What is a veth pair, and how do you find which container a host-side veth belongs to?
Show the answer
Say this first
A veth pair is two virtual Ethernet interfaces joined like a patch cable: a frame sent into one comes out of
the other. You create both ends together, put one in a namespace and leave the other in the root namespace,
often attached to a bridge. That is how a container's eth0 connects to docker0 or a CNI bridge. To match
ends, use the peer interface index shown after @if in ip link, or ethtool -S.
Go deeper
Create and place
ip netns add red
ip link add veth-red type veth peer name veth-red-br
ip link set veth-red netns red
ip link set veth-red-br master br0
ip link set veth-red-br up
ip -n red link set veth-red upMatching the ends
$ ip -br link show type veth
veth-red-br@if5 UP d2:5f:0a:91:3c:11 <BROADCAST,MULTICAST,UP,LOWER_UP>
$ ethtool -S veth-red-br
NIC statistics:
peer_ifindex: 5Index 5 is the peer's interface index inside the other namespace. For a container, compare it with
nsenter -t <pid> -n ip -br link or cat /sys/class/net/eth0/iflink inside the container.
Rules
- Interface names are limited to 15 characters.
- Both ends must be up, and if one end is deleted the other disappears with it.
- veth reports a nominal 10 Gbps but real throughput depends on CPU.
They will ask next
veth or tap, what is the difference?
A veth joins two kernel network stacks. A tap device joins the kernel to a userspace program, such as QEMU, which reads and writes frames through a file descriptor. VMs use tap, containers use veth.
Why does a new veth show state LOWERLAYERDOWN?
Its peer is down. A veth only has carrier when both ends are up.
Traps
- Bringing up the host end and forgetting the namespace end (or the reverse).
- Using a name longer than 15 characters; the command fails.