Inspect and Safely Change Network Links with ip link

A typo in a device name is all it takes for ip link to change the wrong interface instead of reading the one you meant. This guide builds a small, safe workflow: inspect interfaces, create and remove a disposable virtual Ethernet link, and change an MTU with a rollback you can actually use.

The examples match iproute2 6.1.0, package version 6.1.0-1ubuntu6.4. Allow about fifteen minutes. You need a shell; the state-changing examples also need elevated privileges and the CAP_NET_ADMIN capability.

1. Identify the command and the current links

Start with what is actually installed:

$ ip -V
ip utility, iproute2-6.1.0, libbpf 1.3.0
$ dpkg-query -W -f='${Package} ${Version}\n' iproute2
iproute2 6.1.0-1ubuntu6.4

List every link:

$ ip link show

This is link-layer state, not IP addressing. The first field is the interface index, then the name, then flags in angle brackets, then fields like mtu, state, master and link-netnsid. Names like lo, enp0s31f6, docker0 and veth... are specific to this host: never copy a name from an example straight into a change command without checking it first.

To check one known device by name:

$ ip link show dev INTERFACE_NAME

Swap in a real name such as enp0s31f6. dev is optional for several subcommands, but keeping it makes the target easy to spot in a script. You can also narrow by type or relationship:

$ ip link show type bridge
$ ip link show type vlan
$ ip link show master BRIDGE_NAME

2. Ask ip link about its own syntax

The manpage is broad because ip link handles physical devices and a long list of virtual types. Ask the installed binary directly, then ask about one type:

$ ip link help
$ ip link help vlan

• show, add, set, delete are the main operations.
• add creates a virtual device; set changes an existing one. Different jobs, do not confuse them.
• Neither assigns an IP address. That is a separate layer, handled by ip-address(8).

3. Create a disposable veth pair

A veth pair is two connected virtual Ethernet interfaces, useful for local testing without touching a physical cable. Creating one still changes kernel state, so use sudo and a name unlikely to collide:

$ sudo ip link add veth-demo-a type veth peer name veth-demo-b
$ ip link show dev veth-demo-a
$ ip link show dev veth-demo-b

Both devices should appear, normally down until you bring them up explicitly. This example does not move either end into another namespace, and adds no addresses, routes or firewall rules.

Remove one end when you are done, its peer goes with it:

$ sudo ip link delete dev veth-demo-a
$ ip link show dev veth-demo-a
Device "veth-demo-a" does not exist.

That second lookup failing is the expected outcome. Keeping the pair for another test? Skip the delete and just record the names, and check before deleting a similarly named device that it is really the one you created.

4. Change an MTU, then put it back

Changing an MTU can interrupt traffic and affect anything flowing through a bridge or tunnel. Record the current value first. This example targets a placeholder, so replace the name before you copy it anywhere:

$ ip link show dev INTERFACE_NAME
$ sudo ip link set dev INTERFACE_NAME mtu 1400
$ ip link show dev INTERFACE_NAME

Use a value the device and the path beyond it actually support. Success is usually silent, the second show is your verification. Restore the value you actually recorded, not a guessed default:

$ sudo ip link set dev INTERFACE_NAME mtu 1500
$ ip link show dev INTERFACE_NAME

A device carrying VLAN or tunnel traffic may need something other than 1500, and changing it on a busy service can drop packets. If NetworkManager, systemd-networkd or another manager owns the link, it can silently overwrite your manual change later, so make persistent changes in that manager's configuration instead.

5. Create a VLAN only once the parent is confirmed

The manpage's representative form:

$ sudo ip link add link PARENT_DEVICE name VLAN_DEVICE type vlan id VLAN_ID

Swap in the real lower device, a new name such as enp0s31f6.10, and the numeric VLAN ID. Verify the parent first:

$ ip link show dev PARENT_DEVICE
$ sudo ip link add link PARENT_DEVICE name VLAN_DEVICE type vlan id VLAN_ID
$ ip link show dev VLAN_DEVICE

This creates the link but leaves it down with no address. Made it by mistake? Remove exactly that device:

$ sudo ip link delete dev VLAN_DEVICE
$ ip link show dev VLAN_DEVICE
Device "VLAN_DEVICE" does not exist.

6. Bring a test link up, then diagnose failures

The disposable veth pair lets you change operational state without a physical link involved:

$ sudo ip link add veth-demo-a type veth peer name veth-demo-b
$ sudo ip link set dev veth-demo-a up
$ sudo ip link set dev veth-demo-b up
$ ip link show dev veth-demo-a
$ ip link show dev veth-demo-b

Flags should include UP. Take the pair down before deleting it, if you want the sequence spelled out:

$ sudo ip link set dev veth-demo-a down
$ sudo ip link set dev veth-demo-b down
$ sudo ip link delete dev veth-demo-a

• "Operation not permitted": check both privilege and the CAP_NET_ADMIN capability.
• "Cannot find device": re-check ip link show for the exact name, spelling and case included.
• "Already exists": inspect the existing device before deciding it is a leftover test link versus something in use.
• Moving to a namespace: loopback, bridges and wireless devices have restrictions the manpage documents; it points to ethtool for the netns-local flag.