22

I have a small home router running OpenWrt (Kind of embedded Linux for routers). It has five Ethernet ports, one labeled WAN and four labeld LAN 1 to 4. It has the following Network Interfaces defined as per ifconfig:

root@TIBERIUS: ~ > ifconfig | grep Link
br-lan    Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
eth0      Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
lan1      Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
lan2      Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
lan3      Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
lan4      Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
lo        Link encap:Local Loopback
pppoe-wan Link encap:Point-to-Point Protocol
wan       Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
wlan0     Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0

As you can see, quite a number of devices, but only one MAC address.

I understand some of those devices are virtual. Let's put aside lo and pppoe-wan, that's the loopback device and my PPPoE Connection. But for the rest of those, how am I supposed to be able to tell whether they are physical or virtual? I understand there is a naming convention for labeling virtual Interfaces like eth0.1, but that is obviously not adhered to here. Let's see the Output of ifconfig for two of these interfaces:

root@TIBERIUS: ~ > ifconfig wan
wan       Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:15007 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12055 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:13341276 (12.7 MiB)  TX bytes:1831757 (1.7 MiB)

root@TIBERIUS: ~ > ifconfig eth0
eth0      Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:25799 errors:0 dropped:0 overruns:23 frame:0
          TX packets:25294 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:15481996 (14.7 MiB)  TX bytes:15160380 (14.4 MiB)
          Interrupt:4

Apart from the obscure Detail of txqueuelen having a non-zero for eth0, the only striking difference is that eth0 has an Interrupt entry, which as far as I know is a Hardware Feature. So is that how you tell a Network Interface is physical or not, by looking for an Interrupt entry in ifconfig? Or is there a better way? A simple and straightforward way to find out whether a network device is physical or virtual?

Note there is a related question but while it does have an accepted answer, it isn't conclusive.

Update

In reply to derobert's answer, here's information derivd from ls -l /sys/class/net:

br-lan      -> ../../devices/virtual/net/br-lan
eth0        -> ../../devices/platform/ag71xx.0/net/eth0
lan1        -> ../../devices/platform/dsa.0/net/lan1
lan2        -> ../../devices/platform/dsa.0/net/lan2
lan3        -> ../../devices/platform/dsa.0/net/lan3
lan4        -> ../../devices/platform/dsa.0/net/lan4
lo          -> ../../devices/virtual/net/lo
pppoe-wan   -> ../../devices/virtual/net/pppoe-wan
wan         -> ../../devices/platform/dsa.0/net/wan

[Addendum to this list: wlan0 would have shown up as well as wlan0 -> ../../devices/platform/ath9k/net/wlan0, but when I copied the above list I had WLAN disabled, which is why it didn't show up.]

I would say eth0 is the only device. Not clear what dsa.0 is.

And in reply to Bryan Agee's answer:

root@TIBERIUS: ~ > cat /etc/config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config interface 'eth'
        option ifname 'eth0'
        option proto 'none'

config interface 'lan'
        option ifname 'lan1 lan2 lan3 lan4'
        option type 'bridge'
        option proto 'static'
        option ipaddr '192.168.33.1'
        option netmask '255.255.255.0'

config interface 'wan'
        option ifname 'wan'
        option proto 'pppoe'
        option username '…'
        option password '…'
10
  • You already answered your own question (look for hardware-specific items like IRQ, txqueue, ...). The question that arises to me is - why do you need to differentiate that in your use-case?
    – Nils
    Dec 2, 2012 at 22:11
  • @Nils, I don't have a clear grasp of the network configuration on my router device after I flashed OpenWrt onto it. I find it thoroughly confusing. Project docs and forum have provided some help, but not enough, and leaving basic questions unanswered. One of those questions is the one raised here. It now seems to me that my router has only one NIC when I was sure it had two. Clarifying details reduces confusion. That's why.
    – Lumi
    Dec 2, 2012 at 22:23
  • Can you put a small photo or a link to a photo/documentation for that router here? There might be things like bonding/bridging/NATting that hide the real MACs...
    – Nils
    Dec 3, 2012 at 21:45
  • You should be able to see better details, and the ones you need, using lshw -class network
    – Nathan V
    Dec 4, 2012 at 4:43
  • @Nils, here you go: wiki.openwrt.org/toh/tp-link/tl-wr941nd - @Nathan, with just 4 MB of flash, the box is rather constrained, and lshw is not in the package list. A knowledgeable and determined guy might succeed in installing dev tools in tmpfs, but would it be worth while? I'm going to further my understanding of Linux networking by means of a standard PC. This is going to be easier. While I don't properly understand this router configuration, it does work fine. Thanks for your help.
    – Lumi
    Dec 4, 2012 at 16:05

6 Answers 6

22

You can check /sys:

anthony@Zia:/sys/class/net$ ls -l /sys/class/net/
total 0
lrwxrwxrwx 1 root root 0 Dec 11 15:38 br0 -> ../../devices/virtual/net/br0
lrwxrwxrwx 1 root root 0 Dec 11 15:38 lan -> ../../devices/pci0000:00/0000:00:1e.0/0000:07:01.0/net/lan
lrwxrwxrwx 1 root root 0 Dec 11 15:38 lo -> ../../devices/virtual/net/lo
lrwxrwxrwx 1 root root 0 Dec 11 15:38 tun0 -> ../../devices/virtual/net/tun0

So, actual devices show in /sys/class/net. Note that aliases (like lan:0) do not (so you can tell which are aliases). And you can clearly see which are actual hardware (lan) and which aren't (br0, lo, tun0).

to clarify

You can tell which are real in the above because the virtual ones are all in virtual. And lan is on the PCI bus.

In your case, you have six: eth0, wan, and lan1–4. This is rather odd, since you say you only have five ports total. I'd guess eth0 is actually hardwired to a a switch-ish chip, and the other 5 ports are ports on that switch. wlan0 is probably real as well (would be the wireless adapter), though it isn't showing in /sys….

So, I'd say that for all practical purposes, your real ports are wan, lan1–4, and wlan0. br-lan is a bridge set up to make all 4 lan ports function as a switch (so you might be able to split that switch).

5
  • Thanks. I added similar output to my question. It is not as clear as the output you're showing here, with PCI bus or whatnot showing up there; although I don't really understand the output, I agree it looks like hardware identifiers. In the case of my output posted above, it's the presence of ag71xx that makes me think it's hardware, since it looks like a driver.
    – Lumi
    Dec 14, 2012 at 14:28
  • @Lumi edited to try to answer.
    – derobert
    Dec 14, 2012 at 16:47
  • This is probably more practical than my response.
    – Bryan Agee
    Dec 14, 2012 at 18:55
  • Thanks. Note wlan0 would have been present in the device list under /sys/class/net hat it been enabled when I copied the list. :) I have now added it above. I disagree with you on the number of devices, I think there are only two, LAN and WLAN. But that's a minor point … good answer, accepted, thank you!
    – Lumi
    Dec 17, 2012 at 1:57
  • @Lumi use brctrl delif br-lan lan1 (or similar) to drop a port out of the bridge. I suspect it'll function as a separate port (not part of the LAN switch) then.
    – derobert
    Dec 17, 2012 at 15:35
9

Assuming your interface MAC address was not spoofed, you can try to use ethtool:

ethtool -P {Network interface name}

"Permanent address: 00:00:00:00:00:00" will indicate it's a virtual network interface.

The following bash loop will display MAC address for all network interfaces:

for i in $(ip -o link show | awk -F': ' '{print $2}'); \
do mac=$(ethtool -P $i) \
&& printf '%-10s %-10s\n' "$i" "$mac"; \
done

lo         Permanent address: 00:00:00:00:00:00
enp5s0f0   Permanent address: 44:1e:a1:73:39:c8
enp4s0f0   Permanent address: 00:9c:02:b0:ef:20
enp5s0f1   Permanent address: 44:1e:a1:73:39:c9
enp4s0f1   Permanent address: 00:9c:02:b0:ef:24
virbr1     Permanent address: 00:00:00:00:00:00
virbr1-nic Permanent address: 00:00:00:00:00:00
virbr0     Permanent address: 00:00:00:00:00:00
virbr0-nic Permanent address: 00:00:00:00:00:00
vnet0      Permanent address: 00:00:00:00:00:00
vnet1      Permanent address: 00:00:00:00:00:00
4

Per sysfs man page

/sys/class/net

Each of the entries in this directory is a symbolic link representing one of the real or virtual networking devices that are visible in the network namespace of the process that is accessing the directory. Each of these symbolic links refers to entries in the /sys/devices directory.

So, all one needs to do is check if there is a pyhiscal device linked to the network interface in the sysfs filesystem, e.g. /sys/class/net/eth0/device

A simple script if you know the interface name:

#!/bin/bash

iface=eth0

if test -e /sys/class/net/${iface}/device; then
        echo $iface
fi

If you want to print the interface names for all physical devices:

#!/bin/bash

while IFS='\n' read p1 line ;do
        iface=$(echo "$p1" | sed -n 's/[0-9]: \(.*\):.*/\1/p')

        if test -n $iface && ip addr show dev $iface >/dev/null 2>&1; then
                if test -e /sys/class/net/${iface}/device; then
                        echo $iface
                fi
        fi
done < <(ip address)

And here's a one-liner that will do the trick:

echo $(cd /sys/class/net; dirname */device)

suitable for use in for loops and such, like:

for interface in $(cd /sys/class/net; dirname */device); do
    echo $interface
    # Do whatever else you may need to do with $interface
done
3

I would start by looking in /etc/network/config ; most distros have a similar file to define and configure network devices. In debian/Ubuntu, it's /etc/network/interfaces. If you were to post the contents of that, we could identify alias, bond, and bridge entries; the rest would be your physical devices.

By looking at the ifconfig output, you can tell (as you mentioned) by the devices that have interrupts (IRQs); many also have memory assigned, which virtual interfaces don't.

You can't ever judge by mac addresses alone, since bonds (link aggregation) will override the mac of individual devices, and bridges will use the same. So if you have two devices bonded and bridged--a common configuration for HA virtual hosts and routers--there will be four devices with the same mac:

eth0  - physical device 1
eth1  - physical device 2
bond0 - the virtual device that uses either or both of the above
br0   - the bridge that uses bond0 and allows sharing/forwarding across bond0

Clearly the aliases used in openwrt are not the ones above, but the concept holds; I used these because they are standard practice.

2
  • This does not account for interfaces created in other ways, worked around the 'standard' /etc way. For example, interfaces created by NetworkManager are not mentioned there.
    – gertvdijk
    Dec 12, 2012 at 16:44
  • @gertvdijk That's true, although openwrt does not pack NetworkManager into that 4MB, so all interfaces should be in the config.
    – Bryan Agee
    Dec 12, 2012 at 16:49
2

I was trying to figure out how to get a list of virtual can (vcan) devices and came up with the following:

ip -details -oneline link | grep vcan

This will list only the virtual can devices.

If you are interested in only getting back a list of vcan device names, then this should work:

ip -details -oneline link | grep vcan | awk -F': ' '{print $2}'
-4

I think that just checking if the value of /sys/class/net/<interface>/type is 1 (ARPHRD_ETHER) should be enough to understand if the device is a physical one.

http://lxr.linux.no/linux+v3.0/include/linux/if_arp.h#L30

eg. basename $(dirname grep -l ^1$ /sys/class/net/*/type)

1
  • 1
    I'm seeing 1 for many interfaces (eth, wireless, bridge, & vlan hanging from a bridge - so no)
    – nhed
    Feb 26, 2017 at 17:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.