ifconfig vs ip Command Explained for the Linux+ Exam

ifconfig — interface configuration — was the standard command for viewing and changing network settings on Unix-like systems for decades. It still works on macOS and on plenty of older Linux installations, but on modern Linux it has been deprecated in favour of the ip command, and that fact is itself an exam point.

Learn ifconfig because you will meet it. Learn ip because it is what you should be using.

On most current distributions ifconfig is not installed by default at all. It lives in the net-tools package, which is no longer maintained, and running it produces "command not found" on a clean Debian, Ubuntu, Fedora, or RHEL system.

Reading the Output

Running ifconfig with no arguments shows every active interface. The fields that matter:

• Interface name — eth0 or enp0s3 for wired, wlan0 or wlp2s0 for wireless, lo for loopback. Modern systems use predictable naming based on bus position rather than the old sequential names, which is why you see enp0s3 rather than eth0.
• flags — UP means administratively enabled, RUNNING means the link is actually live. An interface that is UP but not RUNNING usually means an unplugged cable.
• inet — the IPv4 address. netmask and broadcast follow it.
• inet6 — IPv6 addresses, including the fe80:: link-local one every interface has.
• ether — the MAC address.
• RX/TX packets and errors — traffic counters. Rising error, dropped, or collision counts point at a physical or duplex problem rather than a configuration one.

Common Commands, Old and New

Task	ifconfig (deprecated)	ip (current)
Show all interfaces	ifconfig -a	ip addr show or ip a
Show one interface	ifconfig eth0	ip addr show eth0
Bring an interface up	ifconfig eth0 up	ip link set eth0 up
Bring it down	ifconfig eth0 down	ip link set eth0 down
Assign an address	ifconfig eth0 192.168.1.50 netmask 255.255.255.0	ip addr add 192.168.1.50/24 dev eth0
Remove an address	Not straightforward	ip addr del 192.168.1.50/24 dev eth0
Change the MAC	ifconfig eth0 hw ether 00:11:22:33:44:55	ip link set eth0 address 00:11:22:33:44:55
Show the routing table	route -n	ip route
Show the ARP cache	arp -a	ip neigh

Note the pattern in the ip syntax: an object (addr, link, route, neigh) followed by a command. Once that clicks, the whole tool is predictable.

Changes Are Not Persistent

This catches people out constantly and is a very likely exam point. Anything set with ifconfig or ip is lost on reboot or on restarting the network service. Persistent configuration lives elsewhere depending on the distribution:

• Netplan — YAML files under /etc/netplan/ on modern Ubuntu.
• NetworkManager — managed with nmcli or nmtui, common on desktops, Fedora and RHEL.
• systemd-networkd — files under /etc/systemd/network/.
• Legacy files — /etc/network/interfaces on older Debian, or /etc/sysconfig/network-scripts/ on older RHEL.

If a question describes a configuration that works until reboot, this is why.

The Windows Equivalents

Worth knowing side by side, because A+ tests both: ipconfig shows the configuration, ipconfig /all adds MAC address and DNS detail, ipconfig /release and /renew handle DHCP, and ipconfig /flushdns clears the resolver cache. Note that ipconfig cannot change an address — that requires netsh or the GUI — whereas ifconfig can, which is a genuine difference between the two commands despite the similar names.

Linux+ (XK0-005) Exam Tips

• ifconfig is deprecated; ip is current. Expect this directly.
• ifconfig is in the net-tools package and often not installed.
• Know the ip equivalents for showing, enabling, and addressing interfaces.
• Changes made with either command are not persistent.
• Know where persistent config lives — Netplan, NetworkManager, systemd-networkd.
• UP versus RUNNING in the flags, and what each tells you.
• Related tools: ss replacing netstat, ip neigh replacing arp, ip route replacing route.

A+ and Security+ Angles

A+ (220-1201/1202) covers the command-line networking tools across platforms — ipconfig, ifconfig, ping, tracert/traceroute, nslookup/dig, netstat — and reading their output during troubleshooting.

Security+ (SY0-701) touches it through MAC address spoofing, since ifconfig hw ether changes the hardware address trivially — which is why MAC filtering is not a security control and why port security and 802.1X exist.

Key Takeaways

• ifconfig views and configures network interfaces on Unix-like systems.
• It is deprecated on Linux in favour of ip, and often not installed by default.
• ip a, ip link set, ip addr add are the modern equivalents.
• Neither tool's changes survive a reboot — persistence lives in Netplan, NetworkManager or systemd-networkd.
• UP means enabled; RUNNING means the link is live.
• MAC addresses can be changed in one command, which is why MAC filtering is not security.