Interfaces

Overview

A Linux machine connects to networks through network interfaces — the software representations of its network connections. Knowing how to inspect interfaces is the starting point for all Linux networking and diagnostics. This lesson explains interfaces and how to view them.

Learning objectives

• Define a network interface.
• Inspect interfaces and their addresses.
• Recognize the loopback and common interface names.

Core concept

A network interface is Linux's representation of a network connection — physical (Ethernet, Wi-Fi) or virtual (loopback, VPN, containers). Each interface can have an IP address, a MAC address, and a state (up/down). Common names:

• lo — the loopback interface (127.0.0.1), the machine talking to itself.
• eth0, enp3s0 — Ethernet interfaces (naming varies by scheme).
• wlan0, wlp2s0 — wireless interfaces.

The modern tool to inspect them is ip (e.g. ip addr), replacing the older ifconfig.

How it works

Running ip addr (or ip a) lists every interface with its addresses and state. Each interface bridges the system to a network: the kernel sends and receives packets through it based on the routing table (next lesson). The loopback interface always exists and lets local services communicate with each other via 127.0.0.1 without touching a real network. An interface must be up and have an appropriate address to carry traffic.

Practical example

$ ip addr
1: lo: <LOOPBACK,UP> ...
    inet 127.0.0.1/8 scope host lo
2: enp3s0: <BROADCAST,MULTICAST,UP> ...
    inet 192.168.1.50/24 brd 192.168.1.255 scope global enp3s0

lo is the loopback (127.0.0.1), and enp3s0 is an Ethernet interface with address 192.168.1.50/24, in the UP state — so this machine is reachable on the LAN at that address. (ip link shows just the link/state layer.)

Cybersecurity relevance

Interface inspection is a first step in understanding a host's network exposure: which addresses it has, which networks it is attached to, and whether unexpected interfaces exist (e.g. a VPN, a bridge, or a rogue virtual interface). During assessment or incident response, ip addr reveals how a machine connects and what its addresses are — essential context before analyzing traffic or reachability. An interface in promiscuous mode (relevant to packet capture) is also visible here.

Common mistakes

• Using deprecated ifconfig habits instead of the modern ip command (though ifconfig may still exist).
• Forgetting the loopback interface (lo/127.0.0.1) is for local-only communication.
• Overlooking an interface's state — a down interface carries no traffic despite having a name.

Key takeaways

• A network interface represents a network connection (physical or virtual), with an IP, MAC, and up/down state.
• Inspect interfaces with ip addr/ip a (modern replacement for ifconfig); lo is loopback (127.0.0.1), eth*/en* Ethernet, wl* wireless.
• Interface inspection reveals a host's addresses and network exposure — key context for diagnostics, assessment, and packet capture.

Check your understanding

• What is the loopback interface, and what address is it associated with?
• Which modern command lists a Linux system's interfaces and their IP addresses?