Identify MAC and IP Addresses in Linux

Introduction

In this lab, you will learn how to identify essential network addressing information on a Linux system using the modern and powerful ip a command. The primary goal is to become proficient at inspecting your system's network interfaces and locating specific details within the command's output, including MAC addresses, IPv4 addresses, and IPv6 addresses.

You will start by executing the ip a command to display a comprehensive overview of all network interfaces, such as the loopback (lo) and primary Ethernet (eth0) interfaces. Following this, you will learn to parse the detailed output to pinpoint the link/ether line for the MAC address, the inet line for the IPv4 address, and the inet6 line for the IPv6 address, solidifying your understanding of fundamental Linux network analysis.

Display All Network Interface Information with ip a

In this step, you will learn how to use the ip command, which is the modern and preferred tool for viewing and manipulating network interfaces, IP addresses, and routes on Linux systems. We will start with the most fundamental command to display information about all available network interfaces.

The command ip a is a shortcut for ip address show. It provides a comprehensive overview of your system's network configuration.

First, ensure you are in the terminal. Your default path is ~/project. Now, execute the ip a command to list all network interfaces and their associated addresses.

ip a

You will see a detailed output listing all network interfaces. Typically, you will see several interfaces:

1. lo: This is the loopback interface, a virtual network interface that the system uses to communicate with itself. It always has the IP address 127.0.0.1.
2. eth0 (or a similar name like enp0s5): This is your primary Ethernet interface, which connects your system to the external network. Notice the altname fields, which provide alternative names for the interface.
3. docker0: If Docker is installed, you might see a docker0 interface, which is a virtual bridge created by Docker for container networking.

Your output will look similar to the example below, though the specific names and addresses will differ.

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:16:3e:0e:d8:3c brd ff:ff:ff:ff:ff:ff
    altname enp0s5
    altname ens5
    inet 172.16.50.202/24 metric 100 brd 172.16.50.255 scope global dynamic eth0
       valid_lft 1892159975sec preferred_lft 1892159975sec
    inet6 fe80::216:3eff:fe0e:d83c/64 scope link
       valid_lft forever preferred_lft forever
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
    link/ether 02:42:60:7e:6f:bc brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever

Take a moment to examine the output. In the following steps, we will break down this information to identify specific details like the MAC address and IP addresses.

Find the MAC Address (link/ether)

In this step, you will learn to identify the Media Access Control (MAC) address from the output of the ip a command. The MAC address is a unique, hardware-level identifier assigned to a Network Interface Card (NIC). It's also known as the physical address and is represented as a 12-digit hexadecimal number.

In the previous step, you ran ip a and saw a lot of information. Now, let's focus on finding the MAC address. Look for your primary network interface, which is typically eth0. The MAC address is located on the line that starts with link/ether.

To make this easier, you can pipe the output of ip a into the grep command to filter for only the line containing the MAC address. The pipe symbol | takes the output of the command on its left and uses it as the input for the command on its right.

In your terminal, run the following command:

ip a | grep "link/ether"

This command will display only the lines from the ip a output that contain the string "link/ether".

You will see a much shorter output, making it easy to spot the MAC addresses. The 12 hexadecimal characters separated by colons are the MAC addresses.

    link/ether 00:16:3e:0e:d8:3c brd ff:ff:ff:ff:ff:ff
    link/ether 02:42:60:7e:6f:bc brd ff:ff:ff:ff:ff:ff

The loopback interface lo does not have a traditional MAC address, so it will not appear in this filtered output. The address 00:16:3e:0e:d8:3c is the MAC address for the eth0 interface in this example. Your address will be different but will follow the same format.

Find the IPv4 Address (inet)

In this step, you will locate the Internet Protocol Version 4 (IPv4) address. Unlike the physical MAC address, an IP address is a logical address assigned to your device for communication on a network. IPv4 addresses are the most common format, represented by four numbers separated by dots (e.g., 192.168.1.10).

Within the output of the ip a command, the IPv4 address is found on the line that begins with inet. We can use the grep command again to filter the output, just as we did for the MAC address. To avoid matching inet6, it's a good practice to include a space after inet in your search pattern.

In your terminal, execute the following command to find all IPv4 addresses configured on your system:

ip a | grep "inet "

The command will filter the output to show only the lines containing IPv4 addresses. You will typically see several: one for the loopback interface (lo), one for your main network interface (eth0), and potentially others like docker0.

    inet 127.0.0.1/8 scope host lo
    inet 172.16.50.202/24 metric 100 brd 172.16.50.255 scope global dynamic eth0
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0

From this output, you can identify multiple IPv4 addresses:

• 127.0.0.1: This is the loopback address, which the system uses to communicate with itself.
• 172.16.50.202/24: This is the primary IPv4 address for the eth0 interface, used for communicating with other devices on the network. The /24 is the CIDR notation, which defines the subnet mask for the network. Your address will be different.
• 172.17.0.1/16: This is the IPv4 address for the docker0 bridge.

Find the IPv6 Address (inet6)

In this final step, you will identify the Internet Protocol Version 6 (IPv6) address. IPv6 is the successor to IPv4 and was designed to address the eventual exhaustion of IPv4 addresses. IPv6 addresses are 128 bits long and are written in hexadecimal notation, separated by colons (e.g., 2001:0db8:85a3:0000:0000:8a2e:0370:7334).

Just like with IPv4, the ip a command displays IPv6 information. The line containing an IPv6 address is clearly marked with inet6. We will use grep one last time to isolate this information.

In your terminal, run the following command to find all IPv6 addresses on your system:

ip a | grep "inet6"

This command will show the lines containing IPv6 addresses for your interfaces.

    inet6 ::1/128 scope host
    inet6 fe80::216:3eff:fe0e:d83c/64 scope link

From this output, you can identify two IPv6 addresses:

• ::1/128: This is the compressed format for the IPv6 loopback address, equivalent to 127.0.0.1 in IPv4.
• fe80::216:3eff:fe0e:d83c/64: This is a link-local IPv6 address for the eth0 interface. Link-local addresses are automatically configured on all IPv6-enabled interfaces and are used for communication only on the same local network segment. Your address will be different.

Congratulations! You have now learned how to use the ip a command to identify the MAC address, IPv4 address, and IPv6 address on a Linux system.

Summary

In this lab, you learned how to use the ip a command to identify network addresses in Linux. You executed ip a, a modern and preferred tool for network configuration, to display comprehensive information about all network interfaces. The output revealed details for both the loopback interface (lo) and the primary Ethernet interface (eth0), providing a complete overview of the system's network setup.

By examining the output of the ip a command, you learned to locate specific network identifiers. You successfully identified the MAC address, found on the line labeled link/ether. Additionally, you located the system's IPv4 address next to the inet label and its IPv6 address next to the inet6 label, mastering the fundamental skill of retrieving essential network address information on a Linux system.