Copyright (c) 2008, Sun Microsystems, Inc. All Rights Reserved
Copyright 2016 Joyent, Inc.
Sun Microsystems, Inc. gratefully acknowledges The Open Group for permission to reproduce portions of its copyrighted documentation. Original documentation from The Open Group can be obtained online at http://www.opengroup.org/bookstore/.
The Institute of Electrical and Electronics Engineers and The Open Group, have given us permission to reprint portions of their documentation. In the following statement, the phrase "this text" refers to portions of the system documentation. Portions of this text
are reprinted and reproduced in electronic form in the Sun OS Reference Manual, from IEEE Std 1003.1, 2004 Edition, Standard for Information Technology -- Portable Operating System Interface (POSIX), The Open Group Base Specifications Issue 6, Copyright (C) 2001-2004 by the Institute of Electrical
and Electronics Engineers, Inc and The Open Group. In the event of any discrepancy between these versions and the original IEEE and The Open Group Standard, the original IEEE and The Open Group Standard is the referee document. The original Standard can be obtained online at http://www.opengroup.org/unix/online.html.
This notice shall appear on any product containing this material.
The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the
fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
dladm show-link [-P] [-s [-i interval]] [[-p] -o field[,...]] [link] dladm rename-link [-R root-dir] link new-link
dladm delete-phys phys-link dladm show-phys [-m | -H | -P] [[-p] -o field[,...]] [phys-link]
dladm create-aggr [-t] [-R root-dir] [-P policy] [-L mode] [-T time] [-u address] -l ether-link1 [-l ether-link2...] aggr-link dladm modify-aggr [-t] [-R root-dir] [-P policy] [-L mode] [-T time] [-u address] aggr-link dladm delete-aggr [-t] [-R root-dir] aggr-link dladm add-aggr [-t] [-R root-dir] -l ether-link1 [-l ether-link2...] aggr-link dladm remove-aggr [-t] [-R root-dir] -l ether-link1 [-l ether-link2...] aggr-link dladm show-aggr [-PLx] [-s [-i interval]] [[-p] -o field[,...]] [aggr-link]
dladm create-bridge [-P protect] [-R root-dir] [-p priority] [-m max-age] [-h hello-time] [-d forward-delay] [-f force-protocol] [-l link...] bridge-name
dladm modify-bridge [-P protect] [-R root-dir] [-p priority] [-m max-age] [-h hello-time] [-d forward-delay] [-f force-protocol] bridge-name
dladm delete-bridge [-R root-dir] bridge-name
dladm add-bridge [-R root-dir] -l link [-l link...]bridge-name
dladm remove-bridge [-R root-dir] -l link [-l link...] bridge-name
dladm show-bridge [-flt] [-s [-i interval]] [[-p] -o field,...] [bridge-name]
dladm create-vlan [-ft] [-R root-dir] -l ether-link -v vid [vlan-link] dladm delete-vlan [-t] [-R root-dir] vlan-link dladm show-vlan [-P] [[-p] -o field[,...]] [vlan-link]
dladm scan-wifi [[-p] -o field[,...]] [wifi-link] dladm connect-wifi [-e essid] [-i bssid] [-k key,...] [-s none | wep | wpa ] [-a open | shared] [-b bss | ibss] [-c] [-m a | b | g] [-T time] [wifi-link] dladm disconnect-wifi [-a] [wifi-link] dladm show-wifi [[-p] -o field[,...]] [wifi-link]
dladm show-ether [-x] [[-p] -o field[,...]] [ether-link]
dladm set-linkprop [-t] [-R root-dir] -p prop=value[,...] link dladm reset-linkprop [-t] [-R root-dir] [-p prop[,...]] link dladm show-linkprop [-P] [[-c] -o field[,...]] [-p prop[,...]] [link]
dladm create-secobj [-t] [-R root-dir] [-f file] -c class secobj dladm delete-secobj [-t] [-R root-dir] secobj[,...] dladm show-secobj [-P] [[-p] -o field[,...]] [secobj,...]
dladm create-vnic [-t] -l link [-R root-dir] [-m value | auto | {factory -n slot-identifier]} | {random [-r prefix]}] [-v vlan-id] [-p prop=value[,...]] vnic-link dladm delete-vnic [-t] [-R root-dir] vnic-link dladm show-vnic [-pP] [-s [-i interval]] [-o field[,...]] [-l link] [vnic-link]
dladm create-etherstub [-t] [-R root-dir] etherstub dladm delete-etherstub [-t] [-R root-dir] etherstub dladm show-etherstub [etherstub]
dladm create-iptun [-t] [-R root-dir] -T type [-a {local|remote}=<addr>[,...]] iptun-link dladm modify-iptun [-t] [-R root-dir] [-a {local|remote}=<addr>[,...]] iptun-link dladm delete-iptun [-t] [-R root-dir] iptun-link dladm show-iptun [-P] [[-p] -o field[,...]] [iptun-link]
dladm show-usage [-a] -f filename [-p plotfile -F format] [-s time] [-e time] [link]
The dladm command is used to administer data-links. A data-link is represented in the system as a STREAMS DLPI (v2) interface which can be plumbed under protocol stacks such as TCP/IP. Each data-link relies on either a single network device or an aggregation of devices to send packets to or receive packets from a network.
Each dladm subcommand operates on one of the following objects: link
A datalink, identified by a name. In general, the name can use any alphanumeric characters (or the underscore, _), but must start with an alphabetic character and end with a number. A datalink name can be at most 31 characters, and the ending number must be between 0 and 4294967294 (inclusive). The ending number must not begin with a zero. Datalink names between 3 and 8 characters are recommended. Some subcommands operate only on certain types or classes of datalinks. For those cases, the following object names are used: phys-link
A physical datalink.
A VLAN datalink.
An aggregation datalink (or a key; see NOTES).
A physical Ethernet datalink.
A WiFi datalink.
A virtual network interface created on a link or an etherstub. It is a pseudo device that can be treated as if it were an network interface card on a machine.
An IP tunnel link.
A network device, identified by concatenation of a driver name and an instance number.
An Ethernet stub can be used instead of a physical NIC to create VNICs. VNICs created on an etherstub will appear to be connected through a virtual switch, allowing complete virtual networks to be built without physical hardware.
A bridge instance, identified by an administratively-chosen name. The name may use any alphanumeric characters or the underscore, _, but must start and end with an alphabetic character. A bridge name can be at most 31 characters. The name default is reserved, as are all names starting with SUNW. Note that appending a zero (0) to a bridge name produces a valid link name, used for observability.
A secure object, identified by an administratively-chosen name. The name can use any alphanumeric characters, as well as underscore (_), period (.), and hyphen (-). A secure object name can be at most 32 characters.
Each dladm subcommand has its own set of options. However, many of the subcommands have the following as a common option: -R root-dir, --root-dir=root-dir
Specifies an alternate root directory where the operation-such as creation, deletion, or renaming-should apply.
The following subcommands are supported: dladm show-link [-P] [-s [-i interval]] [[-p] -o field[,...]][link]
Show link configuration information (the default) or statistics, either for all datalinks or for the specified link link. By default, the system is configured with one datalink for each known network device. -o field[,...], --output=field[,...]
A case-insensitive, comma-separated list of output fields to display. When not modified by the -s option (described below), the field name must be one of the fields listed below, or the special value all to display all fields. By default (without -o), show-link displays all fields. LINK
The name of the datalink.
The class of the datalink. dladm distinguishes between the following classes: phys
A physical datalink. The show-phys subcommand displays more detail for this class of datalink.
An IEEE 802.3ad link aggregation. The show-aggr subcommand displays more detail for this class of datalink.
A VLAN datalink. The show-vlan subcommand displays more detail for this class of datalink.
A virtual network interface. The show-vnic subcommand displays more detail for this class of datalink.
The maximum transmission unit size for the datalink being displayed.
The link state of the datalink. The state can be up, down, or unknown.
The name of the bridge to which this link is assigned, if any.
The physical datalink(s) over which the datalink is operating. This applies to aggr, bridge, and vlan classes of datalinks. A VLAN is created over a single physical datalink, a bridge has multiple attached links, and an aggregation is comprised of one or more physical datalinks.
The name of the datalink.
Number of packets received on this link.
Number of bytes received on this link.
Number of input errors.
Number of packets sent on this link.
Number of bytes received on this link.
Number of output errors.
Display using a stable machine-parsable format. The -o option is required with -p. See "Parsable Output Format", below.
Display the persistent link configuration.
Display link statistics.
Used with the -s option to specify an interval, in seconds, at which statistics should be displayed. If this option is not specified, statistics will be displayed only once.
Rename link to new-link. This is used to give a link a meaningful name, or to associate existing link configuration such as link properties of a removed device with a new device. See the EXAMPLES section for specific examples of how this subcommand is used. -R root-dir, --root-dir=root-dir
See "Options," above.
This command is used to delete the persistent configuration of a link associated with physical hardware which has been removed from the system. See the EXAMPLES section.
Show the physical device and attributes of all physical links, or of the named physical link. Without -P, only physical links that are available on the running system are displayed. -H
Show hardware resource usage, as returned by the NIC driver. Output from -H displays the following elements: LINK
A physical device corresponding to a NIC driver.
A collection of rings.
RX or TX. All rings in a group are of the same group type.
A hardware resource used by a data link, subject to assignment by a driver to different groups.
MAC clients that are using the rings within a group.
Show MAC addresses and related information. Output from -m displays the following elements: LINK
A physical device corresponding to a NIC driver.
When a given physical device has multiple factory MAC addresses, this indicates the slot of the corresponding MAC address which can be used as part of a call to create-vnic.
Displays the MAC address of the device.
Displays whether or not a MAC Address is actively being used.
MAC clients that are using the address.
A case-insensitive, comma-separated list of output fields to display. The field name must be one of the fields listed below, or the special value all, to display all fields. Note that if either -H or -m are specified, then the valid options are those described in their respective sections. For each link, the following fields can be displayed: LINK
The name of the datalink.
The media type provided by the physical datalink.
The state of the link. This can be up, down, or unknown.
The current speed of the link, in megabits per second.
For Ethernet links, the full/half duplex status of the link is displayed if the link state is up. The duplex is displayed as unknown in all other cases.
The name of the physical device under this link.
Display using a stable machine-parsable format. The -o option is required with -p. See "Parsable Output Format", below.
This option displays persistent configuration for all links, including those that have been removed from the system. The output provides a FLAGS column in which the r flag indicates that the physical device associated with a physical link has been removed. For such links, delete-phys can be used to purge the link's configuration from the system.
Combine a set of links into a single IEEE 802.3ad link aggregation named aggr-link. The use of an integer key to generate a link name for the aggregation is also supported for backward compatibility. Many of the *-aggr subcommands below also support the use of a key to refer to a given aggregation, but use of the aggregation link name is preferred. See the NOTES section for more information on keys. dladm supports a number of port selection policies for an aggregation of ports. (See the description of the -P option, below.) If you do not specify a policy, create-aggr uses the default, the L4 policy, described under the -P option. -l ether-link, --link=ether-link
Each Ethernet link (or port) in the aggregation is specified using an -l option followed by the name of the link to be included in the aggregation. Multiple links are included in the aggregation by specifying multiple -l options. For backward compatibility with previous versions of Solaris, the dladm command also supports the using the -d option (or --dev) with a device name to specify links by their underlying device name. The other *-aggr subcommands that take -loptions also accept -d.
Specifies that the aggregation is temporary. Temporary aggregations last until the next reboot.
See "Options," above.
Specifies the port selection policy to use for load spreading of outbound traffic. The policy specifies which dev object is used to send packets. A policy is a list of one or more layers specifiers separated by commas. A layer specifier is one of the following: L2
Select outbound device according to source and destination MAC addresses of the packet.
Select outbound device according to source and destination IP addresses of the packet.
Select outbound device according to the upper layer protocol information contained in the packet. For TCP and UDP, this includes source and destination ports. For IPsec, this includes the SPI (Security Parameters Index).
-P L4Note that policy L4 is the default. To use the source and destination MAC addresses as well as the source and destination IP addresses, the following policy can be used:
-P L2,L3
Specifies whether LACP should be used and, if used, the mode in which it should operate. Supported values are off, active or passive.
Specifies the LACP timer value. The supported values are short or longjjj.
Specifies a fixed unicast hardware address to be used for the aggregation. If this option is not specified, then an address is automatically chosen from the set of addresses of the component devices.
Modify the parameters of the specified aggregation. -t, --temporary
Specifies that the modification is temporary. Temporary aggregations last until the next reboot.
See "Options," above.
Specifies the port selection policy to use for load spreading of outbound traffic. See dladm create-aggr for a description of valid policy values.
Specifies whether LACP should be used and, if used, the mode in which it should operate. Supported values are off, active, or passive.
Specifies the LACP timer value. The supported values are short or long.
Specifies a fixed unicast hardware address to be used for the aggregation. If this option is not specified, then an address is automatically chosen from the set of addresses of the component devices.
Deletes the specified aggregation. -t, --temporary
Specifies that the deletion is temporary. Temporary deletions last until the next reboot.
See "Options," above.
Adds links to the specified aggregation. -l ether-link, --link=ether-link
Specifies an Ethernet link to add to the aggregation. Multiple links can be added by supplying multiple -l options.
Specifies that the additions are temporary. Temporary additions last until the next reboot.
See "Options," above.
Removes links from the specified aggregation. -l ether-link, --link=ether-link
Specifies an Ethernet link to remove from the aggregation. Multiple links can be added by supplying multiple -l options.
Specifies that the removals are temporary. Temporary removal last until the next reboot.
See "Options," above.
Show aggregation configuration (the default), LACP information, or statistics, either for all aggregations or for the specified aggregation. By default (with no options), the following fields can be displayed: LINK
The name of the aggregation link.
The LACP policy of the aggregation. See the create-aggr -P option for a description of the possible values.
Either auto, if the aggregation is configured to automatically configure its unicast MAC address (the default if the -u option was not used to create or modify the aggregation), or fixed, if -u was used to set a fixed MAC address.
The LACP mode of the aggregation. Possible values are off, active, or passive, as set by the -l option to create-aggr or modify-aggr.
The LACP timer value of the aggregation as set by the -T option of create-aggr or modify-aggr.
A set of state flags associated with the aggregation. The only possible flag is f, which is displayed if the administrator forced the creation the aggregation using the -f option to create-aggr. Other flags might be defined in the future.
Displays detailed LACP information for the aggregation link and each underlying port. Most of the state information displayed by this option is defined by IEEE 802.3. With this option, the following fields can be displayed: LINK
The name of the aggregation link.
The name of one of the underlying aggregation ports.
Whether the port can be added to the aggregation.
If yes, the system considers the port to be synchronized and part of the aggregation.
If yes, collection of incoming frames is enabled on the associated port.
If yes, distribution of outgoing frames is enabled on the associated port.
If yes, the port is using defaulted partner information (that is, has not received LACP data from the LACP partner).
If yes, the receive state of the port is in the EXPIRED state.
Display additional aggregation information including detailed information on each underlying port. With -x, the following fields can be displayed: LINK
The name of the aggregation link.
The name of one of the underlying aggregation ports.
The speed of the link or port in megabits per second.
The full/half duplex status of the link or port is displayed if the link state is up. The duplex status is displayed as unknown in all other cases.
The link state. This can be up, down, or unknown.
The MAC address of the link or port.
This indicates whether the individual aggregation port is in the standby or attached state.
A case-insensitive, comma-separated list of output fields to display. The field name must be one of the fields listed above, or the special value all, to display all fields. The fields applicable to the -o option are limited to those listed under each output mode. For example, if using -L, only the fields listed under -L, above, can be used with -o.
Display using a stable machine-parsable format. The -o option is required with -p. See "Parsable Output Format", below.
Display the persistent aggregation configuration rather than the state of the running system.
Displays aggregation statistics.
Used with the -s option to specify an interval, in seconds, at which statistics should be displayed. If this option is not specified, statistics will be displayed only once.
Create an 802.1D bridge instance and optionally assign one or more network links to the new bridge. By default, no bridge instances are present on the system. In order to bridge between links, you must create at least one bridge instance. Each bridge instance is separate, and there is no forwarding connection between bridges. -P protect, --protect=protect
Specifies a protection method. The defined protection methods are stp for the Spanning Tree Protocol and trill for TRILL, which is used on RBridges. The default value is stp.
See "Options," above.
Specifies the Bridge Priority. This sets the IEEE STP priority value for determining the root bridge node in the network. The default value is 32768. Valid values are 0 (highest priority) to 61440 (lowest priority), in increments of 4096. If a value not evenly divisible by 4096 is used, the system silently rounds downward to the next lower value that is divisible by 4096.
Specifies the maximum age for configuration information in seconds. This sets the STP Bridge Max Age parameter. This value is used for all nodes in the network if this node is the root bridge. Bridge link information older than this time is discarded. It defaults to 20 seconds. Valid values are from 6 to 40 seconds. See the -d forward-delay parameter for additional constraints.
Specifies the STP Bridge Hello Time parameter. When this node is the root node, it sends Configuration BPDUs at this interval throughout the network. The default value is 2 seconds. Valid values are from 1 to 10 seconds. See the -d forward-delay parameter for additional constraints.
Specifies the STP Bridge Forward Delay parameter. When this node is the root node, then all bridges in the network use this timer to sequence the link states when a port is enabled. The default value is 15 seconds. Valid values are from 4 to 30 seconds. Bridges must obey the following two constraints:
2 * (forward-delay - 1.0) >= max-age max-age >= 2 * (hello-time + 1.0)Any parameter setting that would violate those constraints is treated as an error and causes the command to fail with a diagnostic message. The message provides valid alternatives to the supplied values.
Specifies the MSTP forced maximum supported protocol. The default value is 3. Valid values are non-negative integers. The current implementation does not support RSTP or MSTP, so this currently has no effect. However, to prevent MSTP from being used in the future, the parameter may be set to 0 for STP only or 2 for STP and RSTP.
Specifies one or more links to add to the newly-created bridge. This is similar to creating the bridge and then adding one or more links, as with the add-bridge subcommand. However, if any of the links cannot be added, the entire command fails, and the new bridge itself is not created. To add multiple links on the same command line, repeat this option for each link. You are permitted to create bridges without links. For more information about link assignments, see the add-bridge subcommand.
Modify the operational parameters of an existing bridge. The options are the same as for the create-bridge subcommand, except that the -l option is not permitted. To add links to an existing bridge, use the add-bridge subcommand. Bridge parameter modification requires the PRIV_SYS_DL_CONFIG privilege.
Delete a bridge instance. The bridge being deleted must not have any attached links. Use the remove-bridge subcommand to deactivate links before deleting a bridge. Bridge deletion requires the PRIV_SYS_DL_CONFIG privilege. The -R (--root-dir) option is the same as for the create-bridge subcommand.
Add one or more links to an existing bridge. If multiple links are specified, and adding any one of them results in an error, the command fails and no changes are made to the system. Link addition to a bridge requires the PRIV_SYS_DL_CONFIG privilege. A link may be a member of at most one bridge. An error occurs when you attempt to add a link that already belongs to another bridge. To move a link from one bridge instance to another, remove it from the current bridge before adding it to a new one. The links assigned to a bridge must not also be VLANs, VNICs, or tunnels. Only physical Ethernet datalinks, aggregation datalinks, wireless links, and Ethernet stubs are permitted to be assigned to a bridge. Links assigned to a bridge must all have the same MTU. This is checked when the link is assigned. The link is added to the bridge in a deactivated form if it is not the first link on the bridge and it has a differing MTU. Note that systems using bridging should not set the eeprom(1M) local-mac-address? variable to false. The options are the same as for the create-bridge subcommand.
Remove one or more links from a bridge instance. If multiple links are specified, and removing any one of them would result in an error, the command fails and none are removed. Link removal from a bridge requires the PRIV_SYS_DL_CONFIG privilege. The options are the same as for the create-bridge subcommand.
Show the running status and configuration of bridges, their attached links, learned forwarding entries, and TRILL nickname databases. When showing overall bridge status and configuration, the bridge name can be omitted to show all bridges. The other forms require a specified bridge. The show-bridge subcommand accepts the following options: -i interval, --interval=interval
Used with the -s option to specify an interval, in seconds, at which statistics should be displayed. If this option is not specified, statistics will be displayed only once.
Display statistics for the specified bridges or for a given bridge's attached links. This option cannot be used with the -f and -t options.
Display using a stable machine-parsable format. See "Parsable Output Format," below.
A case-insensitive, comma-separated list of output fields to display. The field names are described below. The special value all displays all fields. Each set of fields has its own default set to display when -o is not specified.
The name of the bridge.
The Bridge Unique Identifier value (MAC address).
Configured priority value; set by -p with create-bridge and modify-bridge.
Configured bridge maximum age; set by -m with create-bridge and modify-bridge.
Configured bridge hello time; set by -h with create-bridge and modify-bridge.
Configured forwarding delay; set by -d with create-bridge and modify-bridge.
Configured forced maximum protocol; set by -f with create-bridge and modify-bridge.
Time, in seconds, since last topology change.
Count of the number of topology changes.
This indicates that a topology change was detected.
Bridge Identifier of the root node.
Cost of the path to the root node.
Port number used to reach the root node.
Maximum age value from the root node.
Hello time value from the root node.
Forward delay value from the root node.
Minimum BPDU interval.
Bridge name.
Number of packets dropped due to resource problems.
Number of packets forwarded from one link to another.
Number of multicast and broadcast packets handled by the bridge.
Number of packets received on all attached links.
Number of packets sent on all attached links.
Number of packets handled that have an unknown destination. Such packets are sent to all links.
Displays link-related status and statistics information for all links attached to a single bridge instance. By using this option and without the -s option, the following fields can be displayed for each link: LINK
The link name.
Port (link) index number on the bridge.
State of the link. The state can be disabled, discarding, learning, forwarding, non-stp, or bad-mtu.
Number of seconds since the last reset or initialization.
Actual cost in use (1-65535).
This indicates whether point-to-point (P2P) mode been detected.
This indicates whether edge mode has been detected.
The Root Bridge Identifier that has been seen on this port.
Path cost to the network root node through the designated port.
Bridge Identifier for this port.
The ID and priority of the port used to transmit configuration messages for this port.
This indicates whether Topology Change Acknowledge has been seen.
Link name.
Number of configuration BPDUs received.
Number of topology change BPDUs received.
Number of Rapid Spanning Tree BPDUs received.
Number of BPDUs transmitted.
Number of packets dropped due to resource problems.
Number of packets received by the bridge.
Number of packets sent by the bridge.
Displays forwarding entries for a single bridge instance. With this option, the following fields can be shown for each forwarding entry: DEST
Destination MAC address.
Age of entry in seconds and milliseconds. Omitted for local entries.
The L (local) flag is shown if the MAC address belongs to an attached link or to a VNIC on one of the attached links.
For local entries, this is the name of the attached link that has the MAC address. Otherwise, for bridges that use Spanning Tree Protocol, this is the output interface name. For RBridges, this is the output TRILL nickname.
Displays TRILL nickname entries for a single bridge instance. With this option, the following fields can be shown for each TRILL nickname entry: NICK
TRILL nickname for this RBridge, which is a number from 1 to 65535.
The L flag is shown if the nickname identifies the local system.
Link name for output when sending messages to this RBridge.
MAC address of the next hop RBridge that is used to reach the RBridge with this nickname.
Create a tagged VLAN link with an ID of vid over Ethernet link ether-link. The name of the VLAN link can be specified as vlan-link. If the name is not specified, a name will be automatically generated (assuming that ether-link is namePPA) as:
<name><1000 * vlan-tag + PPA>For example, if ether-link is bge1 and vid is 2, the name generated is bge2001. -f, --force
Force the creation of the VLAN link. Some devices do not allow frame sizes large enough to include a VLAN header. When creating a VLAN link over such a device, the -f option is needed, and the MTU of the IP interfaces on the resulting VLAN must be set to 1496 instead of 1500.
Specifies Ethernet link over which VLAN is created.
Specifies that the VLAN link is temporary. Temporary VLAN links last until the next reboot.
See "Options," above.
Delete the VLAN link specified. The delete-vlan subcommand accepts the following options: -t, --temporary
Specifies that the deletion is temporary. Temporary deletions last until the next reboot.
See "Options," above.
Display VLAN configuration for all VLAN links or for the specified VLAN link. The show-vlansubcommand accepts the following options: -o field[,...], --output=field[,...]
A case-insensitive, comma-separated list of output fields to display. The field name must be one of the fields listed below, or the special value all, to display all fields. For each VLAN link, the following fields can be displayed: LINK
The name of the VLAN link.
The ID associated with the VLAN.
The name of the physical link over which this VLAN is configured.
A set of flags associated with the VLAN link. Possible flags are: f
The VLAN was created using the -f option to create-vlan.
The VLAN was implicitly created when the DLPI link was opened. These VLAN links are automatically deleted on last close of the DLPI link (for example, when the IP interface associated with the VLAN link is unplumbed).
Display using a stable machine-parsable format. The -o option is required with -p. See "Parsable Output Format", below.
Display the persistent VLAN configuration rather than the state of the running system.
Scans for WiFi networks, either on all WiFi links, or just on the specified wifi-link. By default, currently all fields but BSSTYPE are displayed. -o field[,...], --output=field[,...]
A case-insensitive, comma-separated list of output fields to display. The field name must be one of the fields listed below, or the special value all to display all fields. For each WiFi network found, the following fields can be displayed: LINK
The name of the link the WiFi network is on.
The ESSID (name) of the WiFi network.
Either the hardware address of the WiFi network's Access Point (for BSS networks), or the WiFi network's randomly generated unique token (for IBSS networks).
Either none for a WiFi network that uses no security, wep for a WiFi network that requires WEP (Wired Equivalent Privacy), or wpa for a WiFi network that requires WPA (Wi-Fi Protected Access).
The supported connection modes: one or more of a, b, or g.
The strength of the signal: one of excellent, very good, good, weak, or very weak.
The maximum speed of the WiFi network, in megabits per second.
Either bss for BSS (infrastructure) networks, or ibss for IBSS (ad-hoc) networks.
Display using a stable machine-parsable format. The -o option is required with -p. See "Parsable Output Format", below.
Connects to a WiFi network. This consists of four steps: discovery, filtration, prioritization, and association. However, to enable connections to non-broadcast WiFi networks and to improve performance, if a BSSID or ESSID is specified using the -e or -i options, then the first three steps are skipped and connect-wifi immediately attempts to associate with a BSSID or ESSID that matches the rest of the provided parameters. If this association fails, but there is a possibility that other networks matching the specified criteria exist, then the traditional discovery process begins as specified below. The discovery step finds all available WiFi networks on the specified WiFi link, which must not yet be connected. For administrative convenience, if there is only one WiFi link on the system, wifi-link can be omitted. Once discovery is complete, the list of networks is filtered according to the value of the following options: -e essid, --essid=essid
Networks that do not have the same essid are filtered out.
Networks that do not have the same bsstype are filtered out.
Networks not appropriate for the specified 802.11 mode are filtered out.
Use the specified secobj named by the key to connect to the network. Networks not appropriate for the specified keys are filtered out.
Networks not appropriate for the specified security mode are filtered out.
Connect using the specified authentication mode. By default, open and shared are tried in order.
Used with -b ibss to create a new ad-hoc network if one matching the specified ESSID cannot be found. If no ESSID is specified, then -c -b ibss always triggers the creation of a new ad-hoc network.
Specifies the number of seconds to wait for association to succeed. If time is forever, then the associate will wait indefinitely. The current default is ten seconds, but this might change in the future. Timeouts shorter than the default might not succeed reliably.
In addition to the filtering previously described, the specified keys will be used to secure the association. The security mode to use will be based on the key class; if a security mode was explicitly specified, it must be compatible with the key class. All keys must be of the same class. For security modes that support multiple key slots, the slot to place the key will be specified by a colon followed by an index. Therefore, -k mykey:3 places mykey in slot 3. By default, slot 1 is assumed. For security modes that support multiple keys, a comma-separated list can be specified, with the first key being the active key.
Disconnect from one or more WiFi networks. If wifi-link specifies a connected WiFi link, then it is disconnected. For administrative convenience, if only one WiFi link is connected, wifi-link can be omitted. -a, --all-links
Disconnects from all connected links. This is primarily intended for use by scripts.
Shows WiFi configuration information either for all WiFi links or for the specified link wifi-link. -o field,..., --output=field
A case-insensitive, comma-separated list of output fields to display. The field name must be one of the fields listed below, or the special value all, to display all fields. For each WiFi link, the following fields can be displayed: LINK
The name of the link being displayed.
Either connected if the link is connected, or disconnected if it is not connected. If the link is disconnected, all remaining fields have the value --.
The ESSID (name) of the connected WiFi network.
Either the hardware address of the WiFi network's Access Point (for BSS networks), or the WiFi network's randomly generated unique token (for IBSS networks).
Either none for a WiFi network that uses no security, wep for a WiFi network that requires WEP, or wpa for a WiFi network that requires WPA.
The supported connection modes: one or more of a, b, or g.
The connection strength: one of excellent, very good, good, weak, or very weak.
The connection speed, in megabits per second.
Either open or shared (see connect-wifi).
Either bss for BSS (infrastructure) networks, or ibss for IBSS (ad-hoc) networks.
Displays using a stable machine-parsable format. The -o option is required with -p. See "Parsable Output Format", below.
Shows state information either for all physical Ethernet links or for a specified physical Ethernet link. The show-ether subcommand accepts the following options: -o field,..., --output=field
A case-insensitive, comma-separated list of output fields to display. The field name must be one of the fields listed below, or the special value all to display all fields. For each link, the following fields can be displayed: LINK
The name of the link being displayed.
Parameter type, where current indicates the negotiated state of the link, capable indicates capabilities supported by the device, adv indicates the advertised capabilities, and peeradv indicates the capabilities advertised by the link-partner.
The state of the link.
A yes/no value indicating whether auto-negotiation is advertised.
Combinations of speed and duplex values available. The units of speed are encoded with a trailing suffix of G (Gigabits/s) or M (Mb/s). Duplex values are encoded as f (full-duplex) or h (half-duplex).
Flow control information. Can be no, indicating no flow control is available; tx, indicating that the end-point can transmit pause frames, but ignores any received pause frames; rx, indicating that the end-point receives and acts upon received pause frames; or bi, indicating bi-directional flow-control.
Fault detection information. Valid values are none or fault.
Displays using a stable machine-parsable format. The -o option is required with -p. See "Parsable Output Format", below.
Extended output is displayed for PTYPE values of current, capable, adv and peeradv.
Sets the values of one or more properties on the link specified. The list of properties and their possible values depend on the link type, the network device driver, and networking hardware. These properties can be retrieved using show-linkprop. -t, --temporary
Specifies that the changes are temporary. Temporary changes last until the next reboot.
See "Options," above.
A comma-separated list of properties to set to the specified values.
Resets one or more properties to their values on the link specified. Properties are reset to the values they had at startup. If no properties are specified, all properties are reset. See show-linkprop for a description of properties. -t, --temporary
Specifies that the resets are temporary. Values are reset to default values. Temporary resets last until the next reboot.
See "Options," above.
A comma-separated list of properties to reset.
Show the current or persistent values of one or more properties, either for all datalinks or for the specified link. By default, current values are shown. If no properties are specified, all available link properties are displayed. For each property, the following fields are displayed: -o field[,...], --output=field
A case-insensitive, comma-separated list of output fields to display. The field name must be one of the fields listed below, or the special value all to display all fields. For each link, the following fields can be displayed: LINK
The name of the datalink.
The name of the property.
The current (or persistent) property value. If the value is not set, it is shown as --. If it is unknown, the value is shown as ?. Persistent values that are not set or have been reset will be shown as -- and will use the system DEFAULT value (if any).
The default value of the property. If the property has no default value, -- is shown.
A comma-separated list of the values the property can have. If the values span a numeric range, min - max might be shown as shorthand. If the possible values are unknown or unbounded, -- is shown.
Display using a stable machine-parsable format. The -o option is required with this option. See "Parsable Output Format", below.
Display persistent link property information
A comma-separated list of properties to show. See the sections on link properties following subcommand descriptions.
Create a secure object named secobj in the specified class to be later used as a WEP or WPA key in connecting to an encrypted network. The value of the secure object can either be provided interactively or read from a file. The sequence of interactive prompts and the file format depends on the class of the secure object. Currently, the classes wep and wpa are supported. The WEP (Wired Equivalent Privacy) key can be either 5 or 13 bytes long. It can be provided either as an ASCII or hexadecimal string -- thus, 12345 and 0x3132333435 are equivalent 5-byte keys (the 0x prefix can be omitted). A file containing a WEP key must consist of a single line using either WEP key format. The WPA (Wi-Fi Protected Access) key must be provided as an ASCII string with a length between 8 and 63 bytes. This subcommand is only usable by users or roles that belong to the "Network Link Security" RBAC profile. -c class, --class=class
class can be wep or wpa. See preceding discussion.
Specifies that the creation is temporary. Temporary creation last until the next reboot.
See "Options," above.
Specifies a file that should be used to obtain the secure object's value. The format of this file depends on the secure object class. See the EXAMPLES section for an example of using this option to set a WEP key.
Delete one or more specified secure objects. This subcommand is only usable by users or roles that belong to the "Network Link Security" RBAC profile. -t, --temporary
Specifies that the deletions are temporary. Temporary deletions last until the next reboot.
See "Options," above.
Show current or persistent secure object information. If one or more secure objects are specified, then information for each is displayed. Otherwise, all current or persistent secure objects are displayed. By default, current secure objects are displayed, which are all secure objects that have either been persistently created and not temporarily deleted, or temporarily created. For security reasons, it is not possible to show the value of a secure object. -o field[,...] , --output=field[,...]
A case-insensitive, comma-separated list of output fields to display. The field name must be one of the fields listed below. For displayed secure object, the following fields can be shown: OBJECT
The name of the secure object.
The class of the secure object.
Display using a stable machine-parsable format. The -o option is required with -p. See "Parsable Output Format", below.
Display persistent secure object information
Create a VNIC with name vnic-link over the specified link. -t, --temporary
Specifies that the VNIC is temporary. Temporary VNICs last until the next reboot.
See "Options," above.
link can be a physical link or an etherstub.
Sets the VNIC's MAC address based on the specified value or keyword. If value is not a keyword, it is interpreted as a unicast MAC address, which must be valid for the underlying NIC. The following special keywords can be used: factory [-n slot-identifier],
factory [--slot=slot-identifier]
Assign a factory MAC address to the VNIC. When a factory MAC address is requested, -m can be combined with the -n option to specify a MAC address slot to be used. If -n is not specified, the system will choose the next available factory MAC address. The -m option of the show-phys subcommand can be used to display the list of factory MAC addresses, their slot identifiers, and their availability.
random [-r prefix],
random [--mac-prefix=prefix]
Assign a random MAC address to the VNIC. A default prefix consisting of a valid IEEE OUI with the local bit set will be used. That prefix can be overridden with the -r option.
Try and use a factory MAC address first. If none is available, assign a random MAC address. auto is the default action if the -m option is not specified.
Enable VLAN tagging for this VNIC. The VLAN tag will have id vlan-id.
A comma-separated list of properties to set to the specified values.
Deletes the specified VNIC. -t, --temporary
Specifies that the deletion is temporary. Temporary deletions last until the next reboot.
See "Options," above.
Show VNIC configuration information (the default) or statistics, for all VNICs, all VNICs on a link, or only the specified vnic-link. -o field[,...] , --output=field[,...]
A case-insensitive, comma-separated list of output fields to display. The field name must be one of the fields listed below. The field name must be one of the fields listed below, or the special value all to display all fields. By default (without -o), show-vnic displays all fields. LINK
The name of the VNIC.
The name of the physical link over which this VNIC is configured.
The maximum speed of the VNIC, in megabits per second.
MAC address of the VNIC.
MAC address type of the VNIC. dladm distinguishes among the following MAC address types: random
A random address assigned to the VNIC.
A factory MAC address used by the VNIC.
Display using a stable machine-parsable format. The -o option is required with -p. See "Parsable Output Format", below.
Display the persistent VNIC configuration.
Displays VNIC statistics.
Used with the -s option to specify an interval, in seconds, at which statistics should be displayed. If this option is not specified, statistics will be displayed only once.
Display information for all VNICs on the named link.
dladm create-etherstub [-t] [-R root-dir] etherstub
Create an etherstub with the specified name. -t, --temporary
Specifies that the etherstub is temporary. Temporary etherstubs do not persist across reboots.
See "Options," above.
dladm delete-etherstub [-t] [-R root-dir] etherstub
Delete the specified etherstub. -t, --temporary
Specifies that the deletion is temporary. Temporary deletions last until the next reboot.
See "Options," above.
Show all configured etherstubs by default, or the specified etherstub if etherstub is specified.
Create an IP tunnel link named iptun-link. Such links can additionally be protected with IPsec using ipsecconf(1M). An IP tunnel is conceptually comprised of two parts: a virtual link between two or more IP nodes, and an IP interface above this link that allows the system to transmit and receive IP packets encapsulated by the underlying link. This subcommand creates a virtual link. The ifconfig(1M) command is used to configure IP interfaces above the link. -t, --temporary
Specifies that the IP tunnel link is temporary. Temporary tunnels last until the next reboot.
See "Options," above.
Specifies the type of tunnel to be created. The type must be one of the following: ipv4
A point-to-point, IP-over-IP tunnel between two IPv4 nodes. This type of tunnel requires IPv4 source and destination addresses to function. IPv4 and IPv6 interfaces can be plumbed above such a tunnel to create IPv4-over-IPv4 and IPv6-over-IPv4 tunneling configurations.
A point-to-point, IP-over-IP tunnel between two IPv6 nodes as defined in IETF RFC 2473. This type of tunnel requires IPv6 source and destination addresses to function. IPv4 and IPv6 interfaces can be plumbed above such a tunnel to create IPv4-over-IPv6 and IPv6-over-IPv6 tunneling configurations.
A 6to4, point-to-multipoint tunnel as defined in IETF RFC 3056. This type of tunnel requires an IPv4 source address to function. An IPv6 interface is plumbed on such a tunnel link to configure a 6to4 router.
Literal IP address or hostname corresponding to the tunnel source. If a hostname is specified, it will be resolved to IP addresses, and one of those IP addresses will be used as the tunnel source. Because IP tunnels are created before naming services have been brought online during the boot process, it is important that any hostname used be included in /etc/hosts.
Literal IP address or hostname corresponding to the tunnel destination.
Modify the parameters of the specified IP tunnel. -t, --temporary
Specifies that the modification is temporary. Temporary modifications last until the next reboot.
See "Options," above.
Specifies a new tunnel source address. See create-iptun for a description.
Specifies a new tunnel destination address. See create-iptun for a description.
Delete the specified IP tunnel link. -t, --temporary
Specifies that the deletion is temporary. Temporary deletions last until the next reboot.
See "Options," above.
Show IP tunnel link configuration for a single IP tunnel or all IP tunnels. -P, --persistent
Display the persistent IP tunnel configuration.
Display using a stable machine-parsable format. The -o option is required with -p. See "Parsable Output Format", below.
A case-insensitive, comma-separated list of output fields to display. The field name must be one of the fields listed below, or the special value all, to display all fields. By default (without -o), show-iptun displays all fields. LINK
The name of the IP tunnel link.
Type of tunnel as specified by the -T option of create-iptun.
A set of flags associated with the IP tunnel link. Possible flags are: s
The IP tunnel link is protected by IPsec policy. To display the IPsec policy associated with the tunnel link, enter:
# ipsecconf -ln -i tunnel-link
See ipsecconf(1M) for more details on how to configure IPsec policy.
The IP tunnel link was implicitly created with ifconfig(1M), and will be automatically deleted when it is no longer referenced (that is, when the last IP interface over the tunnel is unplumbed). See ifconfig(1M) for details on implicit tunnel creation.
The tunnel source address.
The tunnel destination address.
Show the historical network usage from a stored extended accounting file. Configuration and enabling of network accounting through acctadm(1M) is required. The default output will be the summary of network usage for the entire period of time in which extended accounting was enabled. -a
Display all historical network usage for the specified period of time during which extended accounting is enabled. This includes the usage information for the links that have already been deleted.
Read extended accounting records of network usage from filename.
Specifies the format of plotfile that is specified by the -p option. As of this release, gnuplot is the only supported format.
Write network usage data to a file of the format specified by the -F option, which is required.
-e time, --stop=time
Start and stop times for data display. Time is in the format MM/DD/YYYY,hh:mm:ss.
If specified, display the network usage only for the named link. Otherwise, display network usage for all links.
Many dladm subcommands have an option that displays output in a machine-parsable format. The output format is one or more lines of colon (:) delimited fields. The fields displayed are specific to the subcommand used and are listed under the entry for the -o option for a given subcommand. Output includes only those fields requested by means of the -o option, in the order requested.
When you request multiple fields, any literal colon characters are escaped by a backslash (\e) before being output. Similarly, literal backslash characters will also be escaped (\e\e). This escape format is parsable by using shell read(1) functions with the environment variable IFS=: (see EXAMPLES, below). Note that escaping is not done when you request only a single field.
The following general link properties are supported: allowed-ips
A comma-separated list of IP addresses that are allowed on the interface. An address in CIDR format with no host address specified is used to indicate that any address on that subnet is allowed (e.g. 192.168.10.0/24 means any address in the range 192.168.10.0 - 192.168.10.255 is allowed).
Specifies the set of STREAMS modules to push on the stream associated with a link when its DLPI device is opened. It is a space-delimited list of modules. The optional special character sequence [anchor] indicates that a STREAMS anchor should be placed on the stream at the module previously specified in the list. It is an error to specify more than one anchor or to have an anchor first in the list. The autopush property is preferred over the more general autopush(1M) command.
Bind the processing of packets for a given data link to a processor or a set of processors. The value can be a comma-separated list of one or more processor ids. If the list consists of more than one processor, the processing will spread out to all the processors. Connection to processor affinity and packet ordering for any individual connection will be maintained. The processor or set of processors are not exclusively reserved for the link. Only the kernel threads and interrupts associated with processing of the link are bound to the processor or the set of processors specified. In case it is desired that processors be dedicated to the link, psrset(1M) can be used to create a processor set and then specifying the processors from the processor set to bind the link to. If the link was already bound to processor or set of processors due to a previous operation, the binding will be removed and the new set of processors will be used instead. The default is no CPU binding, which is to say that the processing of packets is not bound to any specific processor or processor set.
Limits the number of new or changed MAC sources to be learned over a bridge link. When the number exceeds this value, learning on that link is temporarily disabled. Only non-VLAN, non-VNIC type links have this property. The default value is 1000. Valid values are greater or equal to 0.
Specifies the decay rate for source changes limited by learn_limit. This number is subtracted from the counter for a bridge link every 5 seconds. Only non-VLAN, non-VNIC type links have this property. The default value is 200. Valid values are greater or equal to 0.
Sets the full duplex bandwidth for the link. The bandwidth is specified as an integer with one of the scale suffixes (K, M, or G for Kbps, Mbps, and Gbps). If no units are specified, the input value will be read as Mbps. The default is no bandwidth limit.
Sets the relative priority for the link. The value can be given as one of the tokens high, medium, or low. The default is high.
Enables or disables Spanning Tree Protocol on a bridge link. Setting this value to 0 disables Spanning Tree, and puts the link into forwarding mode with BPDU guarding enabled. This mode is appropriate for point-to-point links connected only to end nodes. Only non-VLAN, non-VNIC type links have this property. The default value is 1, to enable STP.
Enables or disables forwarding for a VLAN. Setting this value to 0 disables bridge forwarding for a VLAN link. Disabling bridge forwarding removes that VLAN from the "allowed set" for the bridge. The default value is 1, to enable bridge forwarding for configured VLANs.
Sets the default VLAN ID that is assumed for untagged packets sent to and received from this link. Only non-VLAN, non-VNIC type links have this property. Setting this value to 0 disables the bridge forwarding of untagged packets to and from the port. The default value is VLAN ID 1. Valid values values are from 0 to 4094.
Enables or disables the default filtering of promiscuous mode for certain classes of links. By default, VNICs will only see unicast traffic destined for it in promiscuous mode. Not all the unicast traffic from the underlying device makes it to the VNIC. Disabling this would cause a VNIC, for example, to be able to see all unicast traffic from the device it is created over. The default value is on.
Sets the STP and RSTP Port Priority value, which is used to determine the preferred root port on a bridge. Lower numerical values are higher priority. The default value is 128. Valid values range from 0 to 255.
Sets the STP and RSTP cost for using the link. The default value is auto, which sets the cost based on link speed, using 100 for 10Mbps, 19 for 100Mbps, 4 for 1Gbps, and 2 for 10Gbps. Valid values range from 1 to 65535.
Enables or disables bridge edge port detection. If set to 0 (false), the system assumes that the port is connected to other bridges even if no bridge PDUs of any type are seen. The default value is 1, which detects edge ports automatically.
Sets bridge point-to-point operation mode. Possible values are true, false, and auto. When set to auto, point-to-point connections are automatically discovered. When set to true, the port mode is forced to use point-to-point. When set to false, the port mode is forced to use normal multipoint mode. The default value is auto.
Triggers the system to run the RSTP Force BPDU Migration Check procedure on this link. The procedure is triggered by setting the property value to 1. The property is automatically reset back to 0. This value cannot be set unless the following are true:
The link is bridged
The bridge is protected by Spanning Tree
The bridge force-protocol value is at least 2 (RSTP)
Specifies the zone to which the link belongs. This property can be modified only temporarily through dladm, and thus the -t option must be specified. To modify the zone assignment such that it persists across reboots, please use zonecfg(1M). Possible values consist of any exclusive-IP zone currently running on the system. By default, the zone binding is as per zonecfg(1M).
The following WiFi link properties are supported. Note that the ability to set a given property to a given value depends on the driver and hardware. channel
Specifies the channel to use. This property can be modified only by certain WiFi links when in IBSS mode. The default value and allowed range of values varies by regulatory domain.
Specifies the power management mode of the WiFi link. Possible values are off (disable power management), max (maximum power savings), and fast (performance-sensitive power management). Default is off.
Specifies the radio mode of the WiFi link. Possible values are on or off. Default is on.
Specifies a fixed speed for the WiFi link, in megabits per second. The set of possible values depends on the driver and hardware (but is shown by show-linkprop); common speeds include 1, 2, 11, and 54. By default, there is no fixed speed.
The following MII Properties, as documented in ieee802.3(5), are supported in read-only mode:
duplex
state
adv_autoneg_cap
adv_10gfdx_cap
adv_1000fdx_cap
adv_1000hdx_cap
adv_100fdx_cap
adv_100hdx_cap
adv_10fdx_cap
adv_10hdx_cap
Each adv_ property (for example, adv_10fdx_cap) also has a read/write counterpart en_ property (for example, en_10fdx_cap) controlling parameters used at auto-negotiation. In the absence of Power Management, the adv* speed/duplex parameters provide the values that are both negotiated and currently effective in hardware. However, with Power Management enabled, the speed/duplex capabilities currently exposed in hardware might be a subset of the set of bits that were used in initial link parameter negotiation. Thus the MII adv_* parameters are marked read-only, with an additional set of en_* parameters for configuring speed and duplex properties at initial negotiation.
Note that the adv_autoneg_cap does not have an en_autoneg_cap counterpart: the adv_autoneg_cap is a 0/1 switch that turns off/on autonegotiation itself, and therefore cannot be impacted by Power Management.
In addition, the following Ethernet properties are reported: speed
(read-only) The operating speed of the device, in Mbps.
The maximum client SDU (Send Data Unit) supported by the device. Valid range is 68-65536.
Establishes flow-control modes that will be advertised by the device. Valid input is one of: no
No flow control enabled.
Receive, and act upon incoming pause frames.
Transmit pause frames to the peer when congestion occurs, but ignore received pause frames.
Bidirectional flow control.
A comma-separated list of additional MAC addresses that are allowed on the interface.
This link property controls the conditions in which 802.1Q VLAN tags will be inserted in packets being transmitted on the link. Two mode values can be assigned to this property: normal
Insert a VLAN tag in outgoing packets under the following conditions:
The packet belongs to a VLAN.
The user requested priority tagging.
Insert a VLAN tag only when the outgoing packet belongs to a VLAN. If a tag is being inserted in this mode and the user has also requested a non-zero priority, the priority is honored and included in the VLAN tag.
The following IP tunnel link properties are supported. hoplimit
Specifies the IPv4 TTL or IPv6 hop limit for the encapsulating outer IP header of a tunnel link. This property exists for all tunnel types. The default value is 64.
Specifies the IPv6 encapsulation limit for an IPv6 tunnel as defined in RFC 2473. This value is the tunnel nesting limit for a given tunneled packet. The default value is 4. A value of 0 disables the encapsulation limit.
Example 1 Configuring an Aggregation
To configure a data-link over an aggregation of devices bge0 and bge1 with key 1, enter the following command:
# dladm create-aggr -d bge0 -d bge1 1
Example 2 Connecting to a WiFi Link
To connect to the most optimal available unsecured network on a system with a single WiFi link (as per the prioritization rules specified for connect-wifi), enter the following command:
# dladm connect-wifi
Example 3 Creating a WiFi Key
To interactively create the WEP key mykey, enter the following command:
# dladm create-secobj -c wep mykey
Alternatively, to non-interactively create the WEP key mykey using the contents of a file:
# umask 077 # cat >/tmp/mykey.$$ <<EOF 12345 EOF # dladm create-secobj -c wep -f /tmp/mykey.$$ mykey # rm /tmp/mykey.$$
Example 4 Connecting to a Specified Encrypted WiFi Link
To use key mykey to connect to ESSID wlan on link ath0, enter the following command:
# dladm connect-wifi -k mykey -e wlan ath0
Example 5 Changing a Link Property
To set powermode to the value fast on link pcwl0, enter the following command:
# dladm set-linkprop -p powermode=fast pcwl0
Example 6 Connecting to a WPA-Protected WiFi Link
Create a WPA key psk and enter the following command:
# dladm create-secobj -c wpa psk
To then use key psk to connect to ESSID wlan on link ath0, enter the following command:
# dladm connect-wifi -k psk -e wlan ath0
Example 7 Renaming a Link
To rename the bge0 link to mgmt0, enter the following command:
# dladm rename-link bge0 mgmt0
Example 8 Replacing a Network Card
Consider that the bge0 device, whose link was named mgmt0 as shown in the previous example, needs to be replaced with a ce0 device because of a hardware failure. The bge0 NIC is physically removed, and replaced with a new ce0 NIC. To associate the newly added ce0 device with the mgmt0 configuration previously associated with bge0, enter the following command:
# dladm rename-link ce0 mgmt0
Example 9 Removing a Network Card
Suppose that in the previous example, the intent is not to replace the bge0 NIC with another NIC, but rather to remove and not replace the hardware. In that case, the mgmt0 datalink configuration is not slated to be associated with a different physical device as shown in the previous example, but needs to be deleted. Enter the following command to delete the datalink configuration associated with the mgmt0 datalink, whose physical hardware (bge0 in this case) has been removed:
# dladm delete-phys mgmt0
Example 10 Using Parsable Output to Capture a Single Field
The following assignment saves the MTU of link net0 to a variable named mtu.
# mtu=`dladm show-link -p -o mtu net0`
Example 11 Using Parsable Output to Iterate over Links
The following script displays the state of each link on the system.
# dladm show-link -p -o link,state | while IFS=: read link state; do
print "Link $link is in state $state"
done
Example 12 Configuring VNICs
Create two VNICs with names hello0 and test1 over a single physical link bge0:
# dladm create-vnic -l bge0 hello0 # dladm create-vnic -l bge0 test1
Example 13 Configuring VNICs and Allocating Bandwidth and Priority
Create two VNICs with names hello0 and test1 over a single physical link bge0 and make hello0 a high priority VNIC with a factory-assigned MAC address with a maximum bandwidth of 50 Mbps. Make test1 a low priority VNIC with a random MAC address and a maximum bandwidth of 100Mbps.
# dladm create-vnic -l bge0 -m factory -p maxbw=50,priority=high hello0 # dladm create-vnic -l bge0 -m random -p maxbw=100M,priority=low test1
Example 14 Configuring a VNIC with a Factory MAC Address
First, list the available factory MAC addresses and choose one of them:
# dladm show-phys -m bge0
LINK SLOT ADDRESS INUSE CLIENT
bge0 primary 0:e0:81:27:d4:47 yes bge0
bge0 1 8:0:20:fe:4e:a5 no
bge0 2 8:0:20:fe:4e:a6 no
bge0 3 8:0:20:fe:4e:a7 no
Create a VNIC named hello0 and use slot 1's address:
# dladm create-vnic -l bge0 -m factory -n 1 hello0 # dladm show-phys -m bge0 LINK SLOT ADDRESS INUSE CLIENT bge0 primary 0:e0:81:27:d4:47 yes bge0 bge0 1 8:0:20:fe:4e:a5 yes hello0 bge0 2 8:0:20:fe:4e:a6 no bge0 3 8:0:20:fe:4e:a7 no
Example 15 Creating a VNIC with User-Specified MAC Address, Binding it to Set of Processors
Create a VNIC with name hello0, with a user specified MAC address, and a processor binding 0, 1, 2, 3.
# dladm create-vnic -l bge0 -m 8:0:20:fe:4e:b8 -p cpus=0,1,2,3 hello0
Example 16 Creating a Virtual Network Without a Physical NIC
First, create an etherstub with name stub1:
# dladm create-etherstub stub1
Create two VNICs with names hello0 and test1 on the etherstub. This operation implicitly creates a virtual switch connecting hello0 and test1.
# dladm create-vnic -l stub1 hello0 # dladm create-vnic -l stub1 test1
Example 17 Showing Network Usage
Network usage statistics can be stored using the extended accounting facility, acctadm(1M).
# acctadm -e basic -f /var/log/net.log net # acctadm net Network accounting: active Network accounting file: /var/log/net.log Tracked Network resources: basic Untracked Network resources: src_ip,dst_ip,src_port,dst_port,protocol, dsfield
The saved historical data can be retrieved in summary form using the show-usage subcommand:
# dladm show-usage -f /var/log/net.log
LINK DURATION IPACKETS RBYTES OPACKETS OBYTES BANDWIDTH
e1000g0 80 1031 546908 0 0 2.44 Kbps
Example 18 Displaying Bridge Information
The following commands use the show-bridge subcommand with no and various options.
# dladm show-bridge BRIDGE PROTECT ADDRESS PRIORITY DESROOT foo stp 32768/8:0:20:bf:f 32768 8192/0:d0:0:76:14:38 bar stp 32768/8:0:20:e5:8 32768 8192/0:d0:0:76:14:38 # dladm show-bridge -l foo LINK STATE UPTIME DESROOT hme0 forwarding 117 8192/0:d0:0:76:14:38 qfe1 forwarding 117 8192/0:d0:0:76:14:38 # dladm show-bridge -s foo BRIDGE DROPS FORWARDS foo 0 302 # dladm show-bridge -ls foo LINK DROPS RECV XMIT hme0 0 360832 31797 qfe1 0 322311 356852 # dladm show-bridge -f foo DEST AGE FLAGS OUTPUT 8:0:20:bc:a7:dc 10.860 -- hme0 8:0:20:bf:f9:69 -- L hme0 8:0:20:c0:20:26 17.420 -- hme0 8:0:20:e5:86:11 -- L qfe1
Example 19 Creating an IPv4 Tunnel
The following sequence of commands creates and then displays a persistent IPv4 tunnel link named mytunnel0 between 66.1.2.3 and 192.4.5.6:
# dladm create-iptun -T ipv4 -s 66.1.2.3 -d 192.4.5.6 mytunnel0 # dladm show-iptun mytunnel0 LINK TYPE FLAGS SOURCE DESTINATION mytunnel0 ipv4 -- 66.1.2.3 192.4.5.6
A point-to-point IP interface can then be created over this tunnel link:
# ifconfig mytunnel0 plumb 10.1.0.1 10.1.0.2 up
As with any other IP interface, configuration persistence for this IP interface is achieved by placing the desired ifconfig commands (in this case, the command for "10.1.0.1 10.1.0.2") into /etc/hostname.mytunnel0.
Example 20 Creating a 6to4 Tunnel
The following command creates a 6to4 tunnel link. The IPv4 address of the 6to4 router is 75.10.11.12.
# dladm create-iptun -T 6to4 -s 75.10.11.12 sitetunnel0 # dladm show-iptun sitetunnel0 LINK TYPE FLAGS SOURCE DESTINATION sitetunnel0 6to4 -- 75.10.11.12 --
The following command plumbs an IPv6 interface on this tunnel:
# ifconfig sitetunnel0 inet6 plumb up # ifconfig sitetunnel0 inet6 sitetunnel0: flags=2200041 <UP,RUNNING,NONUD,IPv6> mtu 65515 index 3 inet tunnel src 75.10.11.12 tunnel hop limit 64 inet6 2002:4b0a:b0c::1/16
Note that the system automatically configures the IPv6 address on the 6to4 IP interface. See ifconfig(1M) for a description of how IPv6 addresses are configured on 6to4 tunnel links.
See attributes(5) for descriptions of the following attributes:
| ATTRIBUTE TYPE ATTRIBUTE VALUE |
| Interface Stability Committed |
/sbin
| ATTRIBUTE TYPE ATTRIBUTE VALUE |
| Interface Stability Committed |
acctadm(1M), autopush(1M), ifconfig(1M), ipsecconf(1M), ndd(1M), psrset(1M), wpad(1M), zonecfg(1M), attributes(5), ieee802.3(5), dlpi(7P)
The preferred method of referring to an aggregation in the aggregation subcommands is by its link name. Referring to an aggregation by its integer key is supported for backward compatibility, but is not necessary. When creating an aggregation, if a key is specified instead of a link name, the aggregation's link name will be automatically generated by dladm as aggrkey.