Find your IP address on Linux

ip -br a, the readable default

$ ip -br a
lo               UNKNOWN        127.0.0.1/8 ::1/128
enp3s0           UP             192.168.1.24/24 2001:db8:aaaa:1::24/64 fe80::1a2b:3c4d:5e6f:7890/64
wlp2s0           DOWN
docker0          DOWN           172.17.0.1/16

Three columns: interface, operational state, addresses. -br is short for --brief and it turns the usual wall of output into something you can scan.

Add colour when you are reading it by eye:

ip -c -br a

Restrict it to one family:

ip -br -4 a
ip -br -6 a

The full form, ip addr show, adds flags, MTU, MAC address, and DHCP lease lifetimes for each address. Use it when you need the detail; use -br when you need the answer.

Getting only the address

$ hostname -I
192.168.1.24 2001:db8:aaaa:1::24

hostname -I prints every non-loopback address on one line, space separated. It is the shortest path to a value you want to paste somewhere, and it is safe in scripts as long as you handle more than one address.

For the address tied to a specific interface:

ip -4 -o addr show enp3s0 | awk '{print $4}'

Which interface is actually carrying traffic

A machine with Docker, a VPN, and both Wi-Fi and Ethernet has several addresses and only one route out. Ask the routing table rather than guessing.

$ ip route show default
default via 192.168.1.1 dev enp3s0 proto dhcp src 192.168.1.24 metric 100

$ ip route get 1.1.1.1
1.1.1.1 via 192.168.1.1 dev enp3s0 src 192.168.1.24 uid 1000

via is your gateway, dev is the interface, and src is the source address the kernel will use. That src value is the one that matters when you are debugging why a firewall rule or an allowlist is not matching.

NetworkManager systems

On a desktop distribution, nmcli gives the same facts with connection context.

nmcli device status
nmcli -f IP4.ADDRESS,IP4.GATEWAY,IP4.DNS device show enp3s0
nmcli -g IP4.ADDRESS device show enp3s0

-g prints the bare value with no key, which is what you want inside a script. On a systemd-networkd host use networkctl status instead.

Private versus public

Everything above is a local address. If it starts with 192.168., 10., or 172.16 to 172.31, it is private under RFC 1918 and no remote server will ever see it. A cloud VM is the same story: the address on eth0 is usually a private one inside the provider’s VPC, with a public address mapped to it at the edge.

Ask an outside service what it sees:

curl whatsmyip.fyi
curl -4 https://v4.whatsmyip.fyi/ip
curl -6 https://v6.whatsmyip.fyi/ip
curl -s https://whatsmyip.fyi/json | jq .

Plain curl whatsmyip.fyi returns text/plain because the site answers curl user agents with the bare address and a newline. The v4. and v6. hostnames are single-family, so curl -4 against the apex still tells you nothing about IPv6 reachability while v6.whatsmyip.fyi does.

The public vs private guide covers the boundary, and the full report turns your public address into ISP, ASN, and approximate location.

Reading the output correctly

• lo with 127.0.0.1/8 is the loopback, defined in RFC 1122. It is always there and it is never useful as an answer.
• fe80::/64 on every interface is IPv6 link-local, required by RFC 4291.
• Two global IPv6 addresses on one interface usually means privacy extensions (RFC 8981). The temporary one is used for outbound connections and rotates.
• docker0 at 172.17.0.1/16 and br-* interfaces are container bridges. They are local to the host.
• 169.254.x.x means DHCP failed and the interface fell back to link-local under RFC 3927.

In scripts

Do not parse ifconfig, and do not assume eth0 exists. Predictable interface names mean it is usually enp3s0 or ens5. Derive the interface from the route table, and set a timeout on any network call:

iface=$(ip -o route get 1.1.1.1 | awk '{print $5}')
local_ip=$(ip -o -4 addr show "$iface" | awk '{print $4}' | cut -d/ -f1)
public_ip=$(curl -fsS --max-time 5 https://whatsmyip.fyi/ip)

The script guide covers retries, rate limits, and the same job in Python, Go, Node, and PowerShell.