Malwarebytes - Cybersecurity for Everyone

Linux ifconfig Cheat Sheet: Commands, MTU, MAC & PROMISC

byShubham Chaudhary •November 02, 2026

0

Linux terminal showing ifconfig output with interface flags, MTU, MAC address and PROMISC mode, next to ip command equivalents

Linux ifconfig Command Cheat Sheet: Interface Checks, Promiscuous Mode, and ip Alternatives for SOC Teams

Last verified: November 2, 2026

Picture a 2 a.m. alert on a Linux server that normally does nothing exciting. The host has no new logins and no new services, but an analyst runs ifconfig -a and sees one extra word in the interface flags: PROMISC. Someone, or something, put that network card into promiscuous mode. It might be an administrator running a packet capture, or it might be a sniffer that nobody approved. (This is an illustrative scenario, not a specific incident.)

What ifconfig Is and Why It Is Deprecated

ifconfig belongs to the legacy net-tools package. Modern distributions have moved to iproute2 (the ip command), and many minimal installs no longer include net-tools by default. You will still meet ifconfig on older servers, in training labs, in runbooks written years ago, and in muscle memory.

Two rules keep you out of trouble:

Changes are temporary. Anything set with ifconfig lasts until a reboot or until the network manager rewrites it. Persistent settings belong in your distro's network configuration.
Replace eth0 with your real interface name. Names like ens33, enp0s3, or wlan0 are common on current systems.

Installing ifconfig on Linux

If the command is missing, install net-tools:

# Debian / Ubuntu
sudo apt update
sudo apt install net-tools

# Fedora
sudo dnf install net-tools

# RHEL / Rocky / AlmaLinux
sudo dnf install net-tools

# Arch Linux
sudo pacman -S net-tools

# Verify installation
ifconfig -a

Expected output: a list of interfaces with flags, addresses, and packet counters. If you see "command not found," the package is not installed or /sbin is not in your PATH.

Inspecting Interfaces

Start with read-only commands. They are safe on production systems.

ifconfig
ifconfig -a
ifconfig eth0
ifconfig lo
ifconfig --help
ifconfig -V
man ifconfig

ifconfig shows active interfaces only.
ifconfig -a shows all interfaces, including those that are down. This matters in investigations, because a down interface can still tell you what hardware or virtual adapters exist.
ifconfig eth0 narrows the view to one interface.
ifconfig lo shows the loopback interface.

What to read in the output: the flags line (UP, BROADCAST, RUNNING, MULTICAST, and sometimes PROMISC), the IPv4 and IPv6 addresses, the MAC address next to ether, the MTU, and the RX/TX packet, error, and dropped counters.

The modern equivalents:

ip -br addr
ip -s link

ip -br addr gives a compact one-line-per-interface summary. ip -s link adds detailed statistics.

Configuring IP, MTU, and MAC (Temporary Changes)

Warning: Disabling an interface or clearing its address on a remote system can cut off your SSH session. Never touch a remote management interface without out-of-band or console access.

Enable or Disable an Interface

sudo ifconfig eth0 up
sudo ifconfig eth0 down

# Modern alternatives
sudo ip link set eth0 up
sudo ip link set eth0 down

Leave the loopback interface (lo) alone unless you have a specific lab reason. Many local services depend on it.

Assign an IPv4 Address

# Address only
sudo ifconfig eth0 192.168.1.10

# Address with netmask
sudo ifconfig eth0 192.168.1.10 netmask 255.255.255.0

# Address with CIDR prefix
sudo ifconfig eth0 192.168.1.10/24

# Address, netmask and broadcast
sudo ifconfig eth0 192.168.1.10 netmask 255.255.255.0 broadcast 192.168.1.255

# Assign and enable in one step
sudo ifconfig eth0 192.168.1.10 netmask 255.255.255.0 up

# Modern alternative
sudo ip addr add 192.168.1.10/24 dev eth0

Always verify afterward with ifconfig eth0. Note that ip addr add adds an address alongside existing ones, while ifconfig typically sets the primary IPv4 address.

Remove or Clear an Address

sudo ifconfig eth0 0.0.0.0
sudo ip addr flush dev eth0
ip addr show dev eth0

Caution: ip addr flush removes every address on the interface, which is why it is more explicit and more disruptive. Double-check the interface name first.

Broadcast and Point-to-Point Settings

sudo ifconfig eth0 broadcast 192.168.1.255
sudo ifconfig eth0 dstaddr 192.168.1.20
sudo ip addr add 192.168.1.10/24 brd 192.168.1.255 dev eth0

For tunnel interfaces such as VPN endpoints:

sudo ifconfig tun0 10.0.0.1 pointopoint 10.0.0.2
sudo ifconfig tun0 up
ifconfig tun0
ip -d link show tun0

Change the MTU

ifconfig eth0
sudo ifconfig eth0 mtu 1500
sudo ifconfig eth0 mtu 9000   # jumbo frames, only if every device on the path supports it
sudo ip link set dev eth0 mtu 1500

A mismatched MTU is a classic cause of "it pings but large transfers hang" tickets. Set jumbo frames only on networks designed for them.

Change the MAC Address (Authorized Testing Only)

Changing a MAC address is legitimate in lab environments, for testing network access controls you own, and for some privacy configurations. Record the original hardware address first, because it is not always recoverable afterward.

sudo ifconfig eth0 down
sudo ifconfig eth0 hw ether 00:11:22:33:44:55
sudo ifconfig eth0 up
ifconfig eth0

# iproute2 alternative
sudo ip link set dev eth0 down
sudo ip link set dev eth0 address 00:11:22:33:44:55
sudo ip link set dev eth0 up

Only do this on networks and systems you are authorized to administer. For defenders, the more important point is the reverse: a MAC address alone is a weak identity signal, so do not treat it as proof of which device you are looking at.

Promiscuous Mode and ALLMULTI: What Analysts Should Know

Normally a network card hands the operating system only frames addressed to its own MAC address, plus broadcast and subscribed multicast traffic. Promiscuous mode tells the card to pass up frames not addressed to it. Packet capture tools rely on this.

sudo ifconfig eth0 promisc
sudo ifconfig eth0 -promisc
ifconfig eth0

# Modern alternatives
sudo ip link set dev eth0 promisc on
sudo ip link set dev eth0 promisc off

An important accuracy note: promiscuous mode does not automatically expose all network traffic. What an interface can actually see depends on hardware, driver, network topology, and switch configuration. On a modern switched network, a promiscuous host mostly still sees its own traffic plus broadcast and multicast, unless the switch mirrors ports or the host sits in a shared segment.

ALLMULTI is a related but narrower setting that accepts all multicast packets:

sudo ifconfig eth0 allmulti
sudo ifconfig eth0 -allmulti

# Modern alternative
sudo ip link set dev eth0 allmulticast on
sudo ip link set dev eth0 allmulticast off

Checking for Unexpected Promiscuous Mode

This is the detection habit worth building. Check the flags, then corroborate:

ifconfig -a | grep -i promisc
ip -d link show | grep -i promiscuity
dmesg | grep -i promisc

What you are looking for: the PROMISC flag in ifconfig output, a promiscuity counter above zero in ip -d link output, and kernel log lines noting a device entering promiscuous mode. Capture tools, container networking, and bridges can all legitimately trigger this. The goal is not to assume malice. The goal is to ask whether you can explain why it is on, and which process turned it on. Pair the finding with ss -antup and a process review to identify the owner.

Network Troubleshooting Workflow

When a ticket says "the server can't reach anything," work from the bottom of the stack upward:

# 1. Is the interface present and up?
ifconfig -a

# 2. Correct IP and netmask?
ifconfig eth0

# 3. Routes and neighbors
route -n
arp -n
ip route
ip neigh

# 4. Gateway and internet reachability
ping -c 4 192.168.1.1
ping -c 4 1.1.1.1

# 5. DNS resolution
getent hosts example.com

# 6. Listening ports and connections
ss -tulnp

# 7. Path to an external host
traceroute 8.8.8.8

The logic is simple. If the gateway ping fails, you have a local or layer 2 problem. If the gateway answers but 1.1.1.1 does not, look at routing or upstream. If IP connectivity works but name lookups fail, the problem is DNS. This sequence keeps you from chasing the wrong layer.

For error and drop counters, use:

ip -s link show eth0
cat /proc/net/dev
watch -n 2 'ip -s link show eth0'

Rising error or dropped counts point to cabling, duplex mismatches, driver problems, or saturation.

SOC and DFIR Network Investigation Snapshot

During an investigation, volatile network state disappears quickly. A single timestamped snapshot gives you something to preserve, compare, and attach to the case. This block records interfaces, addresses, routes, neighbors, and sockets into one file:

{
date -Is
echo "===== IFCONFIG ====="
ifconfig -a
echo "===== ADDRESSES ====="
ip addr show
echo "===== ROUTES ====="
ip route show table all
echo "===== NEIGHBOURS ====="
ip neigh show
echo "===== SOCKETS ====="
ss -antup
} | tee "ifconfig-investigation-$(date +%Y%m%d-%H%M%S).txt"

Expected output: your terminal shows each section as it runs, and a file named like ifconfig-investigation-20261102-021500.txt is saved in the current directory. Write it to evidence storage you control, not to the possibly compromised host's own disk when you can avoid it, and note the collection time and collector in your case record.

Automation and Output Handling

# Save all interface information
ifconfig -a > interfaces.txt

# Save one interface
ifconfig eth0 > eth0-details.txt

# Extract interface names
ifconfig -a | grep -E '^[a-zA-Z0-9_.:-]+:'

# Extract MAC addresses
ifconfig -a | grep -i 'ether'

# Extract IPv4 and IPv6 addresses
ifconfig -a | grep -i 'inet '
ifconfig -a | grep -i 'inet6'

To record interface state over time (stop with Ctrl+C):

while true; do
date -Is
ifconfig -a
sleep 10
done

The output format of ifconfig varies slightly between net-tools versions, so test any grep patterns on your own systems before building automation around them. For anything long-lived, prefer ip with its more consistent output options.

Modern iproute2 Alternatives

Task	ifconfig	ip
Show interfaces	`ifconfig -a`	`ip link` / `ip -br addr`
Show addresses	`ifconfig eth0`	`ip addr show dev eth0`
Enable interface	`ifconfig eth0 up`	`ip link set eth0 up`
Disable interface	`ifconfig eth0 down`	`ip link set eth0 down`
Assign IPv4	`ifconfig eth0 192.168.1.10/24`	`ip addr add 192.168.1.10/24 dev eth0`
Change MTU	`ifconfig eth0 mtu 1500`	`ip link set dev eth0 mtu 1500`
Change MAC	`ifconfig eth0 hw ether MAC`	`ip link set dev eth0 address MAC`
Promiscuous on/off	`ifconfig eth0 promisc` / `-promisc`	`ip link set dev eth0 promisc on\|off`
Statistics	`ifconfig eth0`	`ip -s link`

Expert Tips

Record before you change. Save ifconfig -a output before touching an interface, so you can restore the original MAC, MTU, and addresses.
Know your network manager. On systems running NetworkManager or systemd-networkd, manual changes may be overwritten without warning. That is often a feature, not a bug.
Baseline your fleet. A PROMISC flag is only suspicious if you know what normal looks like. Document which hosts legitimately run captures, bridges, or container networking.
Use ifconfig for quick looks, ip for scripts. Learn both, but write new automation with iproute2.
Preserve evidence early. Network state is volatile. Snapshot first, investigate second.
Do not rely on one signal. Combine interface flags, kernel logs, socket lists, and process data before drawing conclusions.

Linux ip Command Cheat Sheet: Spot Rogue Routes & ARP Spoofing
Linux Networking Commands Cheat Sheet: ip, ss, nmap (2026)
SBI CyRIS Cybersecurity Centre of Excellence: Full Breakdown
Linux pstree Command Cheat Sheet: Spot Suspicious Processes Fast
Linux pgrep Command Cheat Sheet: Find Suspicious Processes Fast
Linux pmap Command Cheat Sheet: 40 Examples for Memory Analysis
Capcom Data Breach: 11.77M Records Exposed – Are You Safe?
VeloCloud Orchestrator Flaw: Read-Only Login Gives Superuser

FAQ

Is the ifconfig command deprecated?

Yes. It is part of the legacy net-tools package, and the iproute2 ip command is the modern replacement. ifconfig still works wherever net-tools is installed.

Why does "ifconfig: command not found" appear?

Most current distributions no longer install net-tools by default. Install it with your package manager, or use ip addr and ip link instead. Also check that /sbin is in your PATH.

Are changes made with ifconfig permanent?

No. They are temporary and are lost on reboot or when the network service reapplies its configuration.

How do I check whether an interface is in promiscuous mode?

Run ifconfig -a | grep -i promisc, or check for a promiscuity value above zero in ip -d link show output. Kernel logs via dmesg often record the change as well.

Does promiscuous mode let a host see all network traffic?

Not automatically. Visibility depends on hardware, drivers, topology, and switch configuration, such as port mirroring.

What is the difference between ifconfig -a and ifconfig?

Plain ifconfig lists only active interfaces. Adding -a includes interfaces that are currently down.

Conclusion

ifconfig may be a legacy tool, but the questions it answers are timeless: what interfaces exist, what addresses and MACs do they carry, and has anything changed their behavior? Learn the read-only commands first, treat every configuration change as temporary and potentially disruptive, and build the habit of capturing a snapshot before you act. Pair it with the ip equivalents and you will be ready for both legacy servers and modern fleets, from routine troubleshooting to a 2 a.m. PROMISC alert.

Analysis based on SOC monitoring experience and review of standard Linux networking documentation.