Reading the output: what every line means
The tools print numbers. This page explains what the numbers mean, so that you can look at any interface on any system and know whether it is healthy, where it sits on the network, and what kind of address it has.
IPv4 addresses
An IPv4 address is 32 bits written as four decimal numbers from 0 to 255, separated by dots. Which range it falls in tells you a lot before you look at anything else.
| Range | CIDR | What it means when you see it |
|---|---|---|
| 10.0.0.0 – 10.255.255.255 | 10.0.0.0/8 | Private (RFC 1918). Corporate LANs, VPNs, cloud VPCs, some ISP routers. |
| 172.16.0.0 – 172.31.255.255 | 172.16.0.0/12 | Private (RFC 1918). Docker (172.17), WSL (172.2x–172.3x), many cloud networks. Note: 172.32+ is not private. |
| 192.168.0.0 – 192.168.255.255 | 192.168.0.0/16 | Private (RFC 1918). Almost every home router. |
| 169.254.0.0 – 169.254.255.255 | 169.254.0.0/16 | Link-local / APIPA. Self-assigned because DHCP failed. Not routable. Diagnose → |
| 127.0.0.0 – 127.255.255.255 | 127.0.0.0/8 | Loopback. 127.0.0.1 is localhost. Ubuntu/Debian also put the hostname on 127.0.1.1. |
| 100.64.0.0 – 100.127.255.255 | 100.64.0.0/10 | Carrier-grade NAT (RFC 6598). If your router's WAN address is here, your ISP shares one public IP among many customers and port forwarding will not work. Tailscale also uses this range internally. |
| 0.0.0.0 | 0.0.0.0/0 | No address / any address. As a route destination it means "default". A server listening on 0.0.0.0 accepts on all interfaces. |
| 224.0.0.0 – 239.255.255.255 | 224.0.0.0/4 | Multicast. Appears in routing tables and ARP caches (224.0.0.251 is mDNS). Never an interface address. |
| 255.255.255.255 | Limited broadcast. | |
| 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 | Documentation ranges (RFC 5737). Used in examples on this site; never real. | |
| Anything else | Public. Directly routable on the internet. If an interface has one, the machine is directly connected without NAT (rare at home, normal on servers). |
Subnet masks and CIDR
The mask says which leading bits of the address identify the network. Windows and ifconfig show it as dotted decimal; ip and most documentation use the CIDR suffix (the count of network bits); macOS and BSD ifconfig use hexadecimal. They are the same information.
| CIDR | Dotted mask | Hex (BSD) | Usable hosts | Typical use |
|---|---|---|---|---|
| /8 | 255.0.0.0 | 0xff000000 | 16,777,214 | Whole 10.0.0.0 network; loopback |
| /16 | 255.255.0.0 | 0xffff0000 | 65,534 | Large corporate LAN; Docker default bridge; 169.254 |
| /20 | 255.255.240.0 | 0xfffff000 | 4,094 | WSL vEthernet; cloud subnets |
| /22 | 255.255.252.0 | 0xfffffc00 | 1,022 | Office networks |
| /23 | 255.255.254.0 | 0xfffffe00 | 510 | Mid-size LAN |
| /24 | 255.255.255.0 | 0xffffff00 | 254 | Home and small office; the most common |
| /25 | 255.255.255.128 | 0xffffff80 | 126 | |
| /26 | 255.255.255.192 | 0xffffffc0 | 62 | |
| /27 | 255.255.255.224 | 0xffffffe0 | 30 | Small server blocks |
| /28 | 255.255.255.240 | 0xfffffff0 | 14 | |
| /29 | 255.255.255.248 | 0xfffffff8 | 6 | Business broadband static blocks |
| /30 | 255.255.255.252 | 0xfffffffc | 2 | Point-to-point links |
| /31 | 255.255.255.254 | 0xfffffffe | 2 | Point-to-point (RFC 3021) |
| /32 | 255.255.255.255 | 0xffffffff | 1 | A single host; loopback aliases; VPN client addresses |
Two hosts can talk directly only if they are in the same network, which means their addresses match on every bit where the mask is 1. 192.168.1.42/24 and 192.168.1.200/24 are neighbours. 192.168.1.42/24 and 192.168.2.10/24 are not, and need a router between them even if they are plugged into the same switch. A mask mismatch between two machines is a classic cause of "I can ping some devices but not others".
The broadcast address is the network with all host bits set to 1: for 192.168.1.0/24 it is 192.168.1.255. The network address has all host bits 0 and is not assignable to a host.
IPv6 addresses
An IPv6 address is 128 bits written as eight groups of four hex digits separated by colons. Leading zeros in a group can be dropped, and one run of all-zero groups can be replaced by ::. So 2001:0db8:0000:0000:0000:0000:0000:0001 is written 2001:db8::1.
IPv6 address types you will see
| Starts with | Type | What it means |
|---|---|---|
fe80:: | Link-local | Every IPv6 interface has one, always, generated automatically. Only valid on the local segment. Used for router discovery, neighbour discovery and as the IPv6 default gateway address. Written with a zone ID: fe80::1%12 (Windows) or fe80::1%eth0 (Unix). |
2000:: to 3fff:: (most often 2a0x:, 2001:, 2600:) | Global unicast | Publicly routable. If you have one, you have working IPv6 from your ISP and there is no NAT: this address is reachable from the internet (subject to your firewall). |
fc00:: / fd00:: | Unique local (ULA) | The IPv6 equivalent of private addresses. Some routers (Fritz!Box, OpenWrt, Windows Internet Connection Sharing) hand these out even without ISP IPv6. |
::1 | Loopback | localhost. |
:: | Unspecified | No address; "any" when listening. |
::ffff:192.168.1.42 | IPv4-mapped | An IPv4 connection seen through a dual-stack socket. Common in server logs. |
2001:0:: | Teredo | IPv4-tunnelled IPv6 from the Windows Teredo adapter. Largely defunct. |
2002:: | 6to4 | Another legacy tunnel type. Deprecated. |
fec0:: | Site-local | Deprecated in 2004; only seen on very old systems. |
ff02::1, ff02::2 | Multicast | All nodes / all routers on the link. Appear in neighbour tables and routing output. |
Why there are several global addresses
Windows shows IPv6 Address and Temporary IPv6 Address; ip shows one marked mngtmpaddr and others marked temporary; macOS shows secured and temporary. The story:
- SLAAC (stateless address autoconfiguration) builds an address from the network prefix advertised by the router plus a 64-bit interface identifier. Originally the identifier was derived from the MAC (EUI-64), which made every device trackable across networks. Windows, macOS and modern Linux now generate a stable random identifier instead (RFC 7217). That is the "IPv6 Address" / "secured" / "mngtmpaddr" one: stable for this network, used for inbound connections.
- Temporary addresses (RFC 8981 privacy extensions) are generated randomly, used for outbound connections, and rotated roughly daily. Old ones linger as Deprecated for a while so existing connections survive. Seeing three or four global addresses on one interface is normal.
- DHCPv6 addresses (marked
dynamicon Linux, from the DHCPv6 Client DUID on Windows) are assigned by a server, usually on corporate networks. Home routers rarely use stateful DHCPv6.
The zone ID (%12, %eth0, %en0)
Because every interface has an fe80:: address and they may even collide, the operating system needs to know which interface you mean. Windows uses the interface index (visible at the top of route print or via Get-NetAdapter | select ifIndex); Unix uses the name. ping fe80::1%12 on Windows, ping fe80::1%eth0 on Linux. In URLs, the percent must be encoded: http://[fe80::1%25eth0]/.
Prefix lengths
Interfaces are almost always /64. Your ISP typically delegates a /56 or /48 to your router, which carves out /64s per LAN. A /128 is a single host address, as seen on loopback and VPN tunnels.
MAC addresses
The hardware address of an Ethernet or Wi-Fi interface: 48 bits, six bytes. Formats differ by platform but the value is identical.
| Format | Example | Where |
|---|---|---|
| Hyphens, upper case | 8C-16-45-3A-9B-2D | Windows ipconfig, getmac, arp |
| Colons, lower case | 8c:16:45:3a:9b:2d | Linux, macOS, BSD, most of the world |
| Dotted triplets | 8c16.453a.9b2d | Cisco IOS |
| No separators | 8C16453A9B2D | Some DHCP servers, PowerShell New-NetNeighbor |
The first three bytes are the OUI (organisationally unique identifier), assigned to the manufacturer; searching for it tells you who made the device, which is how router admin pages label your devices as "Apple" or "Samsung". Some well-known prefixes: 00:50:56 and 00:0c:29 VMware; 08:00:27 VirtualBox; 00:15:5d Hyper-V; 02:42:ac Docker; 52:54:00 QEMU/KVM; b8:27:eb, dc:a6:32 and e4:5f:01 Raspberry Pi. If the second hex digit of the first byte is 2, 6, A or E, the address is locally administered: randomised (phones, macOS 15, Windows "random hardware addresses"), cloned, or virtual. If the lowest bit of the first byte is 1 (first byte odd), it is a multicast address, which is why 01:00:5e:… appears in ARP tables for IPv4 multicast and 33:33:… for IPv6.
The MAC is only ever visible on the local segment. Websites and your ISP cannot see it. Routers see the MAC of the previous hop only.
DHCP lease fields
| Field | Windows | Linux ip | macOS ipconfig getpacket | Meaning |
|---|---|---|---|---|
| Lease obtained | Lease Obtained | (derive from valid_lft) | lease start time (getsummary) | When the current lease began |
| Lease expires | Lease Expires | valid_lft NNNsec | lease_time | When it ends. Clients renew at 50% (T1) and rebind at 87.5% (T2) automatically. |
| DHCP server | DHCP Server | networkctl status | server_identifier | Who gave the lease. Should be your router or your organisation's DHCP server. |
| Client identifier | DHCPv6 Client DUID / (IPv4 uses MAC) | dhclient.leases | chaddr | How the server recognises you; reservations are keyed on it |
| Options | DNS Servers, Connection-specific DNS Suffix, Default Gateway | resolvectl / ip route | router, domain_name_server, domain_name | Extra settings supplied with the lease: 3 router, 6 DNS, 15 domain, 42 NTP, 119 search list, 121 classless routes, 252 WPAD proxy |
A lease with a very short lifetime (minutes) is usually a captive portal or a guest network. A lease that has expired but is still shown means the client could not reach the server to renew; you are living on borrowed time.
Interface state words
| You see | Tool | Meaning |
|---|---|---|
| Media disconnected | Windows | No link. Cable, port, Wi-Fi association or disabled adapter. |
| Media State: Media disconnected + adapter exists | Windows | The adapter is enabled, just not connected. |
| UP, RUNNING | ifconfig | Enabled and link is up. Healthy. |
| UP without RUNNING | ifconfig (Linux) | Enabled, no link. |
| UP, LOWER_UP | ip | Enabled and link is up. |
| NO-CARRIER | ip | Enabled, no link. |
| state DOWN | ip | Administratively disabled (ip link set X up to fix). |
| state UNKNOWN | ip | Driver does not report carrier; normal for lo, tun, WireGuard. |
| DORMANT | ip | Link up but waiting for authentication (802.1X, Wi-Fi WPA). |
| status: active / inactive | macOS/BSD | Link up / no link. |
| connected / disconnected / unavailable / unmanaged | nmcli | NetworkManager state; unavailable often means no carrier or rfkill; unmanaged means NM has been told to ignore it. |
| routable / degraded / carrier / no-carrier / off | networkctl | systemd-networkd operational state; degraded means only link-local addresses. |
| up / up | Cisco | Status up, protocol up: working. |
| up / down | Cisco | Enabled but no link or keepalive failure. |
| administratively down | Cisco | Shut down in configuration. |
MTU
The maximum transmission unit is the largest packet the interface will send without fragmenting. Ethernet is 1500. PPPoE (most UK FTTC/FTTP via BT Openreach) is 1492. Many VPNs are 1400 to 1420; WireGuard defaults to 1420. Jumbo frames are 9000. If the MTU on the path is smaller than the endpoints think, large packets vanish while small ones work: SSH connects but hangs on output, web pages half-load, uploads stall. Test with a don't-fragment ping: 1472 bytes of payload plus 28 bytes of headers is exactly 1500. MTU troubleshooting →
DNS suffixes and search lists
When you type ping printer, the resolver tries printer plus each suffix in the search list before giving up: printer.home, printer.corp.example.com. The Connection-specific DNS Suffix is the one supplied by DHCP on that adapter; the Primary Dns Suffix comes from domain membership. Linux keeps the equivalent in the search line of resolv.conf or resolvectl domain. The .local suffix is special: it is resolved by mDNS (Bonjour, Avahi), not by DNS, which is why mymac.local works on a LAN without any DNS server.
Metrics
When two interfaces both offer a default route, the metric picks the winner: lower wins. Windows computes an automatic metric from link speed (25 for gigabit Ethernet, 50 for Wi-Fi at some speeds, 35 for others) and you can override it per interface. NetworkManager uses 100 for wired and 600 for Wi-Fi. If your laptop is on Wi-Fi and Ethernet simultaneously and traffic goes the slow way, the metrics are the thing to check.
Related pages
- ipconfig reference with annotated output
- ifconfig reference with flag table
- ip reference with address flags and lifetimes
- Glossary