The Modern iproute2 Suite in Daily Operations: ip, ss, Netlink & Persistent Interfaces

Created: 2026-11-08 · Last updated: 2026-11-08 · Nejat Hakan

Executive Summary: The legacy net-tools package (ifconfig, netstat, route, arp) was declared obsolete in the Linux community over fifteen years ago. Modern Linux network administration centers on the iproute2 suite (ip, ss, bridge, tc). Unlike obsolete tools that scraped slow, unatomic text files in /proc/net/, iproute2 communicates directly with the kernel networking subsystem via binary Netlink sockets (AF_NETLINK). This guide covers the complete command substitution matrix, daily management workflows, deep TCP socket inspection with ss, and persistent configuration on Debian.

net-tools vs. iproute2

Direct replacement matrix for ifconfig, netstat, route, and arp, demonstrating modern brief (-br), color (-c), and JSON (-j) flags.
The ip Subsystem CLI

Manage link states and MTUs with ip link, multiple IP addresses with ip addr, routing decisions with ip route, and ARP/NDP caches with ip neigh.
Deep Socket Analytics (ss)

Inspect socket queues, process ownership, and internal TCP metrics (RTT, congestion window, MSS) without freezing busy production databases.
Persistent Debian Config

Write deterministic, production-ready interface definitions for both systemd-networkd and classic Debian /etc/network/interfaces.

1. Why `net-tools` Is Dead: The Netlink Architecture

Legacy tools (ifconfig, netstat) interact with the Linux kernel through two inefficient, legacy mechanisms: 1. ioctl() System Calls: Slow, limited parameter space, and incapable of atomic configuration changes. 2. Scraping /proc/net/ Text Files: When thousands of TCP sockets are active, netstat reads and parses huge text files in /proc/net/tcp, causing significant CPU spikes and locking issues.

In contrast, iproute2 uses Netlink Sockets (AF_NETLINK): * Binary Protocol: Directly communicates with kernel network structures without text formatting overhead. * Atomic Operations: Network routes, IP addresses, and interface flags change instantaneously. * Native Structured Data: Supports machine-readable JSON output via ip -j for direct scripting with jq.

%%{init: {'flowchart': {'wrappingWidth': 600}}}%%
flowchart TB
    APP1["Legacy: ifconfig / netstat / route"] -->|"Slow ioctl() & /proc/net/ parsing"| KERNEL["Linux Kernel Networking Subsystem"]
    APP2["Modern: ip & ss (iproute2)"] -->|"AF_NETLINK Binary Socket (Fast & Atomic)"| KERNEL

2. Definitive Legacy vs. Modern Command Substitution Matrix

Deprecated Command (`net-tools`)	Modern Replacement (`iproute2`)	Function & Purpose
`ifconfig -a`	`ip -br -c addr show`	Brief, colorized overview of all interfaces, states, and IPv4/IPv6 addresses.
`ifconfig eth0 up` / `down`	`sudo ip link set dev eth0 up` / `down`	Administratively enables or disables a physical or virtual link.
`ifconfig eth0 192.168.1.50/24`	`sudo ip addr add 192.168.1.50/24 dev eth0`	Adds an IP address without wiping existing addresses on the interface.
`route -n` / `netstat -rn`	`ip -c route show`	Displays the kernel Layer-3 routing table with color-coded gateways.
`route add default gw 192.168.1.1`	`sudo ip route add default via 192.168.1.1`	Sets or replaces the primary default gateway route.
`arp -an`	`ip -c neigh show`	Displays the Layer-2 neighbor cache (ARP for IPv4 and NDP for IPv6).
`arp -d 192.168.1.50`	`sudo ip neigh del 192.168.1.50 dev eth0`	Purges a specific MAC entry from the kernel neighbor cache.
`netstat -tulpn`	`sudo ss -tulpn`	Instant overview of listening TCP and UDP ports with exact process names and PIDs.
`netstat -i`	`ip -s link show dev eth0`	Displays Layer-2 RX/TX packet counters, frame errors, and dropped packets.

3. Daily Operations with the `ip` Command

1. Link Layer Management: `ip link`

Control the Layer-2 parameters of physical and virtual interfaces:

# Display compact overview of link states, MAC addresses, and MTUs
ip -br link show

# Change interface MTU (e.g., 9000 for Jumbo Frames in storage LANs)
sudo ip link set dev eth0 mtu 9000

# Change MAC address (interface must be down first)
sudo ip link set dev eth0 down
sudo ip link set dev eth0 address 52:54:00:12:34:56
sudo ip link set dev eth0 up

# Inspect detailed interface counters, dropped frames, and hardware carrier status
ip -s -s link show dev eth0

2. Network Layer Management: `ip addr`

Unlike ifconfig, which required fake sub-interfaces (eth0:1) for multiple IPs, iproute2 natively supports multiple IP addresses per interface:

# Add a secondary IP address to an existing interface
sudo ip addr add 10.10.10.50/24 dev eth0

# List only IPv4 addresses in brief format
ip -4 -br addr show

# Delete an assigned IP address
sudo ip addr del 10.10.10.50/24 dev eth0

# Flush all dynamic or static IP addresses from an interface
sudo ip addr flush dev eth0

3. Kernel Routing Management: `ip route`

Manage the kernel's Layer-3 routing table:

# Display the active routing table
ip -c route show

# Add a static route for a remote private network via a specific gateway
sudo ip route add 10.200.0.0/16 via 192.168.1.254 dev eth0

# Add a high-priority host route with explicit metric
sudo ip route add 198.51.100.1 via 192.168.1.1 dev eth0 metric 50

# Query the kernel routing cache to see which interface and gateway will handle traffic
ip route get 8.8.8.8

4. Neighbor Discovery & ARP Management: `ip neigh`

The neighbor table maintains Layer-3 IP to Layer-2 MAC address mappings:

# Display all known IPv4 (ARP) and IPv6 (NDP) neighbors
ip -c neigh show

# Neighbor Cache States:
# REACHABLE = Valid and verified via recent traffic
# STALE     = Valid, but no traffic sent recently; will probe on next packet
# DELAY     = Awaiting confirmation before sending probe
# FAILED    = Resolution failed; no MAC response received
# PERMANENT = Static manual entry; never expires

# Add a static ARP entry (prevents ARP spoofing / MITM in critical segments)
sudo ip neigh add 192.168.1.1 lladdr 00:11:22:33:44:55 nud permanent dev eth0

# Flush the neighbor cache completely
sudo ip neigh flush dev eth0

4. High-Performance Socket Inspection with `ss`

The ss (Socket Statistics) command is the definitive tool for real-time socket inspection. Because it queries kernel socket tables directly via Netlink (sock_diag), it returns instantaneously even on systems handling 100,000+ concurrent connections.

1. Essential Daily Inspection Flags

# Show listening (-l) TCP (-t) and UDP (-u) sockets, numeric (-n), with owning process (-p)
sudo ss -tulpn

# Show all established TCP connections with socket buffer memory usage (-m)
ss -tm state established

# Inspect internal TCP metrics (-i): RTT, congestion window (cwnd), MSS, and retransmissions
ss -ti '( dport = :https or sport = :https )'

Understanding Advanced `ss -ti` Metrics

ESTAB  0  0  192.168.1.50:48210  93.184.216.34:443
     bbr wscale:7,7 rto:204 rtt:4.12/0.08 ato:40 mss:1460 rcvspace:14600
     cwnd:10 ssthresh:7 bytes_acked:15432 retrans:0/1

bbr / cubic: The active TCP congestion control algorithm.
rtt:4.12/0.08: Round Trip Time in milliseconds (smoothed RTT / variance).
cwnd:10: Congestion Window (number of segments the kernel can send before awaiting an ACK).
retrans: Number of retransmitted packets on this connection.

2. State & Expression Filtering

# Find all connections in TIME-WAIT or CLOSE-WAIT state
ss -t state time-wait
ss -t state close-wait

# Filter connections by source or destination port
ss -t '( sport = :http or dport = :http )'

# Filter connections to a specific remote subnet
ss -t dst 10.0.0.0/16

5. Machine-Readable Automation with `ip -j` & `jq`

Modern DevOps automation scripts should never parse text using awk or grep. Use the -j (JSON) flag:

# Extract the default gateway IP cleanly via jq
ip -j route show | jq -r '.[] | select(.dst == "default") | .gateway'

# List all UP interfaces and their primary IPv4 address
ip -j addr show | jq -r '.[] | select(.operstate == "UP") | {ifname: .ifname, ip: .addr_info[0].local}'

6. Persistent Network Configuration on Debian Linux

Commands executed via ip take effect immediately in kernel memory, but are lost upon reboot. Persist them using Debian's standard network managers:

1. systemd-networkd (Modern Headless Standard)2. Classic Debian ifupdown (/etc/network/interfaces)

# File: /etc/systemd/network/10-static-eth0.network
[Match]
Name=eth0

[Network]
Address=192.168.1.50/24
Gateway=192.168.1.1
DNS=192.168.1.1
DNS=9.9.9.9
IPv6AcceptRA=yes

[Link]
MTUBytes=1500
RequiredForOnline=yes

Apply with:

sudo systemctl enable --now systemd-networkd
sudo networkctl reload

# File: /etc/network/interfaces
source /etc/network/interfaces.d/*

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
    address 192.168.1.50/24
    gateway 192.168.1.1
    dns-nameservers 192.168.1.1 9.9.9.9
    mtu 1500

Apply with:

sudo systemctl restart networking

7. Next Steps

With interface and routing management fully operational, examine how Linux applications resolve domain names and how to systematically diagnose connectivity failures from the ground up:

DNS Resolution & Bottom-Up Troubleshooting

Explore glibc NSS lookup mechanics (nsswitch.conf), systemd-resolved, dig tracing, and a deterministic Layer 1–7 troubleshooting matrix.

DNS & Troubleshooting Guide

The Modern iproute2 Suite in Daily Operations: ip, ss, Netlink & Persistent Interfaces

1. Why net-tools Is Dead: The Netlink Architecture

2. Definitive Legacy vs. Modern Command Substitution Matrix

3. Daily Operations with the ip Command

1. Link Layer Management: ip link

2. Network Layer Management: ip addr

3. Kernel Routing Management: ip route

4. Neighbor Discovery & ARP Management: ip neigh

4. High-Performance Socket Inspection with ss