How to find name of currently-active network interface?

Question

I need to get the name of the network interface (e.g. eth0, wlan0) that is the currently-active one, the one sending and receiving traffic at the moment. When it's connected to WiFi, it would be wlan0 but when it's connected directly it would be eth0. Or something else, depending on the network devices on the system and which one is active. How can I find this out?

Solution 1

Open a terminal and run the command:

ifconfig

The active interface will have an IP address and transmitted and received bytes. Here is an example:

eth0  Link encap:Ethernet  HWaddr xx:a8:6b:fe:06:xx
      inet addr:192.168.1.14  Bcast:192.168.1.255  Mask:255.255.255.0
      inet6 addr: fe80::eea8:6bff:fefe:696/64 Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:449232 errors:0 dropped:0 overruns:0 frame:0
      TX packets:309483 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000 
      RX bytes:633900275 (633.9 MB)  TX bytes:27944824 (27.9 MB)

Check if the ethernet interface is used:

ping -c3 -I eth0 www.google.com
ping: Warning: source address might be selected on device other than eth0.
PING www.google.com (74.125.228.145) from 192.168.1.100 eth0: 56(84) bytes of data.Wi-Fi
From Think410 (192.168.1.100) icmp_seq=1 Destination Host Unreachable
From Think410 (192.168.1.100) icmp_seq=2 Destination Host Unreachable
From Think410 (192.168.1.100) icmp_seq=3 Destination Host Unreachable

Verify that the wireless interface is used:

ping -c3 -I wlan0 www.google.com
PING www.google.com (74.125.228.148) from 192.168.1.100 wlan0: 56(84) bytes of data.
64 bytes from iad23s17-in-f20.1e100.net (74.125.228.148): icmp_seq=1 ttl=50 time=37.5 ms
64 bytes from iad23s17-in-f20.1e100.net (74.125.228.148): icmp_seq=2 ttl=50 time=36.8 ms
64 bytes from iad23s17-in-f20.1e100.net (74.125.228.148): icmp_seq=3 ttl=50 time=35.9 ms

So, obviously, internet traffic is currently routed through wlan0, my wireless interface.

It is possible to have both ethernet and wireless connected simultaneously. Normally, Network Manager will disallow it, preferring ethernet over wireless because it is generally faster and more secure. If one wanted to use ethernet for the LAN and wireless for the WAN (internet), one would typically remove NM and set all the details manually in /etc/network/interfaces.

Solution 2

A good way to figure out the interface where particular traffic would go is to use ip route get Just use say Google (8.8.8.8) or Cloudflare (1.1.1.1) DNS servers to figure out which interface internet traffic would go through:

$ ip route get 1.1.1.1
1.1.1.1 via 192.168.2.1 dev eth0 src 192.168.2.155 uid 0
    cache

Then you can do stuff like set a variable with the interface that is used for internet:

LANIFACE=$(ip route get 1.1.1.1 | grep -Po '(?<=dev\s)\w+' | cut -f1 -d ' ')

Then you can also get the IP address of the interface:

LANIP=$(ip addr show "$LANIFACE" | grep "inet " | cut -d '/' -f1 | cut -d ' ' -f6)

Don't forget the same method can also work for other networks, not just ones on the internet.

Solution 3

No need for ping to hunt-and-peck. Use ip link; it has more germane info than ifconfig. Each interface will report something like

• LOOPBACK, meaning active but never goes external (wired or wireless)
• NO-CARRIER, meaning external but no signal being generated
• BROADCAST, meaning external and is active
• LOWER-UP, meaning PHY is enabled

You can have two or more external interfaces with LOWER-UP but generally a bad idea. Here's my laptop with loopback (notice LOWER_UP), down ethernet, wlan0 up and generating a signal, wlan4 (USB wifi) UP but NOT generating a signal, wlan4.mon monitor mode sniffing all stations on BSS (notice LOWER-UP). wlan4.mon does not transmit.

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN qlen 1000
    link/ether 24:b6:fd:24:59:b9 brd ff:ff:ff:ff:ff:ff
3: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 4c:eb:42:32:0c:9e brd ff:ff:ff:ff:ff:ff
26: wlan4: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN qlen 1000
    link/ether 00:26:f2:b3:d7:93 brd ff:ff:ff:ff:ff:ff
27: wlan4.mon: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UNKNOWN qlen 1000
    link/ieee802.11/radiotap 00:26:f2:b3:d7:93 brd ff:ff:ff:ff:ff:ffter code here

Solution 4

If you have only one interface that is being used to reach internet, you can try the following commands.

ip route get 8.8.8.8| awk '{print $5}'|awk /./

The above will tell you about interface through which the traffic is routed.

In-order to get the ip of the interface you can do the following

ip a s ens33| grep -w inet|awk '{print $2}'

Here ens33 is the interface name that you found from the first command.

If you have multiple interfaces that can reach internet.

You can find the interfaces as follows.

route -n | grep -E  '^0.0.0.0'|awk '{print $8}'

The above will provide you the list of the interfaces with access to internet and active.

You can find the Ip's assigned to the interface as follows.

myinterf=$(route -n | grep -E  '^0.0.0.0'|awk '{print $8}') ; for i in $myinterf ; do ip a s ${i}| grep -w inet|awk '{print $2}' ; done

Note: You will be able to see only ipv4 address using grep -w 'inet', in-order to find ipv6 you need to enter the command as grep -w 'inet6'. The rest remains same.

Solution 5

If you want a little more detail try jnettop this tool shows you detailed traffic monitoring in the terminal.

sudo apt-get install jnettop

once installed simply type jnettop in the terminal

View more solutions

Comments

[user779159]

In my system I see a large number of RX and TX packets for both eth0 and wlan0. I guess these numbers are not cleared when switching between wired/wireless networks? So I can't use that to tell. However, inet addr only appears for the one I'm currently connected to, so that looks like that could work. However, couldn't there be times when both show an IP? Like if I'm connected by a cable to another device but WiFi is to the internet? Is there a way to tell which of the 2 is sending you online?

[chili555]

Please see my edit.

[Admin]

alternatively ip route get 1.1.1.1 |grep -oP 'dev\s+\K[^ ]+'