How to Create and Configure Virtual Ethernet (veth) Pairs in Linux Using ip link

In modern Linux networking, container runtimes like Docker, Podman, and Kubernetes rely on a fundamental kernel primitive known as a Virtual Ethernet (veth) pair. A veth pair acts like an invisible, bidirectional virtual network patch cable: any packet transmitted into one end of the pair immediately emerges from the other end. Because each endpoint can reside in a different network namespace, veth pairs serve as the primary bridge connecting isolated containers and processes to the host system and the wider physical network.

In this guide, you will learn how to create, configure, and manage Virtual Ethernet (veth) pairs in Linux using the standard ip link command from the iproute2 utility suite, connect an endpoint to an isolated network namespace, and attach a peer to a network bridge.

---

How veth Pairs Work in the Linux Kernel

Unlike standard loopback or dummy interfaces that simply consume packets, veth devices are always created in linked pairs:

• Tunnel Behaviour: When you send a packet to veth0, the Linux network stack routes it directly across the kernel boundary into the receive queue of its peer, veth1.
• Cross-Namespace Connectivity: While both ends start in the default host network namespace, one end can be moved into an isolated network namespace (such as a container sandbox or custom test environment) while the other remains attached to the host.
• Bridge Integration: The host-side interface can be tethered to a software network bridge (br0), granting the isolated namespace direct Layer 2 connectivity to your local area network.

---

Step 1: Create a veth Pair Using ip link

To instantiate a new veth pair named veth-host and veth-guest, run the following command with root privileges:

sudo ip link add veth-host type veth peer name veth-guest

Verify that both virtual interfaces now exist on your host system:

ip link show type veth

Both devices will appear in the output with a state of DOWN.

---

Step 2: Move One Peer into an Isolated Network Namespace

The true utility of a veth pair comes from bridging namespaces. Let us create a test network namespace named isolated-ns and migrate veth-guest into it:

# 1. Create a new network namespace
sudo ip netns add isolated-ns

# 2. Transfer veth-guest into the namespace
sudo ip link set veth-guest netns isolated-ns

If you run ip link show on your host now, notice that veth-guest has disappeared from the host’s interface list. It now resides entirely inside the isolated namespace:

sudo ip netns exec isolated-ns ip link show

---

Step 3: Assign IP Addresses and Activate the Interfaces

To establish communication across the virtual cable, configure static IP addresses on both endpoints within the same subnet:

1. Configure the Host-Side Endpoint

# Assign an IP address on the host side
sudo ip addr add 10.200.1.1/24 dev veth-host

# Bring the host interface up
sudo ip link set veth-host up

2. Configure the Namespace Endpoint

# Bring loopback up inside the namespace
sudo ip netns exec isolated-ns ip link set lo up

# Assign an IP address inside the namespace
sudo ip netns exec isolated-ns ip addr add 10.200.1.2/24 dev veth-guest

# Bring the guest interface up
sudo ip netns exec isolated-ns ip link set veth-guest up

---

Step 4: Test Connectivity Across the veth Pair

With both endpoints active and addressed, test bidirectional communication using ping:

# Ping the namespace from the host
ping -c 3 10.200.1.2

# Ping the host from inside the namespace
sudo ip netns exec isolated-ns ping -c 3 10.200.1.1

Packets travel instantaneously through the kernel memory buffer between the host and the isolated namespace with negligible latency.

---

Step 5: Attach a veth Peer to a Linux Bridge

Instead of assigning a point-to-point IP address to veth-host, production container setups typically slave the host-side endpoint to a software bridge:

# Attach veth-host to an existing bridge named br0
sudo ip link set veth-host master br0

# Ensure the interface is UP
sudo ip link set veth-host up

This allows multiple container namespaces to share a unified broadcast domain and access external network gateways.

---

Step 6: Identifying Peers and Deleting veth Pairs

Because veth interfaces are linked, deleting either interface automatically destroys its corresponding peer:

sudo ip link delete veth-host

Both veth-host and veth-guest are instantly removed from the system. Similarly, if an isolated namespace is deleted, any child veth devices inside it are dismantled automatically.

To find out which peer an interface is linked to, query its interface index with ethtool:

ethtool -S veth-host

For related network virtualization architectures, read our tutorial on how to create and configure network bridges in Linux using ip link, or learn how to create and configure MACVLAN network interfaces in Linux using ip link.

---

Frequently Asked Questions

What happens if I rename one of the veth peers?

You can freely rename either interface using sudo ip link set veth-guest name eth0 (a technique standard container engines use when placing virtual adapters inside container namespaces). The kernel maintains the underlying peer relationship via internal interface index numbers rather than string names.

What is the performance overhead of a veth pair?

Because traffic moves entirely within kernel memory without physical transceiver encoding or hardware interrupts, veth pairs offer near-native memory transfer throughput with minimal CPU overhead.

Do veth pairs require special kernel modules?

The veth kernel module is compiled directly into almost all major Linux distributions (Ubuntu, Debian, Fedora, Arch, RHEL). If needed, you can explicitly load it with sudo modprobe veth.