How can I tell whether a network interface is physical (device) or virtual (alias)?

Question

I have a small home router running OpenWrt (Kind of embedded Linux for routers). It has five Ethernet ports, one labeled WAN and four labeld LAN 1 to 4. It has the following Network Interfaces defined as per ifconfig:

root@TIBERIUS: ~ > ifconfig | grep Link
br-lan    Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
eth0      Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
lan1      Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
lan2      Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
lan3      Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
lan4      Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
lo        Link encap:Local Loopback
pppoe-wan Link encap:Point-to-Point Protocol
wan       Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
wlan0     Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0

As you can see, quite a number of devices, but only one MAC address.

I understand some of those devices are virtual. Let's put aside lo and pppoe-wan, that's the loopback device and my PPPoE Connection. But for the rest of those, how am I supposed to be able to tell whether they are physical or virtual? I understand there is a naming convention for labeling virtual Interfaces like eth0.1, but that is obviously not adhered to here. Let's see the Output of ifconfig for two of these interfaces:

root@TIBERIUS: ~ > ifconfig wan
wan       Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:15007 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12055 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:13341276 (12.7 MiB)  TX bytes:1831757 (1.7 MiB)

root@TIBERIUS: ~ > ifconfig eth0
eth0      Link encap:Ethernet  HWaddr 00:23:CD:20:C3:B0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:25799 errors:0 dropped:0 overruns:23 frame:0
          TX packets:25294 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:15481996 (14.7 MiB)  TX bytes:15160380 (14.4 MiB)
          Interrupt:4

Apart from the obscure Detail of txqueuelen having a non-zero for eth0, the only striking difference is that eth0 has an Interrupt entry, which as far as I know is a Hardware Feature. So is that how you tell a Network Interface is physical or not, by looking for an Interrupt entry in ifconfig? Or is there a better way? A simple and straightforward way to find out whether a network device is physical or virtual?

Note there is a related question but while it does have an accepted answer, it isn't conclusive.

Update

In reply to derobert's answer, here's information derivd from ls -l /sys/class/net:

br-lan      -> ../../devices/virtual/net/br-lan
eth0        -> ../../devices/platform/ag71xx.0/net/eth0
lan1        -> ../../devices/platform/dsa.0/net/lan1
lan2        -> ../../devices/platform/dsa.0/net/lan2
lan3        -> ../../devices/platform/dsa.0/net/lan3
lan4        -> ../../devices/platform/dsa.0/net/lan4
lo          -> ../../devices/virtual/net/lo
pppoe-wan   -> ../../devices/virtual/net/pppoe-wan
wan         -> ../../devices/platform/dsa.0/net/wan

[Addendum to this list: wlan0 would have shown up as well as wlan0 -> ../../devices/platform/ath9k/net/wlan0, but when I copied the above list I had WLAN disabled, which is why it didn't show up.]

I would say eth0 is the only device. Not clear what dsa.0 is.

And in reply to Bryan Agee's answer:

root@TIBERIUS: ~ > cat /etc/config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config interface 'eth'
        option ifname 'eth0'
        option proto 'none'

config interface 'lan'
        option ifname 'lan1 lan2 lan3 lan4'
        option type 'bridge'
        option proto 'static'
        option ipaddr '192.168.33.1'
        option netmask '255.255.255.0'

config interface 'wan'
        option ifname 'wan'
        option proto 'pppoe'
        option username '…'
        option password '…'

Answer 1

You can check /sys:

anthony@Zia:/sys/class/net$ ls -l /sys/class/net/
total 0
lrwxrwxrwx 1 root root 0 Dec 11 15:38 br0 -> ../../devices/virtual/net/br0
lrwxrwxrwx 1 root root 0 Dec 11 15:38 lan -> ../../devices/pci0000:00/0000:00:1e.0/0000:07:01.0/net/lan
lrwxrwxrwx 1 root root 0 Dec 11 15:38 lo -> ../../devices/virtual/net/lo
lrwxrwxrwx 1 root root 0 Dec 11 15:38 tun0 -> ../../devices/virtual/net/tun0

So, actual devices show in /sys/class/net. Note that aliases (like lan:0) do not (so you can tell which are aliases). And you can clearly see which are actual hardware (lan) and which aren't (br0, lo, tun0).

to clarify

You can tell which are real in the above because the virtual ones are all in virtual. And lan is on the PCI bus.

In your case, you have six: eth0, wan, and lan1–4. This is rather odd, since you say you only have five ports total. I'd guess eth0 is actually hardwired to a a switch-ish chip, and the other 5 ports are ports on that switch. wlan0 is probably real as well (would be the wireless adapter), though it isn't showing in /sys….

So, I'd say that for all practical purposes, your real ports are wan, lan1–4, and wlan0. br-lan is a bridge set up to make all 4 lan ports function as a switch (so you might be able to split that switch).

Answer 2

Assuming your interface MAC address was not spoofed, you can try to use ethtool:

ethtool -P {Network interface name}

"Permanent address: 00:00:00:00:00:00" will indicate it's a virtual network interface.

The following bash loop will display MAC address for all network interfaces:

for i in $(ip -o link show | awk -F': ' '{print $2}'); \
do mac=$(ethtool -P $i) \
&& printf '%-10s %-10s\n' "$i" "$mac"; \
done

---

lo         Permanent address: 00:00:00:00:00:00
enp5s0f0   Permanent address: 44:1e:a1:73:39:c8
enp4s0f0   Permanent address: 00:9c:02:b0:ef:20
enp5s0f1   Permanent address: 44:1e:a1:73:39:c9
enp4s0f1   Permanent address: 00:9c:02:b0:ef:24
virbr1     Permanent address: 00:00:00:00:00:00
virbr1-nic Permanent address: 00:00:00:00:00:00
virbr0     Permanent address: 00:00:00:00:00:00
virbr0-nic Permanent address: 00:00:00:00:00:00
vnet0      Permanent address: 00:00:00:00:00:00
vnet1      Permanent address: 00:00:00:00:00:00

Answer 3

I would start by looking in /etc/network/config ; most distros have a similar file to define and configure network devices. In debian/Ubuntu, it's /etc/network/interfaces. If you were to post the contents of that, we could identify alias, bond, and bridge entries; the rest would be your physical devices.

By looking at the ifconfig output, you can tell (as you mentioned) by the devices that have interrupts (IRQs); many also have memory assigned, which virtual interfaces don't.

You can't ever judge by mac addresses alone, since bonds (link aggregation) will override the mac of individual devices, and bridges will use the same. So if you have two devices bonded and bridged--a common configuration for HA virtual hosts and routers--there will be four devices with the same mac:

eth0  - physical device 1
eth1  - physical device 2
bond0 - the virtual device that uses either or both of the above
br0   - the bridge that uses bond0 and allows sharing/forwarding across bond0

Clearly the aliases used in openwrt are not the ones above, but the concept holds; I used these because they are standard practice.

Answer 4

I think that just checking if the value of /sys/class/net/<interface>/type is 1 (ARPHRD_ETHER) should be enough to understand if the device is a physical one.

http://lxr.linux.no/linux+v3.0/include/linux/if_arp.h#L30

eg. basename $(dirname grep -l ^1$ /sys/class/net/*/type)