ip

Overview ¶

Package ip implements the ip builtin command.

ip — show network interfaces and addresses

Usage: ip [GLOBAL-OPTIONS] OBJECT [COMMAND [ARGUMENTS]]

Query network interface information. Only read-only subcommands are supported. All write operations (add, del, flush, change, replace, set) and dangerous execution vectors (netns exec, -batch, -force) are rejected with exit code 1.

GLOBAL OPTIONS

-o, --oneline
    Output each record on a single line; internal newlines are represented
    by a backslash followed by the continuation content (matching real ip
    -o format). Useful for machine parsing by AI agents.

--brief
    Print a compact tabular summary: interface name, state, and addresses
    only. Mutually compatible with -4/-6. (Note: the real ip command uses
    -br as a shorthand; our builtin uses --brief instead.)

-4
    Restrict address output to IPv4 only.

-6
    Restrict address output to IPv6 only.

-h, --help
    Print this usage message to stdout and exit 0.

OBJECTS AND COMMANDS

addr [show] [dev IFNAME]
    Show IP addresses assigned to all network interfaces, or to the
    single interface named IFNAME when "dev IFNAME" is given.
    "show" is the default command when no command is specified.

link [show] [dev IFNAME]
    Show link-layer information (MTU, hardware address, flags) for all
    interfaces, or for the single interface named IFNAME.
    "show" is the default command when no command is specified.

BLOCKED FLAGS AND SUBCOMMANDS (exit 1 with an explanatory error)

-b, -B, -batch      Reads ip commands from FILE — arbitrary command
                    execution vector (GTFOBins).
-force              Suppresses errors; companion to -batch (GTFOBins).
-n, --netns         Switches network namespace — privilege escalation.
ip netns            Network namespace management — shell escape via
                    "ip netns exec <ns> <cmd>".
addr add/del/flush/change/replace  Write operations (blocked).
link set/add/del/change            Write operations (blocked).

Exit codes:

0  Query completed successfully.
1  Unknown subcommand, unsupported flag, write operation attempted,
   or the named interface does not exist.

Network access:

Uses Go's net.Interfaces() for read-only enumeration of OS network
interfaces and their addresses. No files are opened; the AllowedPaths
sandbox is not involved.

Output differences from real ip:

The qdisc field is omitted from interface header lines. Go's net package
does not expose the queue discipline and hardcoding "noqueue" would
produce incorrect output for physical NICs (which typically use
pfifo_fast, fq_codel, or mq). All other fields match real ip output.