }

OPTIONS := { -V[ersion] | -c[olor] | -help }

netshaper set dev DEV handle scope HANDLE_SCOPE [ id HANDLE_ID ] bw-max BW_MAX

netshaper { show | delete } dev DEV handle scope HANDLE_SCOPE [ id HANDLE_ID ]

## DESCRIPTION
netshaper allows configuration and management of hardware rate limiting (shaping) capabilities available on network devices. The API provides control over shapers at different levels including network devices, queues, and scheduling nodes, enabling manipulation of the device's scheduling tree.

Each shaper is uniquely identified within a device by a handle, which consists of a scope and an optional id. Depending on the scope value, shapers are attached to specific hardware objects:

netdev

Shapers attached to the entire network device. The id parameter is optional for this scope (defaults to 0 if not specified).

queue

Shapers attached to specific device queues. The id parameter is required and specifies the queue number.

node

Shapers representing scheduling groups that can be placed at arbitrary locations in the scheduling tree. The id parameter is required.

## COMMANDS

### netshaper set
- Create or update a shaper configuration

Creates or updates a shaper with the specified parameters. All parameters except id (for netdev scope) are required.

### netshaper show
- Display shaper information

Shows the current configuration of the specified shaper, including bandwidth limits and device information.

### netshaper delete
- Remove a shaper configuration

Removes the specified shaper configuration from the device.

## PARAMETERS
dev DEV

Specifies the network device name on which to operate.

handle

Defines the shaper handle consisting of:

scope HANDLE_SCOPE

The shaper scope, which can be: netdev (device-level shaper), queue (queue-level shaper), or node (scheduling node shaper).

id HANDLE_ID

Numeric identifier for the shaper. Optional for netdev scope (defaults to 0), required for queue and node scopes.

bw-max BW_MAX

Maximum bandwidth limit for the shaper. Accepts values with suffixes: kbit, mbit, gbit for kilobits, megabits, and gigabits per second respectively.

## OPTIONS
-V, -Version

Print the version of the netshaper utility and exit.

-c[color] = {always | auto | never}

Configure color output. If parameter is omitted or always, color output is enabled regardless of stdout state. If parameter is auto, stdout is checked to be a terminal before enabling color output. If parameter is never, color output is disabled. If specified multiple times, the last one takes precedence.

-help

Display usage information and exit.

## EXAMPLES
Example 1: Create a device-level shaper (id optional)

```
# netshaper set dev foo handle scope netdev bw-max 10gbit
```

Creates a netdev-scoped shaper with default id 0 and sets the maximum bandwidth to 10 gigabits per second.

Example 2: Show shaper configuration

```
# netshaper show dev foo handle scope netdev
```

Display the current shaper configuration for the specified device and handle.

Example 3: Delete shaper configuration

```
# netshaper delete dev eth0 handle scope netdev
```

Remove the specified shaper configuration.

## NOTES

- For netdev scope, the id parameter is optional and defaults to 0 if not specified.

- For queue and node scopes, the id parameter is required.

- Bandwidth values support standard suffixes: kbit (kilobits per second), mbit (megabits per second), gbit (gigabits per second).

- This command currently supports basic shaper operations. Additional functionality will be added as requirements are identified.

## SEE ALSO
ip(8), ip-link(8), tc(8)

## AUTHOR
Erni Sri Satya Vennela <ernis@linux.microsoft.com>


rdma

title: rdma(8)

summary: RDMA tool

text:
# rdma(8)

## NAME
rdma - RDMA tool

## SYNOPSIS

rdma [ OPTIONS ] OBJECT { COMMAND | help }

rdma [ -force ] -batch filename

OBJECT := { dev | link | resource | system | statistic | monitor }

OPTIONS := { -V[ersion] | -d[etails] | -j[son] | -o[neline] | -p[retty] }

## OPTIONS
-V, -Version

Print the version of the rdma tool and exit.

-b, -batch <FILENAME>

Read commands from provided file or standard input and invoke them. First failure will cause termination of rdma.

-force

Don't terminate rdma on errors in batch mode. If there were any errors during execution of the commands, the application return code will be non zero.

-d, --details

Output detailed information. Adding a second -d includes driver-specific details.

-r, --raw

Output includes driver-specific details in raw format.

-p, --pretty

When combined with -j generate a pretty JSON output.

-j, --json

Generate JSON output.

-o, -oneline

output each record on a single line, replacing line feeds with the '\' character.

### OBJECT
dev

- RDMA device.

link

- RDMA port related.

resource

- RDMA resource configuration.

sys

- RDMA subsystem related.

statistic

- RDMA counter statistic related.

monitor

- RDMA events monitor

The names of all objects may be written in full or abbreviated form, for example stats can be abbreviated as stat or just s.

### COMMAND
Specifies the action to perform on the object. The set of possible actions depends on the object type. As a rule, it is possible to show (or list ) objects, but some objects do not allow all of these operations or have some additional commands. The help command is available for all objects. It prints out a list of available commands and argument syntax conventions.

If no command is given, some default command is assumed. Usually it is list or, if the objects of this class cannot be listed, help.

## EXIT STATUS
Exit status is 0 if command was successful or a positive integer upon failure.

## SEE ALSO
rdma-dev(8), rdma-link(8), rdma-resource(8), rdma-system(8), rdma-statistic(8), rdma-monitor(8),

## REPORTING BUGS
Report any bugs to the Linux RDMA mailing list <linux-rdma@vger.kernel.org> where the development and maintenance is primarily done. You do not have to be subscribed to the list to send a message there.

## AUTHOR
Leon Romanovsky <leonro@mellanox.com>


rdma-dev

title: rdma-dev(8)

summary: RDMA device configuration

text:
# rdma-dev(8)

## NAME
rdma-dev - RDMA device configuration

## SYNOPSIS

rdma [ OPTIONS ] dev { COMMAND | help }

OPTIONS := { -V[ersion] | -d[etails] }

rdma dev show [ DEV ]

rdma dev set [ DEV ] name NEWNAME

rdma dev set [ DEV ] netns NSNAME

rdma dev set [ DEV ] adaptive-moderation [on/off]

rdma dev add [ NAME ] type [ TYPE ] parent [ PARENT_DEV ]

rdma dev delete [ NAME ]

rdma dev help

## DESCRIPTION

### rdma dev show - display RDMA device attributes
DEV - specifies the RDMA device to show. If this argument is omitted all devices are listed.

### rdma dev delete - Delete a RDMA device which is created with the add command.
NAME - The name of the device being added/deleted.

TYPE - The type of the device being added; It specifies which functionalities it provides. Supported device type:

SMI - A device with this type provides SMI (QP0) interface. This device and it's parent associates with the same HCA port and shares the physical link, so when the parent doesn't support SMI, then this type of device can be created to allow the subnet manager to configure the link.

PARENT_DEV - The name of its parent IB device.

## EXAMPLES
rdma dev

Shows the state of all RDMA devices on the system.

rdma dev show mlx5_3

Shows the state of specified RDMA device.

rdma dev set mlx5_3 name rdma_0

Renames the mlx5_3 device to rdma_0.

rdma dev set mlx5_3 netns foo

Changes the network namespace of RDMA device to foo where foo is previously created using iproute2 ip command.

rdma dev set mlx5_3 adaptive-moderation [on/off]

Sets the state of adaptive interrupt moderation for the RDMA device.

This is a global setting for the RDMA device but the value is printed for each CQ individually because the state is constant from CQ allocation.

rdma dev add smi1 type SMI parent ibp8s0f1

Add a new IB device with name "smi1", type "SMI", and "ibp8s0f1" as its parent device.

rdma dev delete smi1

Delete the IB device "smi1".

## SEE ALSO
ip(8), rdma(8), rdma-link(8), rdma-resource(8), rdma-system(8), rdma-statistic(8),

## AUTHOR
Leon Romanovsky <leonro@mellanox.com>

Mark Zhang <markzhang@nvidia.com>


rdma-link

title: rdma-link(8)

summary: rdma link configuration

text:
# rdma-link(8)

## NAME
rdma-link - rdma link configuration

## SYNOPSIS

rdma [ OPTIONS ] link { COMMAND | help }

OPTIONS := { -V[ersion] | -d[etails] }

rdma link show [ DEV/PORT_INDEX ]

rdma link add NAME type TYPE netdev NETDEV

rdma link delete NAME

rdma link help

## DESCRIPTION

### rdma link show - display rdma link attributes
DEV/PORT_INDEX - specifies the RDMA link to show. If this argument is omitted all links are listed.

### rdma link add NAME type TYPE netdev NETDEV - add an rdma link for the specified type to the network device
NAME - specifies the new name of the rdma link to add

TYPE - specifies which rdma type to use. Link types:

rxe - Soft RoCE driver

siw - Soft iWARP driver

NETDEV - specifies the network device to which the link is bound

### rdma link delete NAME - delete an rdma link
NAME - specifies the name of the rdma link to delete

## EXAMPLES
rdma link show

Shows the state of all rdma links on the system.

rdma link show mlx5_2/1

Shows the state of specified rdma link.

rdma link add rxe_eth0 type rxe netdev eth0

Adds a RXE link named rxe_eth0 to network device eth0

rdma link del rxe_eth0

Removes RXE link rxe_eth0

## SEE ALSO
rdma(8), rdma-dev(8), rdma-resource(8), rdma-statistic(8),

## AUTHOR
Leon Romanovsky <leonro@mellanox.com>


rdma-monitor

title: rdma-monitor(8)

summary: RDMA events monitoring

text:
# rdma-monitor(8)

## NAME
rdma-monitor - RDMA events monitoring

## SYNOPSIS

rdma [ OPTIONS ] monitor { help }

OPTIONS := { -V[ersion] }

rdma monitor

rdma monitor help

## DESCRIPTION

### rdma monitor - utility can monitor RDMA device events on all RDMA devices.
rdma opens an RDMA Netlink socket, listens on it and dumps the event info.

The event types supported are RDMA device registration/unregistration and net device attachment/detachment.

## EXAMPLES
rdma monitor

Listen for events of all RDMA devices

## SEE ALSO
rdma(8), rdma-link(8), rdma-resource(8), rdma-system(8), rdma-statistic(8),

## AUTHOR
Chiara Meiohas <cmeiohas@nvidia.com>


rdma-resource

title: rdma-resource(8)

summary: rdma resource configuration

text:
# rdma-resource(8)

## NAME
rdma-resource - rdma resource configuration

## SYNOPSIS

rdma [ OPTIONS ] RESOURCE { COMMAND | help }

RESOURCE := { cm_id | cq | mr | pd | qp | ctx | srq }

OPTIONS := { -j[son] | -d[etails] }

rdma resource show [ DEV/PORT_INDEX ]

rdma resource help

## DESCRIPTION

### rdma resource show - display rdma resource tracking information
DEV/PORT_INDEX - specifies the RDMA link to show. If this argument is omitted all links are listed.

## EXAMPLES
rdma resource show

Shows summary for all devices on the system.

rdma resource show mlx5_2

Shows the state of specified rdma device.

rdma res show qp link mlx5_4

Get all QPs for the specific device.

rdma res show qp link mlx5_4/1

Get QPs of specific port.

rdma res show qp link mlx5_4/0

Provide illegal port number (0 is illegal).

rdma res show qp link mlx5_4/-

Get QPs which have not assigned port yet.

rdma res show qp link mlx5_4/- -d

Detailed view.

rdma res show qp link mlx5_4/- -dd

Detailed view including driver-specific details.

rdma res show qp link mlx5_4/1 lqpn 0-6

Limit to specific Local QPNs.

rdma res show qp link mlx5_4/1 lqpn 6 -r

Driver specific details in raw format.

rdma resource show cm_id dst-port 7174

Show CM_IDs with destination ip port of 7174.

rdma resource show cm_id src-addr 172.16.0.100

Show CM_IDs bound to local ip address 172.16.0.100

rdma resource show cq pid 30489

Show CQs belonging to pid 30489

rdma resource show ctx ctxn 1

Show contexts that have index equal to 1.

rdma resource show srq lqpn 5-7

Show SRQs that the QPs with lqpn 5-7 are associated with.

## SEE ALSO
rdma(8), rdma-dev(8), rdma-link(8), rdma-statistic(8),

## AUTHOR
Leon Romanovsky <leonro@mellanox.com>


rdma-statistic

title: rdma-statistic(8)

summary: RDMA statistic counter configuration

text:
# rdma-statistic(8)

## NAME
rdma-statistic - RDMA statistic counter configuration

## SYNOPSIS

rdma [ OPTIONS ] statistic { COMMAND | help }

rdma statistic { OBJECT } show

rdma statistic [ OBJECT ] show link [ DEV/PORT_INDX ] [ FILTER_NAME FILTER_VALUE ]

rdma statistic OBJECT mode

rdma statistic OBJECT set COUNTER_SCOPE [ DEV/PORT_INDEX ] auto { CRITERIA | off } [ optional-counters | on/off ]

rdma statistic OBJECT bind COUNTER_SCOPE [ DEV/PORT_INDEX ] [ OBJECT-ID ] [ COUNTER-ID ]

rdma statistic OBJECT unbind COUNTER_SCOPE [ DEV/PORT_INDEX ] [ COUNTER-ID ] [ OBJECT-ID ]

rdma statistic mode [ supported ] link [ DEV/PORT_INDEX ]

rdma statistic set link [ DEV/PORT_INDEX ] optional-counters [ OPTIONAL-COUNTERS ]

rdma statistic unset link [ DEV/PORT_INDEX ] optional-counters

COUNTER_SCOPE := { link | dev }

OBJECT := { qp | mr }

CRITERIA := { type | pid }

FILTER_NAME := { cntn | lqpn | pid | qp-type }

## DESCRIPTION

### rdma statistic [object] show - Queries the specified RDMA device for RDMA and driver-specific statistics. Show the default hw counters if object is not specified
DEV - specifies counters on this RDMA device to show.

PORT_INDEX - specifies counters on this RDMA port to show.

FILTER_NAME - specifies a filter to show only the results matching it.

### rdma statistic <object> set - configure counter statistic auto-mode for a specific device/port
In auto mode all objects belong to one category are bind automatically to a single counter set. The "off" is global for all auto modes together. Not applicable for MR's.

### rdma statistic <object> bind - manually bind an object (e.g., a qp) with a counter
When bound the statistics of this object are available in this counter. Not applicable for MR's.

### rdma statistic <object> unbind - manually unbind an object (e.g., a qp) from the counter previously bound
When unbound the statistics of this object are no longer available in this counter; And if object id is not specified then all objects on this counter will be unbound. Not applicable for MR's.

COUNTER-ID - specifies the id of the counter to be bound. If this argument is omitted then a new counter will be allocated.

### rdma statistic set - Enable a set of optional counters for a specific device/port.
OPTIONAL-COUNTERS - specifies the name of the optional counters to enable. Optional counters that are not specified will be disabled. Note that optional counters are driver-specific.

## EXAMPLES
rdma statistic show

Shows the state of the default counter of all RDMA devices on the system.

rdma statistic show link mlx5_2/1

Shows the state of the default counter of specified RDMA port

rdma statistic qp show

Shows the state of all qp counters of all RDMA devices on the system.

rdma statistic qp show link mlx5_2/1

Shows the state of all qp counters of specified RDMA port.

rdma statistic qp show link mlx5_2 pid 30489

Shows the state of all qp counters of specified RDMA port and belonging to pid 30489

rdma statistic qp show link mlx5_2 qp-type UD

Shows the state of all qp counters of specified RDMA port and with QP type UD

rdma statistic qp mode

List current counter mode on all devices

rdma statistic qp mode link mlx5_2/1

List current counter mode of device mlx5_2 port 1

rdma statistic qp set link mlx5_2/1 auto type on

On device mlx5_2 port 1, for each new user QP bind it with a counter automatically. Per counter for QPs with same qp type.

rdma statistic qp set link mlx5_2/1 auto type on optional-counters on

On device mlx5_2 port 1, for each new user QP bind it with a counter automatically. Per counter for QPs with same qp type. Whilst also binding the currently enabled optional-counters.

rdma statistic qp set link mlx5_2/1 auto pid on

On device mlx5_2 port 1, for each new user QP bind it with a counter automatically. Per counter for QPs with same pid.

rdma statistic qp set link mlx5_2/1 auto pid,type on

On device mlx5_2 port 1, for each new user QP bind it with a counter automatically. Per counter for QPs with same pid and same type.

rdma statistic qp set link mlx5_2/1 auto off

Turn-off auto mode on device mlx5_2 port 1. The allocated counters can be manually accessed.

rdma statistic qp bind link mlx5_2/1 lqpn 178

On device mlx5_2 port 1, allocate a counter and bind the specified qp on it

rdma statistic qp unbind link mlx5_2/1 cntn 4 lqpn 178

On device mlx5_2 port 1, bind the specified qp on the specified counter

rdma statistic qp unbind link mlx5_2/1 cntn 4

On device mlx5_2 port 1, unbind all QPs on the specified counter. After that this counter will be released automatically by the kernel.

rdma statistic show mr

List all currently allocated MR's and their counters.

rdma statistic show mr mrn 6

Dump a specific MR statistics with mrn 6. Dumps nothing if does not exists.

rdma statistic mode link mlx5_2/1

Display the optional counters that was enabled on mlx5_2/1.

rdma statistic mode supported link mlx5_2/1

Display the optional counters that mlx5_2/1 supports.

rdma statistic set link mlx5_2/1 optional-counters cc_rx_ce_pkts,cc_rx_cnp_pkts

Enable the cc_rx_ce_pkts,cc_rx_cnp_pkts counters on device mlx5_2 port 1.

rdma statistic unset link mlx5_2/1 optional-counters

Disable all the optional counters on device mlx5_2 port 1.

## SEE ALSO
rdma(8), rdma-dev(8), rdma-link(8), rdma-resource(8),

## AUTHORS
Mark Zhang <markz@mellanox.com>

Erez Alfasi <ereza@mellanox.com>

Neta Ostrovsky <netao@nvidia.com>


rdma-system

title: rdma-system(8)

summary: RDMA subsystem configuration

text:
# rdma-system(8)

## NAME
rdma-system - RDMA subsystem configuration

## SYNOPSIS

rdma [ OPTIONS ] sys { COMMAND | help }

OPTIONS := { -V[ersion] | -d[etails] }

rdma system show

rdma system set netns NEWMODE

rdma system set privileged-qkey NEWSTATE

rdma system help

## DESCRIPTION

### rdma system set - set RDMA subsystem network namespace mode or
privileged qkey mode

### rdma system show - display RDMA subsystem network namespace mode,
privileged qkey state and whether RDMA monitoring is supported.

NEWMODE - specifies the RDMA subsystem mode. Either exclusive or shared. When user wants to assign dedicated RDMA device to a particular network namespace, exclusive mode should be set before creating any network namespace. If there are active network namespaces and if one or more RDMA devices exist, changing mode from shared to exclusive returns error code EBUSY.

When RDMA subsystem is in shared mode, RDMA device is accessible in all network namespace. When RDMA device isolation among multiple network namespaces is not needed, shared mode can be used.

It is preferred to not change the subsystem mode when there is active RDMA traffic running, even though it is supported.

NEWSTATE - Specifies the new state of the privileged-qkey parameter, either on or off. This parameter determines whether a non-privileged user is allowed to specify a controlled QKEY or not.

## EXAMPLES
rdma system show

Shows the state of RDMA subsystem network namespace mode on the system, the state of privileged qkey parameter and whether RDMA monitor is supported.

rdma system set netns exclusive

Sets the RDMA subsystem in network namespace exclusive mode. In this mode RDMA devices are visible only in single network namespace.

rdma system set netns shared

Sets the RDMA subsystem in network namespace shared mode. In this mode RDMA devices are shared among network namespaces.

rdma system set privileged-qkey on

Sets the privileged-qkey parameter to on. In this state non-privileged user is allowed to specify a controlled QKEY.

rdma system set privileged-qkey off

Sets the privileged-qkey parameter to off. In this state non-privileged user is *not* allowed to specify a controlled QKEY.

## SEE ALSO
rdma(8), rdma-link(8), rdma-resource(8), rdma-monitor(8), network_namespaces(7), namespaces(7),

## AUTHOR
Parav Pandit <parav@mellanox.com>


rtacct

title: rtacct(8)

text:
# rtacct(8)

## NAME
nstat, rtacct - network statistics tools.

## SYNOPSIS
Usage: nstat [ -h?vVzrnasd:t:jp ] [ PATTERN [ PATTERN ] ]

Usage: rtacct [ -h?vVzrnasd:t: ] [ ListOfRealms ]

## DESCRIPTION
nstat and rtacct are simple tools to monitor kernel snmp counters and network interface statistics.

nstat can filter kernel snmp counters by name with one or several specified wildcards. Wildcards are case-insensitive and can include special symbols ? and *

## OPTIONS
-h, --help Print help

-V, --version

Print version

-z, --zeros

Dump zero counters too. By default they are not shown.

-r, --reset

Reset history.

-n, --nooutput

Do not display anything, only update history.

-a, --ignore

Dump absolute values of counters. The default is to calculate increments since the previous use.

-s, --noupdate

Do not update history, so that the next time you will see counters including values accumulated to the moment of this measurement too.

-j, --json

Display results in JSON format.

-p, --pretty

When combined with --json, pretty print the output.

-d, --scan <INTERVAL>

Run in daemon mode collecting statistics. <INTERVAL> is interval between measurements in seconds.

-t, --interval <INTERVAL>

Time interval to average rates. Default value is 60 seconds.

## SEE ALSO
lnstat(8)