How to understand (the output of) ifconfig or ip addr show

Question

The ifconfig command dumps a lot of information at you, especially if you have a lot of interfaces, and you don't know where they come from. I've read through the "Ifconfig Command - Explained in Detail" tutorial page, which gives a great rundown on most of the information in ifconfig. But it doesn't contain all the information I want (and the article could also be outdated after its release in 2006).

Using ip addr show eth0:

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
   link/ether 08:00:27:e2:80:18 brd ff:ff:ff:ff:ff:ff
   inet 10.0.2.15/24 brd 10.0.2.255 scope global eth0 valid_lft forever preferred_lft forever

---

I find it tough to parse some of the output.

• Under eth0:
  • <…> describes… the interface capabilities? Uncertain where I can find the full set of options, uncertain what they're called, no idea what to google. What're the other options?
  • state UP – I know there's also state DOWN and state RUNNING. These are all software constructs, right? Nothing is physically changing when I run ip link set dev eth0 down, right? So how does the kernel act differently when this state changes? Does this state change?
  • group default – interface groups. What is the unique problem they solve?
• Under inet
  • What does scope global mean? – How can a private IP have a global scope? What am I missing?

---

What is the grammar of this command's output?

Answer 1

Here are the parts that I can already parse, for reference for anyone else with the same question.

• eth0 is the interface name. It can be any string:
  • mtu 1500 maximum transmission unit = 1500 bytes, this is the largest size that a frame sent over this interface can be. This number is usually limited by the Ethernet protocol's cap of 1500. If you send a larger packet and it arrives at an Ethernet interface, then the frame will get fragmented and its payload transmitted in two or more packets. Not really any benefit to that, so it's best to follow standards.
  • qdisc pfifo_fast queuing discipline = three pipes of first in first out. This determines how an interface chooses which packet to transmit next, when it's being overloaded.
  • group default Interface groups give a single interface to clients by combining the capabilities of the aggregated interfaces on them.
  • qlen 1000 transmission queue length = 1000 packets. The 1000th packet will be queued, the 1001st will be dropped.
• link/ether means the link layer protocol is Ethernet:
  • brd means broadcast. This is the address that the device will set as the destination when it sends a broadcast. An interface sees all traffic on the wire it's sitting on, but is polite enough to only read data addressed to it. The way you address an interface is by using its specific address, or the broadcast address.
• inet means the network layer protocol is internet (ipv4). inet6 would mean IPv6.
  • lft stands for lifetime. If you get this address through DHCP, then you'll have a valid lifetime for your lease on the IP address. And just to make handoffs a little bit easier, a (probably) shorter preferred lifetime.

Answer 2

Addresses with global scope are global from the point of view of the host, i.e. they are not restricted to the host or the local link. The host does not care, and does nothing different, in the case the address falls within the ranges specified in RFC1819 (Address Allocation for Private Internets). The "private" addresses are private only by convention. The host does not care which router does NAT, and how many hops away from the host the address translation from private to public addresses is done. Besides, you can implement NAT with other addresses too.