1. Introduction
As a Linux user, knowing the different types of network interfaces and how to identify them is essential. Whether we’re troubleshooting network issues or setting up a new server, understanding the characteristics of physical and virtual interfaces is a valuable skill.
In this tutorial, we’ll explore in detail what physical and virtual network interfaces are and several ways to identify them in Linux.
2. Network Interfaces
A network interface is a hardware or software component that connects a device to a network. In Linux, there are two categories of network interfaces – physical and virtual.
2.1. Physical Interfaces
Physical interfaces are hardware components that connect to a network. These include network cards, ethernet ports, fibre-optics ports, coaxial cable ports, USB modem ports, and other physical components.
When we add a physical interface to a Linux system, it’s assigned a unique identifier known as the interface name.
Examples of physical interface names include eth0, eth1, enp0s25, and ens33.
2.2. Virtual Interfaces
On the other hand, virtual interfaces are software-based components that emulate the behaviour of a physical interface.
Virtual interfaces include virtual LANs, virtual loopback interfaces, virtual tunnel interfaces, virtual WiFi interfaces and other software-based components. Also, virtualization applications and network bridge software can create virtual interfaces.
Examples of virtual interface names include virbr0, vnet0, and br0.
2.3. Physical vs. Virtual Network Interfaces
The main difference between physical and virtual network interfaces is that physical interfaces connect to a physical network, while virtual interfaces don’t. Also, physical interfaces typically have a fixed MAC address and speed, while virtual interfaces may have a dynamic MAC address and speed.
It’s important we identify the type of interface we’re working with, as both interfaces require different troubleshooting and configuration steps.
3. Displaying Current Network Interfaces
The ip command is the most popular tool in Linux to display all network interface configuration information. Let’s start by using this command to display all the network interfaces on our system:
$ ip addr show
1: eth0: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: virbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic eth0
valid_lft 86382sec preferred_lft 86382sec
inet6 fe80::5054:ff:fe12:3456/64 scope link
valid_lft forever preferred_lft forever
3: wlan0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
link/ether 52:54:00:12:34:57 brd ff:ff:ff:ff:ff:ff
inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
valid_lft forever preferred_lft forever
As we can see, this command gives us a list of our active network interfaces. We can now proceed to identify the physical and virtual interfaces.
4. Identifying Network Interface Types
Now that we have a better understanding of what physical and virtual network interfaces are, let’s explore different mechanisms for identifying them and practical examples of their usage.
4.1. Checking the /sys Directory
The simplest way we can determine if a network interface is physical or virtual is by checking the information available in the /sys directory.
To check if an interface is virtual, we can look for the presence of the virtfnX file in the /sys/class/net/INTERFACE_NAME/device/ directory.
The X in virtfnX refers to the number of the virtual function associated with the interface. If the file exists, it means that the interface is a virtual function of a physical device.
Let’s see an example command that checks if the network interface eth0 has a virtfnX file:
$ ls /sys/class/net/eth0/device/virtfn*
If the command returns one or more files, it means that eth0 or the replaced network is a virtual function of a physical device, and thus a virtual interface. Otherwise, if the command doesn’t return any file, it means that the network is a physical network interface.
We should note that not all virtual interfaces will have a virtfnX file associated with them. For example, interfaces created using virtualization technologies like Docker or Kubernetes may not have this file. In such cases, we can look for other files in the /sys/class/net/INTERFACE_NAME/ directory to determine if the interface is virtual.
These types of virtual interfaces often have a file called ifalias that contains the string virtual in its value. Let’s see an example command to see if our network interface eth0 is virtual:
$ grep -q virtual /sys/class/net/eth0/ifalias && echo "This interface is a virtual interface"
In this example, if our command outputs “This interface is a virtual interface“, it means that eth0 or the replaced network is a virtual network interface. If there is no output, it means the network is a physical interface.
4.2. Checking the /sys/class/net/ Directory
We can also use a Bash script to identify physical interfaces on Linux:
#!/bin/bash
while IFS='\n' read p1 line ;do
iface=$(echo "$p1" | sed -n 's/[0-9]: \(.*\):.*/\1/p')
if test -n $iface && ip addr show dev $iface >/dev/null 2>&1; then
if test -e /sys/class/net/${iface}/device; then
echo $iface
fi
fi
done < <(ip address)
With this script, we read the output of the ip address command, parse the interface names from it, and check if the interface exists in the /sys/class/net/ directory. If it does, we have a physical interface, and then it proceeds to list it.
Now that we understand the script, let’s save it to a file identify_physical_interfaces.sh, and make it executable with the chmod command:
$ chmod +x identify_physical_interfaces.sh
Finally, let’s run the script:
$ ./identify_physical_interfaces.sh
eth0
enp3s0
enp4s0
As we can see, there are three physical network interfaces (eth0, enp3s0, enp4s0) on our Linux system in this example.
4.3. Using the ethtool Command
ethtool is another command-line tool we can use to check whether a network interface is physical or virtual. This tool provides detailed information about the Ethernet interfaces installed on a system, including their speed, duplex settings, link status, and the driver used by the interface.
We can run the ethtool command with the -i option to list all the Ethernet interfaces on the system while replacing eth0 with the name of the interface we want to check:
$ sudo ethtool -i eth0
driver: e1000e
version: 3.2.6-k
firmware-version: 0.13-4
bus-info: 0000:00:19.0
supports-statistics: yes
supports-test: yes
supports-eeprom-access: yes
supports-register-dump: yes
supports-priv-flags: no
From this command’s output, if bus-info in our output starts with pci or 0000 as we can see in this example, then the interface is physical.
Otherwise, if it starts with virtio, veth, ens, tap, wl, or any other naming conventions and identifiers for virtual interfaces as used by different hypervisors or virtualization technologies, then it indicates a virtual interface:
$ sudo ethtool -i virbr0
driver: virtio_net
version: 1.0.0
firmware-version: N/A
bus-info: virtio0@pci:0000:00:03.0
supports-statistics: no
supports-test: no
supports-eeprom-access: no
supports-register-dump: no
supports-priv-flags: no
In this example, the virbr0 interface has the bus-info field starting with virtio0, indicating that it’s a virtual interface.
4.4. Using MAC Address
Another way we can determine whether a network interface is virtual or physical is to look at its MAC address. Physical interfaces generally have unique MAC addresses burned into their hardware, while virtual interfaces have MAC addresses that are generated by the virtualization software.
We can use the ethtool command with the -P option, followed by the interface name to check the MAC address of a network interface:
$ sudo ethtool -P ens3
Permanent address: 52:54:00:11:22:33
$ sudo ethtool -P vnet0
Permanent address: 00:00:00:00:00:00
In this example, ens3 is a physical interface with a MAC address of 52:54:00:11:22:33, while vnet0 is a virtual interface with a MAC address of 00:00:00:00:00:00.
Alternatively, we can use a Bash script loop to display the MAC address for all network interfaces. From there, we can identify which ones are virtual interfaces when we see a permanent address of 00:00:00:00:00:00:
for i in $(ip -o link show | awk -F': ' '{print $2}'); \
do
mac=$(ethtool -P $i)
printf '%-10s %-10s\n' "$i" "$mac"
done
The output will display each interface name and its permanent MAC address. If we see an interface with a MAC address of 00:00:00:00:00:00, then it’s a virtual interface:
eth0 Permanent address: ab:cd:ef:12:34:56
eth1 Permanent address: 12:34:56:ab:cd:ef
vnet0 Permanent address: 00:00:00:00:00:00
enp4s0f1 Permanent address: 00:9c:02:b0:ef:24
In this sample, vnet0 is a virtual interface. However, we should note that not all virtual interfaces will have MAC addresses starting with 00:00:00. Some virtualization platforms, such as VMware and Hyper-V, generate MAC addresses that start with a different prefix.
Additionally, some virtualization platforms allow us to specify the MAC address for virtual interfaces, which could result in a MAC address that is identical to a physical interface. Therefore, while using MAC addresses to identify virtual interfaces can be helpful, it may not always be completely reliable.
4.5. Using the lshw Command
Another useful command is the lshw command. This command lists detailed information about all hardware on the system, including network interfaces. Virtual interfaces will often include a reference to the virtualization technology used, such as VirtualBox or VMware. On the other hand, physical interfaces won’t have any such reference:
$ sudo lshw -C network
*-network
description: Ethernet interface
product: Ethernet Controller X710 for 10GbE SFP+
vendor: Intel Corporation
physical id: 0
bus info: pci@0000:03:00.0
logical name: enp3s0f0
version: 02
serial: 12:34:56:78:9a:bc
size: 10Gbit/s
capacity: 10Gbit/s
width: 64 bits
clock: 33MHz
capabilities: pm msi msix pciexpress bus_master cap_list rom ethernet physical tp 10000bt-fd
configuration: autonegotiation=off broadcast=yes driver=ixgbe driverversion=5.5.6 duplex=full firmware=6.01 0x8000df55 0.0.0 link=no multicast=yes port=twisted pair speed=10Gbit/s
resources: irq:56 memory:df200000-df3fffff memory:df400000-df7fffff memory:df800000-df9fffff memory:dfa00000-dfafffff
*-network:0
description: Ethernet interface
product: Virtio network device
vendor: Red Hat, Inc.
physical id: 1
bus info: virtio0@0000:00:03.0
logical name: ens3
version: 00
serial: 52:54:00:12:34:56
capacity: 1Gbit/s
width: 64 bits
clock: 33MHz
capabilities: pm pciexpress msix bus_master cap_list rom ethernet physical virtio
configuration: driver=virtio_net latency=0 link=no multicast=yes
resources: irq:16 ioport:e040(size=32) memory:f7d00000-f7d0ffff
*-network:1
description: Ethernet interface
product: Virtio network device
vendor: Red Hat, Inc.
physical id: 2
bus info: virtio0@0000:00:04.0
logical name: ens4
version: 00
serial: 52:54:00:12:34:57
capacity: 1Gbit/s
width: 64 bits
clock: 33MHz
capabilities: pm pciexpress msix bus_master cap_list rom ethernet physical virtio
configuration: driver=virtio_net latency=0 link=no multicast=yes
resources: irq:17 ioport:e0c0(size=32) memory:f7c00000-f7c0ffff
This output displays information about both physical and virtual network interfaces. It lists the physical interface first, providing detailed information about the hardware description, resources of the adapter, and driver used. Then, the virtual interfaces are listed, with a description that indicates they are Virtio network devices, which is the underlying provider of the virtual interface application.
In some cases, virtual network interfaces may not include a reference to the virtualization technology, or their configuration appears identical to physical interfaces. In other cases, physical interfaces may have additional information in their output, making them appear more similar to virtual interfaces.
However, we should note that the accuracy of this method may depend on the system configuration and the virtualization technology.
4.6. Checking the Vendor ID
Lastly, each network interface has a unique vendor ID assigned by the IEEE. Physical interfaces will have a vendor ID associated with a physical hardware manufacturer, while virtual interfaces will typically have a vendor ID associated with the virtualization software used.
However, this method can be a bit more involved for us, as it requires looking up the vendor ID associated with each interface. But it can be useful in some cases.
5. Conclusion
Identifying whether a network interface is physical or virtual can be important for various reasons, such as troubleshooting network connectivity issues or optimizing network performance. In this article, we’ve discussed in detail different methods for identifying physical and virtual network interfaces.
By using these methods, we can confidently identify the type of network interface we’re working with within Linux systems.