| DLADM(8) | Maintenance Commands and Procedures | DLADM(8) |
dladm — administer
data links
dladm |
help |
dladm |
show-link [-P]
[-s [-i
interval]] [[-p]
-o field[,...]]
[link] |
dladm |
rename-link [-R
root-dir] link new-link |
dladm |
delete-phys phys-link |
dladm |
show-phys [-m |
-H | -P]
[[-p] -o
field[,...]] [phys-link] |
dladm |
create-aggr [-t]
[-R root-dir]
[-P policy]
[-L mode]
[-T time]
[-u address]
-l ether-link
[-l ether-link]...
aggr-link |
dladm |
modify-aggr [-t]
[-R root-dir]
[-P policy]
[-L mode]
[-T time]
[-u address]
aggr-link |
dladm |
delete-aggr [-t]
[-R root-dir]
aggr-link |
dladm |
add-aggr [-t]
[-R root-dir]
-l ether-link
[-l ether-link]...
aggr-link |
dladm |
remove-aggr [-t]
[-R root-dir]
-l ether-link
[-l ether-link]...
aggr-link |
dladm |
show-aggr [-PLx]
[-s [-i
interval]] [[-p]
-o field[,...]]
[aggr-link] |
dladm |
create-bridge [-R
root-dir] [-P
protect] [-p
priority] [-m
max-age] [-h
hello-time] [-d
forward-delay] [-f
force-protocol] [-l
link]... bridge-name |
dladm |
modify-bridge [-R
root-dir] [-P
protect] [-p
priority] [-m
max-age] [-h
hello-time] [-d
forward-delay] [-f
force-protocol]
bridge-name |
dladm |
delete-bridge [-R
root-dir] bridge-name |
dladm |
add-bridge [-R
root-dir] -l
link [-l
link]... bridge-name |
dladm |
remove-bridge [-R
root-dir] -l
link [-l
link]... bridge-name |
dladm |
show-bridge [-flt]
[-s [-i
interval]] [[-p]
-o field[,...]]
bridge-name |
dladm |
create-vlan [-ft]
[-R root-dir]
-l ether-link
-v vid
[vlan-link] |
dladm |
delete-vlan [-t]
[-R root-dir]
vlan-link |
dladm |
show-vlan [-P]
[[-p] -o
field[,...]] [vlan-link] |
dladm |
scan-wifi [[-p]
-o field[,...]]
[wifi-link] |
dladm |
connect-wifi [-e
essid] [-i
bssid] [-k
key,...]
[-s none|wep|wpa] [-a open|shared] [-b bss|ibss]
[-c]
[-m a|b|g]
[-T time]
[wifi-link] |
dladm |
disconnect-wifi [-a]
[wifi-link] |
dladm |
show-wifi [[-p]
-o field[,...]]
[wifi-link] |
dladm |
show-ether [-x]
[[-p] -o
field[,...]] [ether-link] |
dladm |
set-linkprop [-t]
[-R root-dir]
-p
prop=value[,...]
link |
dladm |
reset-linkprop [-t]
[-R root-dir]
[-p prop[,...]]
link |
dladm |
show-linkprop [-P]
[[-c] -o
field[,...]] [-p
prop[,...]] [link] |
dladm |
create-secobj [-t]
[-R root-dir]
[-f file]
-c class
secobj |
dladm |
delete-secobj [-t]
[-R root-dir]
secobj[,...] |
dladm |
show-secobj [-P]
[[-p] -o
field[,...]]
[secobj[,...]] |
dladm |
create-vnic [-t]
[-R root-dir]
-l link
[-m value |
auto | factory
-n slot-identifier |
random [-r
prefix]] [-v
vlan-id] [-p
prop=value[,...]]
vnic-link |
dladm |
delete-vnic [-t]
[-R root-dir]
vnic-link |
dladm |
show-vnic [-P]
[[-p] -o
field[,...]] [-s
[-i interval]]
[-l link]
[vnic-link] |
dladm |
create-etherstub [-t]
[-R root-dir]
etherstub |
dladm |
delete-etherstub [-t]
[-R root-dir]
etherstub |
dladm |
show-etherstub
[etherstub] |
dladm |
create-iptun [-t]
[-R root-dir]
-T type
[-a {local|remote}=addr[,...]]
iptun-link |
dladm |
modify-iptun [-t]
[-R root-dir]
[-a {local|remote}=addr[,...]]
iptun-link |
dladm |
delete-iptun [-t]
[-R root-dir]
iptun-link |
dladm |
show-iptun [-P]
[[-p] -o
field[,...]] [iptun-link] |
dladm |
create-overlay [-t]
-e encap
-s search
-v vnetid
[-p
prop=value[,...]]
overlay |
dladm |
delete-overlay [-t]
overlay |
dladm |
modify-overlay -d
mac | -f |
-s mac=ip:port
overlay |
dladm |
show-overlay [-f |
-t] [[-p]
-o field[,...]]
[overlay] |
dladm |
show-usage [-a]
-f filename
[-p plotfile
-F format]
[-s time]
[-e time]
[link] |
The dladm command is used to administer
data-links. A data-link is represented in the system as a STREAMS DLPI (v2)
interface which can be plumbed under protocol stacks such as TCP/IP. Each
data-link relies on either a single network device or an aggregation of
devices to send packets to or receive packets from a network.
Each dladm subcommand operates on one of
the following objects:
Some subcommands operate only on certain types or classes of datalinks. For those cases, the following object names are used:
Note that appending a zero (0) to a bridge name produces a valid link name, used for observability.
Each dladm subcommand has its own set of
options. However, many of the subcommands have the following as a common
option:
-R
root-dir,
--root-dir=root-dirWhen invoked with no arguments, dladm
shows the link configuration information, in the same way as
dladm show-link.
The following subcommands are supported:
dladm helpdladm show-link
[-P] [-s
[-i interval]]
[[-p] -o
field[,...]] [link]Show link configuration information (the default) or statistics, either for all datalinks or for the link. By default, the system is configured with one datalink for each known network device.
-o
field[,...],
--output=field[,...]-s option (described
below), the field name must be one of the fields listed below, or the
special value all to display all fields. By
default (without -o),
show-link displays all fields.
dladm
distinguishes between the following classes:
show-phys
subcommand displays more detail for this class of
datalink.show-aggr subcommand displays more
detail for this class of datalink.show-etherstub
subcommand displays more detail for this class of
datalink.show-overlay
subcommand displays more detail for this class of
datalink.show-vlan
subcommand displays more detail for this class of
datalink.show-vnic subcommand displays more
detail for this class of datalink.When the -o option is used in
conjunction with the -s option, used to
display link statistics, the field name must be one of the fields
listed below, or the special value all to
display all fields.
-p,
--parsable-o option is required with
-p. See
Parsable Output
Format, below.-P,
--persistent-s,
--statistics-i
interval,
-interval=
interval-s option to specify an
interval, in seconds, at which statistics should be displayed. If this
option is not specified, statistics will be displayed only once.dladm rename-link
[-R root-dir]
link new-linkRename link to new-link. This is used to give a link a meaningful name, or to associate existing link configuration such as link properties of a removed device with a new device. See the EXAMPLES section for specific examples of how this subcommand is used.
dladm delete-phys
phys-linkThis command is used to delete the persistent configuration of a link associated with physical hardware which has been removed from the system. See the EXAMPLES section.
dladm show-phys
[-m | -H |
-P] [[-p]
-o field[,...]]
[phys-link]Show the physical device and attributes of all physical links,
or of the named physical link. Without -P, only
physical links that are available on the running system are
displayed.
-H-H displays the following elements:
-m-m displays the following elements:
create-vnic.-o
field[,...],
--output=field[,...]all, to display all fields. Note that if
either -H or -m are
specified, then the valid options are those described in their
respective sections. For each link, the following fields can be
displayed:
-p,
--parsable-o option is required with
-p. See
Parsable Output
Format, below.-P,
--persistentdelete-phys can
be used to purge the link's configuration from the system.dladm create-aggr
[-t] [-R
root-dir] [-P
policy] [-L
mode] [-T
time]
[-u address]
-l ether-link
[-l -ether-link]...
aggr-linkCombine a set of links into a single IEEE 802.3ad link
aggregation named aggr-link. The use of an integer
key to generate a link name for the aggregation is
also supported for backward compatibility. Many of the
-aggr subcommands below also support the use of
a key to refer to a given aggregation, but use of
the aggregation link name is preferred. See the
NOTES section for more information on
keys.
dladm supports a number of port
selection policies for an aggregation of ports. (See the description of
the -P option, below). If you do not specify a
policy, create-aggr uses the L4 policy,
described under the -P option.
-l
ether-link,
--link=ether-link-l option followed by the name of the link to
be included in the aggregation. Multiple links are included in the
aggregation by specifying multiple -l options.
For backwards compatibility, the dladm command
also supports the using the -d option (or
--dev) with a device name to specify links by
their underlying device name. The other -aggr
subcommands that take -l options also accept
-d.-t,
--temporary-R
root-dir,
--root-dir=root-dir-P
policy,
--policy=policyFor example, to use upper layer protocol information, the following policy can be used:
Note that policy L4 is the default.
To use the source and destination MAC addresses as well as the source and destination IP addresses, the following policy can be used:
-L
mode,
--lacp-mode=modeoff,
active or
passive.-T
time,
--lacp-timer=modeshort or long.-u
address,
--unicast=addressdladm modify-aggr
[-t] [-R
root-dir] [-P
policy] [-L
mode] [-T
time]
[-u address]
aggr-linkModify the parameters of the specified aggregation.
-t,
--temporary-R
root-dir,
--root-dir=root-dir-P
policy,
--policy=policydladm
create-aggr for a description of valid policy
values.-L
mode,
--lacp-mode=modeoff,
active, or
passive.-T
time,
--lacp-timer=timeshort or long.-u
address,
--unicast=addressdladm delete-aggr
[-t] [-R
root-dir] aggr-linkDeletes the specified aggregation.
dladm add-aggr
[-t] [-R
root-dir] -l
ether-link [-l
ether-link]... aggr-linkAdds links to the specified aggregation.
-l
ether-link,
--link=ether-link-l
options.-t,
--temporary-R
root-dir,
--root-dir=root-dirdladm remove-aggr
[-t] [-R
root-dir] -l
ether-link [-l
ether-link]... aggr-linkRemoves links from the specified aggregation.
-l
ether-link,
--link=ether-link-l
options.-t,
--temporary-R
root-dir,
--root-dir=root-dirdladm show-aggr
[-PLx] [-s
[-i interval]]
[[-p] -o
field[,...]] [aggr-link]Show aggregation configuration (the default), LACP information, or statistics, either for all aggregations or for the specified aggregation.
By default (with no options), the following fields can be displayed:
create-aggr -P option
for a description of the possible values.-u option was not used to create or modify the
aggregation), or ‘fixed’, if -u
was used to set a fixed MAC address.-l
option to create-aggr or
modify-aggr.-T option of
create-aggr or
modify-aggr.-f option to
create-aggr. Other flags might be defined in
the future.The show-aggr command accepts the
following options:
-L,
--lacp-x,
--extended-x,
the following fields can be displayed:
-o
field[,...],
--output=field[,...]all, to display all fields. The fields
applicable to the -o option are limited to
those listed under each output mode. For example, if using
-L, only the fields listed under
-L, above, can be used with
-o.-p,
--parsable-o option is required with
-p. See
Parsable Output
Format, below.-p,
--persistent-s,
--statistics-i
interval,
--interval=interval-s option to specify an
interval, in seconds, at which statistics should be displayed. If this
option is not specified, statistics will be displayed only once.dladm create-bridge
[-R root-dir]
[-P protect]
[-p priority]
[-m max-age]
[-h hello-time]
[-d forward-delay]
[-f force-protocol]
[-l link]...
bridge-nameCreate an 802.1D bridge instance and optionally assign one or more network links to the new bridge. By default, no bridge instances are present on the system.
In order to bridge between links, you must create at least one bridge instance. Each bridge instance is separate, and there is no forwarding connection between bridges.
-P
protect,
--protect=protectstp for the Spanning Tree Protocol and
trill for TRILL, which is used on RBridges.
The default value is stp.-R
root-dir,
--root-dir=root-dir-p
priority,
--priority=priorityIf a value not evenly divisible by 4096 is used, the system silently rounds downwards to the next lower value that is divisible by 4096.
-m
max-age,
--max-age=max-age-d forward-delay
parameter for additional constraints.-h
hello-time,
--hello-time=hello-time-d
forward-delay parameter for additional
constraints.-d
forward-delay,
--forward-delay=forward-delayBridges must obey the following two constraints:
Any parameter setting that would violate those constraints is treated as an error and causes the command to fail with a diagnostic message. The message provides valid alternatives to the supplied values.
-f
force-protocol,
--force-protocol=force-protocol-l
link,
--link=linkadd-bridge subcommand. However, if
any of the links cannot be added, the entire command fails, and the
new bridge itself is not created. To add multiple links on the same
command line, repeat this option for each link. You are permitted to
create bridges without links. For more information about link
assignments, see the add-bridge
subcommand.Bridge creation and link assignment require the PRIV_SYS_DL_CONFIG privilege. Bridge creation might fail if the optional bridging feature is not installed on the system.
dladm modify-bridge
[-R root-dir]
[-P protect]
[-p priority]
[-m max-age]
[-h hello-time]
[-d forward-delay]
[-f force-protocol]
bridge-nameModify the operational parameters of an existing bridge. The
options are the same as for the create-bridge
subcommand, except that the -l option is not
permitted. To add links to an existing bridge, use the
add-bridge subcommand.
Bridge parameter modification requires the PRIV_SYS_DL_CONFIG privilege.
dladm delete-bridge
[-R root-dir]
bridge-nameremove-bridge subcommand
to deactivate links before deleting a bridge.
Bridge deletion requires the PRIV_SYS_DL_CONFIG privilege.
The -R
(--root-dir) option is the same as for the
create-bridge subcommand.
dladm add-bridge
[-R root-dir]
-l link
[-l link]...
bridge-nameAdd one or more links to an existing bridge. If multiple links are specified, and adding any one of them results in an error, the command fails and no changes are made to the system.
Link addition to a bridge requires the PRIV_SYS_DL_CONFIG privilege.
A link may be a member of at most one bridge. An error occurs when you attempt to add a link that already belongs to another bridge. To move a link from one bridge instance to another, remove it from the current bridge before adding it to a new one.
The links assigned to a bridge must not also be VLANs, VNICs, or tunnels. Only physical Ethernet datalinks, aggregation datalinks, wireless links, and Ethernet stubs are permitted to be assigned to a bridge.
Links assigned to a bridge must all have the same MTU. This is checked when the link is assigned. The link is added to the bridge in a deactivated form if it is not the first link on the bridge and it has a differing MTU.
Note that systems using bridging should not set the
eeprom(8)
local-mac-address? variable to false.
The options are the same as for the
create-bridge subcommand.
dladm remove-bridge
[-R root-dir]
-l link
[-l link]...
bridge-nameRemove one or more links from a bridge instance. If multiple links are specified, and removing any one of them would result in an error, the command fails and none are removed.
Link removal from a bridge requires the PRIV_SYS_DL_CONFIG privilege.
The options are the same as for the
create-bridge subcommand.
dladm show-bridge
[-flt] [-s
[-i interval]]
[[-p] -o
field[,...]] bridge-nameShow the running status and configuration of bridges, their attached links, learned forwarding entries, and TRILL nickname databases. When showing overall bridge status and configuration, the bridge name can be omitted to show all bridges. The other forms require a specified bridge.
The show-bridge subcommand accepts the following options:
-i
interval,
--interval=interval-s option to specify an
interval, in seconds, at which statistics should be displayed. If this
option is not specified, statistics will be displayed only once.-s,
--statistics-f and -t
options.-p,
--parsable-o
field[,...],
--output=field[,...]all displays all fields. Each set of fields
has its own default set to display when -o is
not specified.By default, the show-bridge subcommand
shows bridge configuration. The following fields can be shown:
-p with
create-bridge and
modify-bridge.-m with
create-bridge and
modify-bridge.-h with
create-bridge and
modify-bridge.-d with
create-bridge and
modify-bridge.-f
with create-bridge and
modify-bridge.By default, when the -o option is not
specified, only the BRIDGE, ADDRESS,
PRIORITY, and DESROOT fields are
shown.
When the -s option is specified, the
show-bridge subcommand shows bridge statistics.
The following fields can be shown:
By default, when the -o option is not
specified, only the BRIDGE, DROPS,
and FORWARDS fields are shown.
The show-bridge subcommand also
accepts the following options:
-l,
--link-s option, the following fields can be
displayed for each link:
When the -l option is specified
without the -o option, only the
LINK, STATE,
UPTIME, and DESROOT fields are
shown.
When the -l option is specified,
the -s option can be used to display the
following fields for each link:
When the -o option is not
specified, only the LINK, DROPS,
RECV, and XMIT fields are
shown.
-f,
--forwardingWhen the -o option is not
specified, the DEST, AGE,
FLAGS, and OUTPUT fields are
shown.
-t,
--trillWhen the -o option is not
specified, the NICK, FLAGS,
LINK, and NEXTHOP fields are
shown.
dladm create-vlan
[-ft] [-R
root-dir] -l
ether-link -v
vid [vlan-link]Create a tagged VLAN link with an ID of vid over Ethernet link ether-link. The name of the VLAN link can be specified as vlan- link. If the name is not specified, a name will be automatically generated (assuming that ether-link is namePPA) as:
For example, if ether-link is bge1 and vid is 2, the name generated is bge2001.
-f,
--force-f option is needed,
and the MTU of the IP interfaces on the resulting VLAN must be set to
1496 instead of 1500.-l
ether-link-t,
--temporary-R
root-dir,
--root-dir=root-dirdladm delete-vlan
[-t] [-R
root-dir] vlan-linkDelete the VLAN link specified.
The delete-vlan subcommand accepts the
following options:
dladm show-vlan
[-P] [[-p]
-o field[,...]]
[vlan-link]Display VLAN configuration for all VLAN links or for the specified VLAN link.
The show-vlan subcommand accepts the
following options:
-o
field[,...],
--output=field[,...]all, to display all fields. For each
VLAN link, the following fields can be displayed:
-f-f
option to create-vlan.-iAdditional flags may be defined in the future.
-p,
--parsable-o option is required with
-p. See
Parsable Output
Format, below.-P,
--persistentdladm scan-wifi
[[-p] -o
field[,...]] [wifi-link]Scans for WiFi networks, either on all WiFi links, or just on the specified wifi-link.
By default, currently all fields but BSSTYPE are displayed.
-o
field[,...],
--output=field[,...]all to display all fields. For each WiFi
network found, the following fields can be displayed:
-p,
--parsable-o option is required with
-p. See
Parsable Output
Format, below.dladm connect-wifi
[-e essid]
[-i bssid]
[-k key,...]
[-s none|wep|wpa] [-a open|shared] [-b bss|ibss]
[-c]
[-m a|b|g]
[-T time]
[wifi-link]Connects to a WiFi network. This consists of
four steps:
discovery,
filtration,
prioritization,
and
association.
However, to enable connections to non-broadcast WiFi networks and to
improve performance, if a BSSID or ESSID is specified using the
-e or -i options, then
the first three steps are skipped and
connect-wifi immediately attempts to associate
with a BSSID or ESSID that matches the rest of the provided parameters.
If this association fails, but there is a possibility that other
networks matching the specified criteria exist, then the traditional
discovery process begins as specified below.
The discovery step finds all available WiFi networks on the specified WiFi link, which must not yet be connected. For administrative convenience, if there is only one WiFi link on the system, wifi-link can be omitted.
Once discovery is complete, the list of networks is filtered according to the value of the following options:
-e
essid,
--essid=essid-b bss|ibss, --bsstype=bss|ibss-m a|b|g, --mode=a|b|g-k key[,...], --key=key[,...]-s none|wep|wpa, --sec=none|wep|wpaNext, the remaining networks are prioritized, first by signal strength, and then by maximum speed. Finally, an attempt is made to associate with each network in the list, in order, until one succeeds or no networks remain.
In addition to the options described above, the following
options also control the behavior of
connect-wifi:
open and shared are
tried in order.-c,
--create-ibss-b ibss to
create a new ad-hoc network if one matching the specified ESSID cannot
be found. If no ESSID is specified, then -c
-b ibss always
triggers the creation of a new ad-hoc network.-T
time,
--timeout=timeforever, then
the associate will wait indefinitely. The current default is ten
seconds, but this might change in the future. Timeouts shorter than
the default might not succeed reliably.-k key[,...], --key=key[,...]For security modes that support multiple key
slots, the slot to place the key will be specified by a colon
followed by an index. Therefore, -k
mykey:3 places
mykey in
slot 3. By default, slot 1 is assumed. For security modes that
support multiple keys, a comma-separated list can be specified, with
the first key being the active key.
dladm disconnect-wifi
[-a] [wifi-link]Disconnect from one or more WiFi networks. If wifi-link specifies a connected WiFi link, then it is disconnected. For administrative convenience, if only one WiFi link is connected, wifi-link can be omitted.
-a,
--all-linksdladm show-wifi
[[-p] -o
field[,...]] [wifi-link]Shows WiFi configuration information either for all WiFi links or for the specified wifi-link.
-o
field[,...],
--output=field[,...]all, to display all fields. For each
WiFi link, the following fields can be displayed:
connect-wifi).By default, currently all fields but AUTH, BSSID, and BSSTYPE are displayed.
-p,
--parsable-o option is required with
-p. See
Parsable Output
Format, below.dladm show-ether
[-x] [[-p]
-o field[,...]]
[ether-link]Shows state information either for all physical Ethernet links or for a specified physical Ethernet link.
The show-ether subcommand accepts the
following options:
-o
field[,...],
--output=field[,...]all to display all fields. For each
link, the following fields can be displayed:
By default, all fields except REM_FAULT are displayed for the “current” PTYPE.
-p,
--parsable-o option is required with
-p. See
Parsable Output
Format, below.-x,
--extendeddladm set-linkprop
[-t] [-R
root-dir] -p
prop=value[,...]
linkSets the values of one or more properties on the link
specified. The list of properties and their possible values depend on
the link type, the network device driver, and networking hardware. These
properties can be retrieved using
show-linkprop.
-t,
--temporary-R
root-dir,
--root-dir=root-dir-p prop=value[,...], --prop prop=value[,...]Note that when the persistent value is set, the temporary value changes to the same value.
dladm reset-linkprop
[-t] [-R
root-dir] [-p
prop[,...]] linkResets one or more properties to their values on the link
specified. Properties are reset to the values they had at startup. If no
properties are specified, all properties are reset. See
show-linkprop for a description of
properties.
-t,
--temporary-R
root-dir,
--root-dir=root-dir-p
prop[,...],
--prop=prop[,...]Note that when the persistent value is reset, the temporary value changes to the same value.
dladm show-linkprop
[-P] [[-c]
-o field[,...]]
[-p prop[,...]]
[link]Show the current or persistent values of one or more properties, either for all datalinks or for the specified link. By default, current values are shown. If no properties are specified, all available link properties are displayed. For each property, the following fields are displayed:
-o
field[,...],
--output=field[,...]all to display all fields. For each
link, the following fields can be displayed:
The list of properties depends on the link type and network device driver, and the available values for a given property further depends on the underlying network hardware and its state. General link properties are documented in the LINK PROPERTIES section. However, link properties that begin with underscore (_) are specific to a given link or its underlying network device and subject to change or removal. See the appropriate network device driver man page for details.
-c,
--parsable-o option is required with this option. See
Parsable Output
Format, below.-P,
--persistent-p
prop[,...],
--prop=prop[,...]dladm create-secobj
[-t] [-R
root-dir] [-f
file] -c
class secobjCreate a secure object named secobj in the specified class to be later used as a WEP or WPA key in connecting to an encrypted network. The value of the secure object can either be provided interactively or read from a file. The sequence of interactive prompts and the file format depends on the class of the secure object.
Currently, the classes ‘wep’ and ‘wpa’ are supported. The ‘WEP’ (Wired Equivalent Privacy) key can be either 5 or 13 bytes long. It can be provided either as an ASCII or hexadecimal string — thus, 12345 and 0x3132333435 are equivalent 5-byte keys (the 0x prefix can be omitted). A file containing a ‘WEP’ key must consist of a single line using either ‘WEP’ key format. The WPA (Wi-Fi Protected Access) key must be provided as an ASCII string with a length between 8 and 63 bytes.
This subcommand is only usable by users or roles that belong to the "Network Link Security" RBAC profile.
-c
class,
--class=class-t,
--temporary-R
root-dir,
--root-dir=root-dir-f
file,
--file=filedladm delete-secobj
[-t] [-R
root-dir] secobj[,...]Delete one or more specified secure objects. This subcommand is only usable by users or roles that belong to the "Network Link Security" RBAC profile.
dladm show-secobj
[-P] [[-p]
-o field[,...]]
[secobj[,...]]Show current or persistent secure object information. If one or more secure objects are specified, then information for each is displayed. Otherwise, all current or persistent secure objects are displayed.
By default, current secure objects are displayed, which are all secure objects that have either been persistently created and not temporarily deleted, or temporarily created.
For security reasons, it is not possible to show the value of a secure object.
-o
field[,...],
--output=field[,...]-p,
--parsable-o option is required with
-p. See
Parsable Output
Format, below.-P,
--persistentdladm create-vnic
[-t] [-R
root-dir] -l
link [-m
value | auto |
factory -n
slot-identifier | random
[-r prefix]]
[-v vlan-id]
[-p
prop=value[,...]]
vnic-linkCreate a VNIC with name vnic-link over the specified link.
-t,
--temporary-R
root-dir,
--root-dir=root-dir-l
link,
--link=link-m value|keyword, --mac-address=value|keywordfactory
[-n
slot-identifier]factory
[--slot=slot-identifier]-m can be combined
with the -n option to specify a MAC
address slot to be used. If -n is not
specified, the system will choose the next available factory MAC
address. The -m option of the
show-phys subcommand can be used to
display the list of factory MAC addresses, their slot identifiers,
and their availability.random
[-r prefix]random
[--mac-prefix=prefix]-r option.autoauto is the
default action if the -m option is not
specified.-v
vlan-id-p
prop[,...],
--prop=prop[,...]dladm delete-vnic
[-t] [-R
root-dir] vnic-linkDeletes the specified VNIC.
dladm show-vnic
[-P] [[-p]
-o field[,...]]
[-s [-i
interval]] [-l
link] [vnic-link]Show VNIC configuration information (the default) or statistics, for all VNICs, all VNICs on a link, or only the specified vnic-link.
-o
field[,...],
--output=field[,...]all to display all fields. By default (without
-o), show-vnic
displays all fields.
dladm
distinguishes among the following MAC address types:
-p,
--parsable-o option is required with
-p. See
Parsable Output
Format, below.-P,
--persistent-s,
--statistics-i
interval,
--interval=interval-s option to specify an
interval, in seconds, at which statistics should be displayed. If this
option is not specified, statistics will be displayed only once.-l
link,
--link=linkdladm create-etherstub
[-t] [-R
root-dir] etherstubCreate an etherstub with the specified name.
-t,
--temporary-R
root-dir,
--root-dir=root-dirVNICs can be created on top of etherstubs instead of physical NICs. As with physical NICs, such a creation causes the stack to implicitly create a virtual switch between the VNICs created on top of the same etherstub.
dladm delete-etherstub
[-t] [-R
root-dir] etherstubDelete the specified etherstub.
dladm show-etherstub
[etherstub]Show all configured etherstubs by default, or the specified etherstub if etherstub is specified.
dladm create-iptun
[-t] [-R
root-dir] -T
type
[-a {local|remote}=addr[,...]]
iptun-linkCreate an IP tunnel link named iptun-link. Such links can additionally be protected with IPsec using ipsecconf(8).
An IP tunnel is conceptually comprised of two parts: a virtual link between two or more IP nodes, and an IP interface above this link that allows the system to transmit and receive IP packets encapsulated by the underlying link. This subcommand creates a virtual link. The ifconfig(8) command is used to configure IP interfaces above the link.
-t,
--temporary-R
root-dir,
--root-dir=root-dir-T
type,
--tunnel-type=type-a
local=addr-a
remote=addr Literal IP
address or hostname corresponding to the tunnel destination.dladm modify-iptun
[-t] [-R
root-dir]
[-a {local|remote}=addr[,...]]
iptun-linkModify the parameters of the specified IP tunnel.
-t,
--temporary-R
root-dir,
--root-dir=root-dir-a
local=addrcreate-iptun for a description.-a
remote=addrcreate-iptun for a description.delete-iptun
[-t] [-R
root-dir] iptun-linkDelete the specified IP tunnel link.
dladm show-iptun
[-P] [[-p]
-o field[,...]]
[iptun-link]Show IP tunnel link configuration for a single IP tunnel or all IP tunnels.
-P,
--persistent-p,
--parsable-o option is required with
-p. See
Parsable Output
Format, below.-o
field[,...],
--output=field[,...]all, to display all fields. By default
(without -o),
show-iptun displays all fields.
-T
option of create-iptun.See ipsecconf(8) for more details on how to configure IPsec policy.
dladm create-overlay
[-t] -e
encap -s
search -v
vnetid
[-p prop=value[,...]]
overlayCreate an overlay device named overlay.
Overlay devices are similar to etherstubs. VNICs can be created on top of them. However, unlike an etherstub which is local to the system, an overlay device can be configured to communicate to remote hosts, providing a means for network virtualization. The way in which it does this is described by the encapsulation module and the search plugin. For more information on these, see overlay(7).
An overlay device has a series of required and optional properties. These properties vary based upon the search and encapsulation modules and are fully specified in overlay(7). Not every property needs to be specified — some have default values which will be used if nothing specific is specified. For example, the default port for VXLAN comes from its IANA standard. If a required property is missing, the command will fail and inform you of the missing properties.
-t,
--temporary-e
encap,
--encap=encap-s
search,
--search=search-p prop=value[,...], --prop prop=value[,...]-v
vnetid,
--vnetid=vnetid-e.dladm delete-overlay
[-t] overlayDelete the specified overlay. This will fail if there are VNICs on top of the device.
-t,
--temporarydladm
modify-overlay -d
mac |
-f |
-s mac=ip:port
overlayModifies the target tables for the specified overlay.
The different options allow for different ways of modifying
the target table. One of -d,
-f, and -s is required.
This is not applicable for all kinds of overlay devices. For more
information, see overlay(7).
-d
mac,
--delete-entry=mac-f,
--flush-table-s
mac=value,
--set-entry=mac=value,][IP:][port].
If a component is the last one, then there is no need for a separator.
eg. if just the MAC address or IP is needed, it would look like
mac and IP respectively.dladm show-overlay
[-f | -t]
[[-p] -o
field[,...]] [overlay]Shows overlay configuration (the default), internal target
tables (-t), or the FMA state
(-f), either for all overlays or the specified
overlay.
By default (with neither -f or
-t specified), the following fields will be
displayed:
When the -f option is used, the
following fields will be displayed:
When the -t option is used, the
following fields will be displayed:
The show-overlay command supports the
following options:
-f,
--fma-o
field[,...],
--output=field[,...]all, to display all fields. The fields
applicable to the -o option are limited to
those listed under each output mode. For example, if using
-L, only the fields listed under
-L, above, can be used with
-o.-p,
--parsable-o option is required with
-p. See
Parsable Output
Format, below.-t,
--targetdladm show-usage
[-a] -f
filename [-p
plotfile -F
format]
[-s time ][-e time]
[link]Show the historical network usage from a stored extended accounting file. Configuration and enabling of network accounting through acctadm(8) is required. The default output will be the summary of network usage for the entire period of time in which extended accounting was enabled.
-a-f
filename,
--file=filename-F
format,
--format=format-p option.
gnuplot is the only currently supported
format.
-p
plotfile,
--plot=plotfile-F option, which is required.
-s
time,
--start=time-e
time,
--stop=timeMany dladm subcommands have an option that
displays output in a machine-parsable format. The output format is one or
more lines of colon (:) delimited fields. The fields displayed are specific
to the subcommand used and are listed under the entry for the
-o option for a given subcommand. Output includes
only those fields requested by means of the -o
option, in the order requested.
When you request multiple fields, any literal colon characters are escaped by a backslash (\) before being output. Similarly, literal backslash characters will also be escaped (\\). This escape format is parsable by using shell read(1) functions with the environment variable IFS=: (see EXAMPLES, below). Note that escaping is not done when you request only a single field.
The following general link properties are supported:
An address in CIDR format with no host address specified is used to indicate that any address on that subnet is allowed (e.g. 192.168.10.0/24 means any address in the range 192.168.10.0 - 192.168.10.255 is allowed).
The optional special character sequence ‘[anchor]’ indicates that a STREAMS anchor should be placed on the stream at the module previously specified in the list. It is an error to specify more than one anchor or to have an anchor first in the list.
The autopush property is preferred over the more general autopush(8) command.
The processor or set of processors are not exclusively reserved for the link. Only the kernel threads and interrupts associated with processing of the link are bound to the processor or the set of processors specified. In case it is desired that processors be dedicated to the link, psrset(8) can be used to create a processor set and then specifying the processors from the processor set to bind the link to.
If the link was already bound to processor or set of processors due to a previous operation, the binding will be removed and the new set of processors will be used instead.
The default is no CPU binding, which is to say that the processing of packets is not bound to any specific processor or processor set.
The default value is 1000. Valid values are greater or equal to 0.
The default value is 200. Valid values are greater or equal to 0.
high, medium,
or low. The default is
high.auto, which sets the cost based on link speed,
using ‘100’ for 10Mbps, ‘19’ for 100Mbps,
‘4’ for 1Gbps, and ‘2’ for 10Gbps. Valid
values range from 1 to 65535.true, false, and
auto. When set to auto,
point-to-point connections are automatically discovered. When set to
true, the port mode is forced to use
point-to-point. When set to false, the port mode
is forced to use normal multipoint mode. The default value is
auto.The default value is 0.
dladm, and thus
the -t option must be specified. To modify the
zone assignment such that it persists across reboots, use
zonecfg(8). Possible values consist
of any exclusive-IP zone currently running on the system. By default, the
zone binding is as per
zonecfg(8).The following WiFi link properties are supported. Note that the ability to set a given property to a given value depends on the driver and hardware.
off disable power
management, max maximum
power savings, and fast
(performance-sensitive power management). Default is
off.on or off. Default is
on.show-linkprop); common speeds include 1, 2, 11,
and 54. By default, there is no fixed speed.The following MII Properties, as documented in ieee802.3(7), are supported in read-only mode:
Each ‘adv_’ property (for example, ‘adv_10fdx_cap’) also has a read/write counterpart ‘en_’ property (for example, ‘en_10fdx_cap’) controlling parameters used at auto-negotiation. In the absence of Power Management, the ‘adv_*’ speed/duplex parameters provide the values that are both negotiated and currently effective in hardware. However, with Power Management enabled, the speed/duplex capabilities currently exposed in hardware might be a subset of the set of bits that were used in initial link parameter negotiation. Thus the MII ‘adv_*’ parameters are marked read-only, with an additional set of ‘en_*’ parameters for configuring speed and duplex properties at initial negotiation.
Note that the ‘adv_autoneg_cap’ does not have an ‘en_autoneg_cap’ counterpart: the ‘adv_autoneg_cap’ is a 0/1 switch that turns off/on auto-negotiation itself, and therefore cannot be impacted by Power Management.
In addition, the following Ethernet properties are reported:
Note that the actual settings for this value are constrained by the capabilities allowed by the device and the link partner.
Valid input is either auto as a single
value, or a comma separated combination of none,
rs and base-r. The
default value is auto.
Note the actual FEC settings and combinations are constrained by the capabilities allowed by the device and the link partner.
The default value is vlanonly.
The following IP tunnel link properties are supported.
Example 1 Configuring an Aggregation
To configure a data-link over an aggregation of devices bge0 and bge1 with key 1, enter the following command:
# dladm create-aggr -d bge0 -d bge1 1
Example 2 Connecting to a WiFi Link
To connect to the most optimal available unsecured network on a
system with a single WiFi link (as per the prioritization rules specified
for connect-wifi), enter the following command:
# dladm connect-wifi
Example 3 Creating a WiFi Key
To interactively create the WEP key ‘mykey’, enter the following command:
# dladm create-secobj -c wep mykey
Alternatively, to non-interactively create the WEP key ‘mykey’ using the contents of a file:
# umask 077 # cat >/tmp/mykey.$$ <<EOF 12345 EOF # dladm create-secobj -c wep -f /tmp/mykey.$$ mykey # rm /tmp/mykey.$$
Example 4 Connecting to a Specified Encrypted WiFi Link
To use key ‘mykey’ to connect to ESSID ‘wlan’ on link ‘ath0’, enter the following command:
# dladm connect-wifi -k mykey -e wlan ath0
Example 5 Changing a Link Property
To set powermode to the value ‘fast’ on link ‘pcwl0’, enter the following command:
# dladm set-linkprop -p powermode=fast pcwl0
Example 6 Connecting to a WPA-Protected WiFi Link
Create a WPA key ‘psk’ and enter the following command:
# dladm create-secobj -c wpa psk
To then use key ‘psk’ to connect to ESSID ‘wlan’ on link ‘ath0’, enter the following command:
# dladm connect-wifi -k psk -e wlan ath0
Example 7 Renaming a Link
To rename the ‘bge0’ link to ‘mgmt0’, enter the following command:
# dladm rename-link bge0 mgmt0
Example 8 Replacing a Network Card
Consider that the bge0 device, whose link was named mgmt0 as shown in the previous example, needs to be replaced with a ce0 device because of a hardware failure. The bge0 NIC is physically removed, and replaced with a new ce0 NIC. To associate the newly added ce0 device with the mgmt0 configuration previously associated with bge0, enter the following command:
# dladm rename-link ce0 mgmt0
Example 9 Removing a Network Card
Suppose that in the previous example, the intent is not to replace the bge0 NIC with another NIC, but rather to remove and not replace the hardware. In that case, the mgmt0 datalink configuration is not slated to be associated with a different physical device as shown in the previous example, but needs to be deleted. Enter the following command to delete the datalink configuration associated with the mgmt0 datalink, whose physical hardware (bge0 in this case) has been removed:
# dladm delete-phys mgmt0
Example 10 Using Parsable Output to Capture a Single Field
The following assignment saves the MTU of link net0 to a variable named ‘mtu’.
# mtu=`dladm show-link -p -o mtu net0`
Example 11 Using Parsable Output to Iterate over Links
The following script displays the state of each link on the system.
# dladm show-link -p -o link,state | \
while IFS=: read link state; do
print "Link $link is in state $state"
done
Example 12 Configuring VNICs
Create two VNICs with names ‘hello0’ and ‘test1’ over a single physical link ‘bge0’:
# dladm create-vnic -l bge0 hello0 # dladm create-vnic -l bge0 test1
Example 13 Configuring VNICs and Allocating Bandwidth and Priority
Create two VNICs with names ‘hello0’ and ‘test1’ over a single physical link ‘bge0’ and make ‘hello0’ a high priority VNIC with a factory-assigned MAC address with a maximum bandwidth of 50 Mbps. Make ‘test1’ a low priority VNIC with a random MAC address and a maximum bandwidth of 100Mbps.
# dladm create-vnic -l bge0 -m factory \
-p maxbw=50,priority=high hello0
# dladm create-vnic -l bge0 -m random \
-p maxbw=100M,priority=low test1
Example 14 Configuring a VNIC with a Factory MAC Address
First, list the available factory MAC addresses and choose one of them:
# dladm show-phys -m bge0 LINK SLOT ADDRESS INUSE CLIENT bge0 primary 0:e0:81:27:d4:47 yes bge0 bge0 1 8:0:20:fe:4e:a5 no bge0 2 8:0:20:fe:4e:a6 no bge0 3 8:0:20:fe:4e:a7 no
Create a VNIC named ‘hello0’ and use slot 1's address:
# dladm create-vnic -l bge0 -m factory -n 1 hello0 # dladm show-phys -m bge0 LINK SLOT ADDRESS INUSE CLIENT bge0 primary 0:e0:81:27:d4:47 yes bge0 bge0 1 8:0:20:fe:4e:a5 yes hello0 bge0 2 8:0:20:fe:4e:a6 no bge0 3 8:0:20:fe:4e:a7 no
Example 15 Creating a VNIC with User-Specified MAC Address, Binding it to Set of Processors
Create a VNIC with name ‘hello0’, with a user specified MAC address, and a processor binding 0, 1, 2, 3.
# dladm create-vnic -l bge0 -m 8:0:20:fe:4e:b8 \
-p cpus=0,1,2,3 hello0
Example 16 Creating a Virtual Network Without a Physical NIC
First, create an etherstub with name ‘stub1’:
# dladm create-etherstub stub1
Create two VNICs with names ‘hello0’ and ‘test1’ on the etherstub. This operation implicitly creates a virtual switch connecting ‘hello0’ and ‘test1’.
# dladm create-vnic -l stub1 hello0 # dladm create-vnic -l stub1 test1
Example 17 Showing Network Usage
Network usage statistics can be stored using the extended accounting facility, acctadm(8).
# acctadm -e basic -f /var/log/net.log net # acctadm net Network accounting: active Network accounting file: /var/log/net.log Tracked Network resources: basic Untracked Network resources: src_ip,dst_ip,src_port,dst_port,...
The saved historical data can be retrieved in summary form using
the show-usage subcommand:
# dladm show-usage -f /var/log/net.log LINK DURATION IPACKETS RBYTES OPACKETS OBYTES BANDWIDTH e1000g0 80 1031 546908 0 0 2.44 Kbps
Example 18 Displaying Bridge Information
The following commands use the show-bridge
subcommand with no and various options.
# dladm show-bridge BRIDGE PROTECT ADDRESS PRIORITY DESROOT foo stp 32768/8:0:20:bf:f 32768 8192/0:d0:0:76:14:38 bar stp 32768/8:0:20:e5:8 32768 8192/0:d0:0:76:14:38 # dladm show-bridge -l foo LINK STATE UPTIME DESROOT hme0 forwarding 117 8192/0:d0:0:76:14:38 qfe1 forwarding 117 8192/0:d0:0:76:14:38 # dladm show-bridge -s foo BRIDGE DROPS FORWARDS foo 0 302 # dladm show-bridge -ls foo LINK DROPS RECV XMIT hme0 0 360832 31797 qfe1 0 322311 356852 # dladm show-bridge -f foo DEST AGE FLAGS OUTPUT 8:0:20:bc:a7:dc 10.860 -- hme0 8:0:20:bf:f9:69 -- L hme0 8:0:20:c0:20:26 17.420 -- hme0 8:0:20:e5:86:11 -- L qfe1
Example 19 Creating an IPv4 Tunnel
The following sequence of commands creates and then displays a persistent IPv4 tunnel link named ‘mytunnel0’ between 66.1.2.3 and 192.4.5.6:
# dladm create-iptun -T ipv4 -s 66.1.2.3 -d 192.4.5.6 mytunnel0 # dladm show-iptun mytunnel0 LINK TYPE FLAGS SOURCE DESTINATION mytunnel0 ipv4 -- 66.1.2.3 192.4.5.6
A point-to-point IP interface can then be created over this tunnel link:
# ifconfig mytunnel0 plumb 10.1.0.1 10.1.0.2 up
As with any other IP interface, configuration persistence for this IP interface is achieved by placing the desired ifconfig(8) commands (in this case, the command for 10.1.0.1 10.1.0.2) into /etc/hostname.mytunnel0.
Example 20 Creating a 6to4 Tunnel
The following command creates a 6to4 tunnel link. The IPv4 address of the 6to4 router is 75.10.11.12.
# dladm create-iptun -T 6to4 -s 75.10.11.12 sitetunnel0 # dladm show-iptun sitetunnel0 LINK TYPE FLAGS SOURCE DESTINATION sitetunnel0 6to4 -- 75.10.11.12 --
The following command plumbs an IPv6 interface on this tunnel:
# ifconfig sitetunnel0 inet6 plumb up # ifconfig sitetunnel0 inet6 sitetunnel0: flags=2200041 <UP,RUNNING,NONUD,IPv6> mtu 65515 index 3 inet tunnel src 75.10.11.12 tunnel hop limit 64 inet6 2002:4b0a:b0c::1/16
Note that the system automatically configures the IPv6 address on the 6to4 IP interface. See ifconfig(8) for a description of how IPv6 addresses are configured on 6to4 tunnel links.
The command line interface of dladm is
Committed. The output of dladm is
Committed
read(1), dlpi(4P), attributes(7), ieee802.3(7), overlay(7), acctadm(8), autopush(8), eeprom(8), ifconfig(8), ipadm(8), ipsecconf(8), ndd(8), psrset(8), wpad(8), zonecfg(8)
The preferred method of referring to an aggregation in the
aggregation subcommands is by its link name. Referring to an aggregation by
its integer key is supported for backward
compatibility, but is not necessary. When creating an aggregation, if a
key is specified instead of a link name, the
aggregation's link name will be automatically generated by
dladm as
aggrkey.
| September 15, 2024 | OmniOS |