IFCONFIG(8)             OpenBSD System Manager's Manual            IFCONFIG(8)

NAME
     ifconfig - configure network interface parameters

SYNOPSIS
     ifconfig [-AaC] [interface] [address_family] [address [dest_address]]
              [parameters]

DESCRIPTION
     The ifconfig utility is used to assign an address to a network interface
     and/or configure network interface parameters.  Generally speaking,
     hostname.if(5) files are used at boot-time to define the network address
     of each interface present on a machine; ifconfig is used at a later time
     to redefine an interface's address or other operating parameters.

     ifconfig displays the current configuration for a network interface when
     no optional parameters are supplied.  If a protocol family is specified,
     ifconfig will report only the details specific to that protocol family.
     If no parameters are provided, a summary of all interfaces is provided.

     Only the superuser may modify the configuration of a network interface.

     The options are as follows:

     -A      Causes full interface alias information for each interface to be
             displayed.

     -a      Causes ifconfig to print information on all interfaces.  The pro-
             tocol family may be specified as well.  This is the default, if
             no parameters are given to ifconfig.

     -C      Print the names of all network pseudo-devices that can be created
             dynamically at runtime using ifconfig create.

     interface
             The interface parameter is a string of the form ``name unit'',
             for example, ``en0''.  If no optional parameters are supplied,
             this string can instead be just ``name''.  In this case, all in-
             terfaces of that type will be displayed.  For example, ``carp''
             will display the current configuration of all carp(4) interfaces.

     address_family
             Specifies the address family which affects interpretation of the
             remaining parameters.  Since an interface can receive transmis-
             sions in differing protocols with different naming schemes, spec-
             ifying the address family is recommended.  The address or proto-
             col families currently supported are ``inet'', ``inet6'', and
             ``atalk''.

     address
             Internet version 4 and 6 addresses take the form of a host name
             present in the host name database, hosts(5); ``dot'' notation
             (IPv4); colon separated (IPv6); or CIDR notation.

             AppleTalk (LLAP) addresses are specified as ``nn.na'' (``Network
             Number.Node Address'').  Node addresses are divided into two
             classes: User Node IDs and Server Node IDs.  1-127($01-$7F) are
             for User Node IDs while 128-254($80-$FE) are used for Server Node
             IDs.  Node 0($00) is not allowed (unknown) while Node 255($FF) is
             reserved for the AppleTalk broadcast hardware address (broadcast
             ID).

     dest_address
             Specify the address of the correspondent on the other end of a
             point-to-point link.

     The following parameters may be set with ifconfig:

     alias           Establish an additional network address for this inter-
                     face.  This is sometimes useful when changing network
                     numbers, and one wishes to accept packets addressed to
                     the old interface.

     -alias          A synonym for delete.  Use of this option is discouraged
                     in favour of delete.

     arp             Enable the use of the Address Resolution Protocol (ARP)
                     in mapping between network level addresses and link level
                     addresses (default).  This is currently implemented for
                     mapping between DARPA Internet addresses and Ethernet ad-
                     dresses.

     -arp            Disable the use of ARP.

     broadcast addr  (inet only) Specify the address to use to represent
                     broadcasts to the network.  The default broadcast address
                     is the address with a host part of all 1's.

     create          Create the specified network pseudo-device.  At least the
                     following devices can be created on demand:

                     bridge(4), carp(4), gif(4), gre(4), lo(4), mpe(4),
                     pflog(4), pflow(4), pfsync(4), ppp(4), pppoe(4), sl(4),
                     trunk(4), tun(4), vether(4), vlan(4)

     debug           Enable driver-dependent debugging code; usually, this
                     turns on extra console error logging.

     -debug          Disable driver-dependent debugging code.

     delete          Remove the specified network address, including any net-
                     mask or destination address configured with this address.

     description value
                     Specify a description of the interface.  This can be used
                     to label interfaces in situations where they may other-
                     wise be difficult to distinguish.

     -description    Clear the interface description.

     destroy         Destroy the specified network pseudo-device.

     down            Mark an interface ``down''.  When an interface is marked
                     ``down'', the system will not attempt to transmit mes-
                     sages through that interface.  If possible, the interface
                     will be reset to disable reception as well.  This action
                     automatically disables routes using the interface.

     group group-name
                     Assign the interface to a ``group''.  Any interface can
                     be in multiple groups.

                     For instance, such a group could be used to create a
                     hardware independent pf(4) ruleset (i.e. not one based on
                     the names of NICs) using existing (egress, carp, etc.) or
                     user-defined groups.

                     Some interfaces belong to specific groups by default:

                     -       All interfaces are members of the all interface
                             group.
                     -       Cloned interfaces are members of their interface
                             family group.  For example, a PPP interface such
                             as ppp0 is a member of the ppp interface family
                             group.
                     -       The interface(s) the default route(s) point to
                             are members of the egress interface group.
                     -       IEEE 802.11 wireless interfaces are members of
                             the wlan interface group.
                     -       Any interfaces used for network booting are mem-
                             bers of the netboot interface group.

     -group group-name
                     Remove the interface from the given ``group''.

     -inet6          Disable inet6(4) on the given interface and remove all
                     configured inet6(4) addresses, including the link-local
                     ones.  To turn it on again, assign any inet6 address or
                     run rtsol(8).

     instance minst  Set the media instance to minst.  This is useful for de-
                     vices which have multiple physical layer interfaces
                     (PHYs).  Setting the instance on such devices may not be
                     strictly required by the network interface driver as the
                     driver may take care of this automatically; see the driv-
                     er's manual page for more information.

     ipdst addr      This is used to specify an Internet host which is willing
                     to receive IP packets encapsulating AppleTalk packets
                     bound for a remote network.  An apparent point-to-point
                     link is constructed, and the address specified will be
                     taken as the address and network of the destination.  IP
                     encapsulation of Connectionless Network Protocol
                     (``CLNP'') packets is done differently.

     link[0-2]       Enable special processing of the link level of the inter-
                     face.  These three options are interface specific in ac-
                     tual effect; however, they are in general used to select
                     special modes of operation.  An example of this is to en-
                     able SLIP compression, or to select the connector type
                     for some Ethernet cards.  Refer to the man page for the
                     specific driver for more information.

     -link[0-2]      Disable special processing at the link level with the
                     specified interface.

     lladdr etheraddr
                     Change the link layer address (MAC address) of the inter-
                     face.  This should be specified as six colon-separated
                     hex values.

     media [type]    Set the media type of the interface to type.  If no argu-
                     ment is given, display a list of all available media.

                     Some interfaces support the mutually exclusive use of one
                     of several different physical media connectors.  For ex-
                     ample, a 10Mb/s Ethernet interface might support the use
                     of either AUI or twisted pair connectors.  Setting the
                     media type to ``10base5'' or ``AUI'' would change the
                     currently active connector to the AUI port.  Setting it
                     to ``10baseT'' or ``UTP'' would activate twisted pair.
                     Refer to the interface's driver-specific man page for a
                     complete list of the available types, or use the follow-
                     ing command for a listing of choices:

                           $ ifconfig interface media

     mediaopt opts   Set the specified media options on the interface.  opts
                     is a comma delimited list of options to apply to the in-
                     terface.  Refer to the interface's driver-specific man
                     page for a complete list of available options, or use the
                     following command for a listing of choices:

                           $ ifconfig interface media

     -mediaopt opts  Disable the specified media options on the interface.

     metric nhops    Set the routing metric of the interface to nhops, default
                     0.  The routing metric can be used by routing protocols.
                     Higher metrics have the effect of making a route less fa-
                     vorable.

     mode mode       If the driver for the interface supports the media selec-
                     tion system, set the specified operating mode on the in-
                     terface to the given mode.  For IEEE 802.11 wireless in-
                     terfaces that support multiple operating modes, this di-
                     rective is used to select between 802.11a (``11a''),
                     802.11b (``11b''), and 802.11g (``11g'') operating modes.

     mtu value       Set the MTU for this device to the given value.  Cloned
                     routes will inherit this value as a default.  Currently,
                     not all devices support setting the MTU.

     netmask mask    (inet and inet6) Specify how much of the address to re-
                     serve for subdividing networks into subnetworks.  The
                     mask includes the network part of the local address and
                     the subnet part, which is taken from the host field of
                     the address.  The mask can be specified as a single hex-
                     adecimal number with a leading 0x, with a dot-notation
                     Internet address, or with a pseudo-network name listed in
                     the network table networks(5).  The mask contains 1's for
                     the bit positions in the 32-bit address which are to be
                     used for the network and subnet parts, and 0's for the
                     host part.  The mask should contain at least the standard
                     network portion, and the subnet field should be contigu-
                     ous with the network portion.

     phase n         The argument n specifies the version (phase) of the Ap-
                     pleTalk network attached to the interface.  Values of 1
                     or 2 are permitted.

     prefixlen n     (inet and inet6 only) Effect is similar to netmask, but
                     you can specify prefix length by digits.

     priority n      Set the interface routing priority to n.  This will in-
                     fluence the default routing priority of new static routes
                     added to the kernel.  n is in the range of 0 to 16 with
                     smaller numbers being better.

     range netrange  Under AppleTalk, set the interface to respond to a
                     netrange of the form ``startnet-endnet''.  AppleTalk uses
                     this scheme instead of netmasks though OpenBSD implements
                     it internally as a set of netmasks.

     rdomain route-id
                     Attach the interface to the routing table with the speci-
                     fied route-id.  Interfaces in different routing domains
                     are separated and can not directly pass traffic between
                     each other.  By default all interfaces belong to routing
                     table 0.

     rtlabel route-label
                     (inet) Attach route-label to new network routes of the
                     specified interface.  Route labels can be used to imple-
                     ment policy routing; see route(4), route(8), and
                     pf.conf(5).

     -rtlabel        Clear the route label.

     timeslot timeslot_range
                     Set the timeslot range map, which is used to control
                     which channels an interface device uses.

     up              Mark an interface ``up''.  This may be used to enable an
                     interface after an ifconfig down.  It happens automati-
                     cally when setting the first address on an interface.  If
                     the interface was reset when previously marked down, the
                     hardware will be re-initialized.

     ifconfig supports a multitude of sub-types, described in the following
     sections:

           -   bridge(4)
           -   carp(4)
           -   IEEE 802.11 (wireless devices)
           -   inet6(4)
           -   interface groups
           -   mpe(4)
           -   pflow(4)
           -   pfsync(4)
           -   pppoe(4)
           -   sppp(4) (PPP Link Control Protocol)
           -   trunk(4)
           -   tunnel (gif(4) and gre(4))
           -   vlan(4)

BRIDGE
     Bridges have many configuration options as well as a rudimentary filter-
     ing language.  They are as follows:

     add interface
             Add interface as a member of the bridge.  The interface is put
             into promiscuous mode so that it can receive every packet sent on
             the network.  An interface can be a member of at most one bridge.

     addr    Display the addresses that have been learned by the bridge.

     addspan interface
             Add interface as a span port on the bridge.  See bridge(4) for
             more details.

     autoedge interface
             Automatically detect the spanning tree edge port status on
             interface.  This is the default for interfaces added to the
             bridge.

     -autoedge interface
             Disable automatic spanning tree edge port detection on interface.

     autoptp interface
             Automatically detect the point-to-point status on interface by
             checking the full duplex link status.  This is the default for
             interfaces added to the bridge.

     -autoptp interface
             Disable automatic point-to-point link detection on interface.

     blocknonip interface
             Mark interface so that no non-IPv4, IPv6, ARP, or Reverse ARP
             packets are accepted from it or forwarded to it from other bridge
             member interfaces.

     -blocknonip interface
             Allow non-IPv4, IPv6, ARP, or Reverse ARP packets through
             interface.

     del interface
             Alias for delete.

     deladdr address
             Delete address from the cache.

     delete interface
             Remove interface from the bridge.  Promiscuous mode is turned off
             for the interface when it is removed from the bridge.

     delspan interface
             Delete interface from the list of span ports of the bridge.

     discover interface
             Mark interface so that packets are sent out of the interface if
             the destination port of the packet is unknown.  If the bridge has
             no address cache entry for the destination of a packet, meaning
             that there is no static entry and no dynamically learned entry
             for the destination, the bridge will forward the packet to all
             member interfaces that have this flag set.  This is the default
             for interfaces added to the bridge.

     -discover interface
             Mark interface so that packets are not sent out of the interface
             if the destination port of the packet is unknown.  Turning this
             flag off means that the bridge will not send packets out of this
             interface unless the packet is a broadcast packet, multicast
             packet, or a packet with a destination address found on the in-
             terface's segment.  This, in combination with static address
             cache entries, prevents potentially sensitive packets from being
             sent on segments that have no need to see the packet.

     down    Stop the bridge from forwarding packets.

     edge interface
             Set interface as a spanning tree edge port.  An edge port is a
             single connection to the network and cannot create bridge loops.
             This allows a straight transition to forwarding.

     -edge interface
             Disable edge port status on interface.

     flush   Remove all dynamically learned addresses from the cache.

     flushall
             Remove all addresses from the cache including static addresses.

     flushrule interface
             Remove all Ethernet MAC filtering rules from interface.

     fwddelay time
             Set the time (in seconds) before an interface begins forwarding
             packets.  Defaults to 15 seconds, minimum of 4, maximum of 30.

     hellotime time
             Set the time (in seconds) between broadcasting spanning tree pro-
             tocol configuration packets.  Defaults to 2 seconds, minimum of
             1, maximum of 2.  This option is only supported in STP mode with
             rapid transitions disabled; see the proto command for setting the
             protocol version.

     holdcnt time
             Set the transmit hold count, which is the number of spanning tree
             protocol packets transmitted before being rate limited.  Defaults
             to 6, minimum of 1, maximum of 10.

     ifcost interface num
             Set the spanning tree path cost of interface to num.  Defaults to
             55, minimum of 1, maximum of 200000000 in RSTP mode, and maximum
             of 65535 in STP mode.

     -ifcost interface
             Automatically calculate the spanning tree priority of interface
             based on the current link speed, interface status, and spanning
             tree mode.  This is the default for interfaces added to the
             bridge.

     ifpriority interface num
             Set the spanning tree priority of interface to num.  Defaults to
             128, minimum of 0, maximum of 240.

     learn interface
             Mark interface so that the source address of packets received
             from the interface are entered into the address cache.  This is
             the default for interfaces added to the bridge.

     -learn interface
             Mark interface so that the source address of packets received
             from interface are not entered into the address cache.

     link0   Setting this flag stops all IP multicast packets from being for-
             warded by the bridge.

     -link0  Clear the link0 flag on the bridge interface.

     link1   Setting this flag stops all non-IP multicast packets from being
             forwarded by the bridge.

     -link1  Clear the link1 flag on the bridge interface.

     link2   Setting this flag causes all packets to be passed on to ipsec(4)
             for processing, based on the policies established by the adminis-
             trator using the ipsecctl(8) command and ipsec.conf(5).  If ap-
             propriate security associations (SAs) exist, they will be used to
             encrypt or decrypt the packets.  Otherwise, any key management
             daemons such as isakmpd(8) that are running on the bridge will be
             invoked to establish the necessary SAs.  These daemons have to be
             configured as if they were running on the host whose traffic they
             are protecting (i.e. they need to have the appropriate authenti-
             cation and authorization material, such as keys and certificates,
             to impersonate the protected host(s)).

     -link2  Clear the link2 flag on the bridge interface.

     maxaddr size
             Set the address cache size to size.  The default is 100 entries.

     maxage time
             Set the time (in seconds) that a spanning tree protocol configu-
             ration is valid.  Defaults to 20 seconds, minimum of 6, maximum
             of 40.

     proto value
             Force the spanning tree protocol version.  The available values
             are rstp to operate in the default Rapid Spanning Tree (RSTP)
             mode or stp to force operation in Spanning Tree (STP) mode with
             rapid transitions disabled.

     ptp interface
             Set interface as a point-to-point link.  This is required for
             straight transitions to forwarding and should be enabled for a
             full duplex link or a trunk(4) with at least two physical links
             to the same network segment.

     -ptp interface
             Disable point-to-point link status on interface.  This should be
             disabled for a half duplex link and for an interface connected to
             a shared network segment, like a hub or a wireless network.

     rule block|pass [in | out] on interface [src address] [dst address] [tag
             tagname]
             Add a filtering rule to an interface.  Rules have a similar syn-
             tax to those in pf.conf(5).  Rules can be used to selectively
             block or pass frames based on Ethernet MAC addresses.  They can
             also tag packets for pf(4) to filter on.  Rules are processed in
             the order in which they were added to the interface, and the
             first rule matched takes the action (block or pass) and, if giv-
             en, the tag of the rule.  If no source or destination address is
             specified, the rule will match all frames (good for creating a
             catchall policy).

     rulefile filename
             Load a set of rules from the file filename.

     rules interface
             Display the active filtering rules in use on interface.

     spanpriority num
             Set the spanning priority of this bridge to num.  Defaults to
             32768, minimum of 0, maximum of 61440.

     static interface address
             Add a static entry into the address cache pointing to interface.
             Static entries are never aged out of the cache or replaced, even
             if the address is seen on a different interface.

     stp interface
             Enable spanning tree protocol on interface.

     -stp interface
             Disable spanning tree protocol on interface.  This is the default
             for interfaces added to the bridge.

     timeout time
             Set the timeout, in seconds, for addresses in the cache to time.
             The default is 240 seconds.  If time is set to zero, then entries
             will not be expired.

     up      Start the bridge forwarding packets.

CARP
     ifconfig carp-interface [advbase n] [advskew n] [balancing mode]
     [carpnodes vhid:advskew,vhid:advskew,...] [carpdev iface]
     [[-]carppeer peer_address] [pass passphrase] [state state] [vhid host-id]

     The options are as follows:

     advbase n
             If the driver is a carp(4) pseudo-device, set the base advertise-
             ment interval to n seconds.  This is an 8-bit number; the default
             value is 1 second.

     advskew n
             If the driver is a carp(4) pseudo-device, skew the advertisement
             interval by n.  This is an 8-bit number; the default value is 0.

     balancing mode
             If the driver is a carp(4) pseudo-device, set the load balancing
             mode to mode.  Valid modes are arp, ip, ip-stealth, and ip-
             unicast.

     carpnodes vhid:advskew,vhid:advskew,...
             If the driver is a carp(4) pseudo-device, create a load balancing
             group consisting of up to 32 nodes.  Each node is specified as a
             vhid:advskew tuple in a comma separated list.

     carpdev iface
             If the driver is a carp(4) pseudo-device, attach it to iface.  If
             not specified, the kernel will attempt to select an interface
             with a subnet matching that of the carp interface.

     carppeer peer_address
             If the driver is a carp(4) pseudo-device, send the carp adver-
             tisements to a specified point-to-point peer or multicast group
             instead of sending the messages to the default carp multicast
             group.  The peer_address is the IP address of the other host tak-
             ing part in the carp cluster.  With this option, carp(4) traffic
             can be protected using ipsec(4) and it may be desired in networks
             that do not allow or have problems with IPv4 multicast traffic.

     -carppeer
             If the driver is a carp(4) pseudo-device, send the advertisements
             to the default carp multicast group.

     pass passphrase
             If the driver is a carp(4) pseudo-device, set the authentication
             key to passphrase.  There is no passphrase by default.

     state state
             Explicitly force the carp(4) pseudo-device to enter this state.
             Valid states are init, backup, and master.

     vhid n  If the driver is a carp(4) pseudo-device, set the virtual host ID
             to n.  Acceptable values are 1 to 255.

     Taken together, the advbase and advskew indicate how frequently, in sec-
     onds, the host will advertise the fact that it considers itself master of
     the virtual host.  The formula is advbase + (advskew / 256).  If the mas-
     ter does not advertise within three times this interval, this host will
     begin advertising as master.

IEEE 802.11 (WIRELESS DEVICES)
     ifconfig wireless-interface [[-]bssid bssid] [[-]chan [n]]
     [[-]nwflag flag] [[-]nwid id] [[-]nwkey key] [[-]powersave [duration]]
     [scan] [[-]txpower dBm] [[-]wpa] [wpaakms akm,akm,...]
     [wpaciphers cipher,cipher,...] [wpagroupcipher cipher]
     [wpaprotos proto,proto,...] [[-]wpapsk psk]

     The options are as follows:

     bssid bssid
             Set the desired BSSID for IEEE 802.11-based wireless network in-
             terfaces.

     -bssid  Unset the desired BSSID for IEEE 802.11-based wireless network
             interfaces.  The interface will automatically select a BSSID in
             this mode, which is the default.

     chan [n]
             Set the channel (radio frequency) to be used for IEEE
             802.11-based wireless network interfaces to n.

             With no channel specified, show the list of channels supported by
             the device.

     -chan   Unset the desired channel to be used for IEEE 802.11-based wire-
             less network interfaces.  It doesn't affect the channel to be
             created for IBSS or Host AP mode.

     nwflag flag
             Set a specified flag for the wireless network interface.  The
             flag name can be either `hidenwid' or `nobridge'.  The `hidenwid'
             flag will hide the network ID (ESSID) in beacon frames when oper-
             ating in Host AP mode.  It will also prevent responses to probe
             requests with an unspecified network ID.  The `nobridge' flag
             will disable the direct bridging of frames between associated
             nodes when operating in Host AP mode.  Setting this flag will
             block and filter direct inter-station communications.

             Note that the `hidenwid' and `nobridge' options do not provide
             any security.  The hidden network ID will be sent in clear text
             by associating stations and can be easily discovered with tools
             like tcpdump(8) and hostapd(8).

     -nwflag flag
             Remove a specified flag for the wireless network interface.

     nwid id
             Configure network ID for IEEE 802.11-based wireless network in-
             terfaces.  The id can either be any text string up to 32 charac-
             ters in length, or a series of hexadecimal digits up to 64 dig-
             its.  The empty string allows the interface to connect to any
             available access points.  Note that network ID is synonymous with
             Extended Service Set ID (ESSID).

     -nwid   Set the network ID to the empty string to allow the interface to
             connect to any available access point.

     nwkey key
             Enable WEP encryption for IEEE 802.11-based wireless network in-
             terfaces using the specified key.  The key can either be a
             string, a series of hexadecimal digits (preceded by `0x'), or a
             set of keys of the form ``n:k1,k2,k3,k4'' where `n' specifies
             which of the keys will be used for transmitted packets, and the
             four keys, ``k1'' through ``k4'', are configured as WEP keys.  If
             a set of keys is specified, a comma (`,') within the key must be
             escaped with a backslash.  Note that if multiple keys are used,
             their order must be the same within the network.  The length of
             each key must be either 40 bits, i.e. a 5-character string or 10
             hexadecimal digits or 104 bits (13-character).

     -nwkey  Disable WEP encryption for IEEE 802.11-based wireless network in-
             terfaces.

     nwkey persist
             Enable WEP encryption for IEEE 802.11-based wireless network in-
             terfaces with the persistent key stored in the network card.

     nwkey persist:key
             Write key to the persistent memory of the network card, and en-
             able WEP encryption for IEEE 802.11-based wireless network inter-
             faces using that key.

     powersave [duration]
             Enable 802.11 power saving mode.  Optionally set the receiver
             sleep duration (in milliseconds).

     -powersave
             Disable 802.11 power saving mode.

     scan    Show the results of an access point scan.  In Host AP mode, this
             will dump the list of known nodes without scanning.

     txpower dBm
             Set the transmit power for IEEE 802.11-based wireless network in-
             terfaces.  The driver will disable any auto level and transmit
             power controls in this mode.

     -txpower
             Disable manual transmit power mode and enable any auto level and
             transmit power controls.

     wpa     Enable Wi-Fi Protected Access.  WPA is a Wi-Fi Alliance protocol
             based on the IEEE 802.11i standard.  It was designed to enhance
             the security of wireless networks.  Notice that not all drivers
             support WPA.  Check the driver's manual page to know if this op-
             tion is supported.

     -wpa    Disable Wi-Fi Protected Access.

     wpaakms akm,akm,...
             Set the comma-separated list of allowed authentication and key
             management protocols.

             The supported values are ``psk'' and ``802.1x''.  psk authentica-
             tion (also known as personal mode) uses a 256-bit pre-shared key.
             802.1x authentication (also known as enterprise mode) is meant to
             be used with an external IEEE 802.1X authentication server.  The
             default value is ``psk''.  ``psk'' can only be used if a pre-
             shared key is configured using the wpapsk option.

     wpaciphers cipher,cipher,...
             Set the comma-separated list of allowed pairwise ciphers.

             The supported values are ``tkip'', ``ccmp'', and ``usegroup''.
             usegroup specifies that no pairwise ciphers are supported and
             that only group keys should be used.  The default value is
             ``tkip,ccmp''.  If multiple pairwise ciphers are specified, the
             pairwise cipher will be negotiated between the station and the
             access point at association time.  A station will always try to
             use ccmp over tkip if both ciphers are allowed and supported by
             the access point.  If the selected cipher is not supported by the
             hardware, software encryption will be used.  Check the driver's
             manual page to know which ciphers are supported in hardware.

     wpagroupcipher cipher
             Set the group cipher to be used to encrypt broadcast and multi-
             cast traffic.

             The supported values are ``wep40'', ``wep104'', ``tkip'', and
             ``ccmp''.  The default value is ``tkip''.  The use of wep40 or
             wep104 as the group cipher is discouraged due to weaknesses in
             WEP.  The wpagroupcipher option is available in Host AP mode on-
             ly.  A station will always use the group cipher of the BSS.

     wpaprotos proto,proto,...
             Set the comma-separated list of allowed WPA protocol versions.

             The supported values are ``wpa1'' and ``wpa2''.  wpa1 is based on
             draft 3 of the IEEE 802.11i standard whereas wpa2 is based on the
             ratified standard.  The default value is ``wpa1,wpa2''.  If
             ``wpa1,wpa2'' is specified, a station will always use the wpa2
             protocol when supported by the access point.

     wpapsk psk
             Set the 256-bit pre-shared key.  The pre-shared key must be spec-
             ified using a series of 64 hexadecimal digits (preceded by
             `0x').  The pre-shared key will be used only if ``psk'' authenti-
             cation is allowed using the wpaakms option.  Pre-shared keys can
             be generated from passphrases using wpa-psk(8), as in the follow-
             ing example, which configures wpi0 to join network ``my_net'' us-
             ing WPA-PSK with passphrase ``my_passphrase'':

                   # ifconfig wpi0 nwid my_net wpa wpapsk \
                           `wpa-psk my_net my_passphrase`

     -wpapsk
             Delete the pre-shared key.  This will prevent ``psk'' authentica-
             tion.

INET6
     ifconfig inet6-interface [[-]anycast] [eui64] [pltime n] [[-]tentative]
     [vltime n]

     The options are as follows:

     anycast
             Set the IPv6 anycast address bit.

     -anycast
             Clear the IPv6 anycast address bit.

     eui64   Fill the interface index (the lowermost 64th bit of an IPv6
             address) automatically.

     pltime n
             Set preferred lifetime for the address.

     tentative
             Set the IPv6 tentative address bit.

     -tentative
             Clear the IPv6 tentative address bit.

     vltime n
             Set valid lifetime for the address.

INTERFACE GROUPS
     ifconfig -g group-name [[-]carpdemote [number]]

     The options are as follows:

     -g group-name
             Specify the group.

     carpdemote [number]
             Increase carp(4) demote count for given interface group by
             number.  If number is omitted, it is increased by 1.

     -carpdemote [number]
             Decrease carp(4) demote count for given interface group by
             number.  If number is omitted, it is decreased by 1.

MPE
     ifconfig mpe-interface [mplslabel mpls-label]

     The options are as follows:

     mplslabel mpls-label
             If the interface is a mpe(4) pseudo-interface, set the MPLS label
             to mpls-label.  This value is a 20-bit number which will be used
             as the MPLS header for packets entering the MPLS domain.

PFLOW
     ifconfig pflow-interface [[-]flowdst addr:port] [[-]flowsrc addr]

     The options are as follows:

     flowdst addr:port
             Set the receiver address and the port for pflow(4) packets.  Both
             must be defined to export pflow data.  addr is the IP address and
             port is the port number of the flow collector.  Pflow data will
             be sent to this address/port.

     -flowdst
             Unset the receiver address and stop sending pflow data.

     flowsrc addr
             Set the source IP address for pflow packets.  addr is the IP ad-
             dress used as sender of the UDP packets and may be used to iden-
             tify the source of the data on the pflow collector.

     -flowsrc
             Unset the source address.

PFSYNC
     ifconfig pfsync-interface [[-]defer] [maxupd n] [[-]syncdev iface]
     [[-]syncpeer peer_address]

     The options are as follows:

     defer   Defer transmission of the first packet in a state until a peer
             has acknowledged that the associated state has been inserted.
             See pfsync(4) for more information.

     -defer  Do not defer the first packet in a state.  This is the default.

     maxupd n
             If the driver is a pfsync(4) pseudo-device, indicate the maximum
             number of updates for a single state which can be collapsed into
             one.  This is an 8-bit number; the default value is 128.

     syncdev iface
             If the driver is a pfsync(4) pseudo-device, use the specified in-
             terface to send and receive pfsync state synchronisation mes-
             sages.

     -syncdev
             If the driver is a pfsync(4) pseudo-device, stop sending pfsync
             state synchronisation messages over the network.

     syncpeer peer_address
             If the driver is a pfsync(4) pseudo-device, make the pfsync link
             point-to-point rather than using multicast to broadcast the state
             synchronisation messages.  The peer_address is the IP address of
             the other host taking part in the pfsync cluster.  With this op-
             tion, pfsync(4) traffic can be protected using ipsec(4).

     -syncpeer
             If the driver is a pfsync(4) pseudo-device, broadcast the packets
             using multicast.

PPPOE
     ifconfig pppoe-interface [authkey key] [authname name] [authproto proto]
     [[-]peerflag flag] [peerkey key] [peername name] [peerproto proto]
     [[-]pppoeac access-concentrator] [pppoedev parent-interface]
     [[-]pppoesvc service]

     pppoe(4) uses the sppp(4) "generic" SPPP framework.  Any options not de-
     scribed in the section immediately following are described in the SPPP
     section, below.  The options are as follows:

     pppoeac access-concentrator
             Set the name of the access-concentrator for the pppoe(4) inter-
             face.

     -pppoeac
             Clear a previously set access-concentrator name.

     pppoedev parent-interface
             Set the name of the interface through which pppoe(4) packets will
             be transmitted and received.

     pppoesvc service
             Set the service name of the pppoe(4) interface.

     -pppoesvc
             Clear a previously set service name.

SPPP (PPP LINK CONTROL PROTOCOL)
     ifconfig sppp-interface [authkey key] [authname name] [authproto proto]
     [[-]peerflag flag] [peerkey key] [peername name] [peerproto proto]

     The options are as follows:

     authkey key
             Set the client key or password for the PPP authentication proto-
             col.

     authname name
             Set the client name for the PPP authentication protocol.

     authproto proto
             Set the PPP authentication protocol on the specified interface
             acting as a client.  The protocol name can be either `chap',
             `pap', or `none'.  In the latter case, authentication will be
             turned off.

     peerflag flag
             Set a specified PPP flag for the remote authenticator.  The flag
             name can be either `callin' or `norechallenge'.  The `callin'
             flag will require the remote peer to authenticate only when he's
             calling in, but not when the peer is called by the local client.
             This is required for some peers that do not implement the authen-
             tication protocols symmetrically.  The `norechallenge' flag is
             only meaningful with the CHAP protocol to not re-challenge once
             the initial CHAP handshake has been successful.  This is used to
             work around broken peer implementations that can't grok being re-
             challenged once the connection is up.

     -peerflag flag
             Remove a specified PPP flag for the remote authenticator.

     peerkey key
             Set the authenticator key or password for the PPP authentication
             protocol.

     peername name
             Set the authenticator name for the PPP authentication protocol.

     peerproto proto
             Set the PPP authentication protocol on the specified interface
             acting as an authenticator.  The protocol name can be either
             `chap', `pap', or `none'.  In the latter case, authentication
             will be turned off.

TRUNK
     ifconfig trunk-interface [[-]trunkport child-iface] [trunkproto proto]

     The options are as follows:

     trunkport child-iface
             If the driver is a trunk(4) pseudo-device, add the child-iface as
             a trunk port.

     -trunkport child-iface
             If the driver is a trunk(4) pseudo-device, remove the trunk port
             child-iface.

     trunkproto proto
             If the driver is a trunk(4) pseudo-device, set the trunk proto-
             col.  Refer to the interface's driver-specific man page for a
             complete list of the available protocols, or use the following
             for a listing of choices:

                   $ ifconfig interface media

TUNNEL
     ifconfig tunnel-interface [deletetunnel src_address dest_address]
     [tunnel src_address dest_address] [tunneldomain route-id]

     The options are as follows:

     deletetunnel src_address dest_address
             Remove the source and destination tunnel addresses.

     tunnel src_address dest_address
             Set the source and destination tunnel addresses on a tunnel in-
             terface, including gif(4).  Packets routed to this interface will
             be encapsulated in IPv4 or IPv6, depending on the source and des-
             tination address families.  Both addresses must be of the same
             family.

     tunneldomain route-id
             Use routing table route-id instead of the default table.  The
             tunnel does not need to terminate in the same routing domain as
             the interface itself.  route-id can be set to any valid routing
             table ID; the corresponding routing domain is derived from this
             table.

VLAN
     ifconfig vlan-interface [vlan vlan-tag] [[-]vlandev parent-interface]
     [vlanprio vlan-priority]

     The options are as follows:

     vlan vlan-tag
             If the interface is a vlan(4) pseudo-interface, set the vlan tag
             value to vlan-tag.  This value is a 12-bit number which is used
             to create an 802.1Q vlan header for packets sent from the vlan
             interface.  This value cannot be changed once it is set for an
             interface.

     vlandev parent-interface
             If the interface is a vlan(4) pseudo-device, associate physical
             interface iface with it.  Packets transmitted through the vlan
             interface will be diverted to the specified physical interface
             iface with 802.1Q vlan encapsulation.  Packets with 802.1Q encap-
             sulation received by the parent interface with the correct vlan
             tag will be diverted to the associated vlan pseudo-interface.
             The vlan interface is assigned a copy of the parent interface's
             flags and the parent's Ethernet address.  If vlandev and vlan are
             not set at the same time, the vlan tag will be inferred from the
             interface name, for instance vlan5 will be assigned 802.1Q tag 5.
             If the vlan interface already has a physical interface associated
             with it, this command will fail.  To change the association to
             another physical interface, the existing association must be
             cleared first.

     -vlandev
             If the driver is a vlan(4) pseudo-device, disassociate the physi-
             cal interface from it.  This breaks the link between the vlan in-
             terface and its parent, clears its vlan tag, flags, and link ad-
             dress, and shuts the interface down.

     vlanprio vlan-priority
             If the interface is a vlan(4) pseudo-interface, set the vlan pri-
             ority value to vlan-priority.  This value is a 3-bit number which
             is used to create an 802.1Q vlan header for packets sent from the
             vlan interface.

EXAMPLES
     Assign the address of 192.168.1.10 with a network mask of 255.255.255.0
     to interface fxp0:

           # ifconfig fxp0 inet 192.168.1.10 netmask 255.255.255.0

     Configure the xl0 interface to use 100baseTX, full duplex:

           # ifconfig xl0 media 100baseTX mediaopt full-duplex

     Label the em0 interface as an uplink:

           # ifconfig em0 description "Uplink to Gigabit Switch 2"

     Create the gif1 network interface:

           # ifconfig gif1 create

     Scan for wireless networks using bwi0:

           # ifconfig bwi0 scan

DIAGNOSTICS
     Messages indicating the specified interface does not exist, the requested
     address is unknown, or the user is not privileged and tried to alter an
     interface's configuration.

SEE ALSO
     netstat(1), ifmedia(4), inet(4), intro(4), netintro(4), hostname.if(5),
     hosts(5), networks(5), rc(8), tcpdump(8)

HISTORY
     The ifconfig command appeared in 4.2BSD.

OpenBSD 4.7                    November 23, 2009                            16
