Teams can be managed. This means the team device plugin is loaded.

OpenVSwitch can be managed. This means the OVS device plugin is loaded. Since: 1.24.

Networking state is unknown. This indicates a daemon error that makes it unable to reasonably assess the state. In such event the applications are expected to assume Internet connectivity might be present and not disable controls that require network access. The graphical shells may hide the network accessibility indicator altogether since no meaningful status indication can be provided.

Networking is not enabled, the system is being suspended or resumed from suspend.

There is no active network connection. The graphical shell should indicate no network connectivity and the applications should not attempt to access the network.

Network connections are being cleaned up. The applications should tear down their network sessions.

A network connection is being started The graphical shell should indicate the network is being connected while the applications should still make no attempts to connect the network.

There is only local IPv4 and/or IPv6 connectivity, but no default route to access the Internet. The graphical shell should indicate no network connectivity.

There is only site-wide IPv4 and/or IPv6 connectivity. This means a default route is available, but the Internet connectivity check (see "Connectivity" property) did not succeed. The graphical shell should indicate limited network connectivity.

There is global IPv4 and/or IPv6 Internet connectivity This means the Internet connectivity check succeeded, the graphical shell should indicate full network connectivity.

Network connectivity is unknown. This means the connectivity checks are disabled (e.g. on server installations) or has not run yet. The graphical shell should assume the Internet connection might be available and not present a captive portal window.

The host is not connected to any network. There's no active connection that contains a default route to the internet and thus it makes no sense to even attempt a connectivity check. The graphical shell should use this state to indicate the network connection is unavailable.

The Internet connection is hijacked by a captive portal gateway. The graphical shell may open a sandboxed web browser window (because the captive portals typically attempt a man-in-the-middle attacks against the https connections) for the purpose of authenticating to a gateway and retrigger the connectivity check with CheckConnectivity() when the browser window is dismissed.

The host is connected to a network, does not appear to be able to reach the full Internet, but a captive portal has not been detected.

The host is connected to a network, and appears to be able to reach the full Internet.

unknown device

generic support for unrecognized device types

a wired ethernet device

an 802.11 Wi-Fi device

not used

not used

a Bluetooth device supporting PAN or DUN access protocols

an OLPC XO mesh networking device

an 802.16e Mobile WiMAX broadband device

a modem supporting analog telephone, CDMA/EVDO, GSM/UMTS, or LTE network access protocols

an IP-over-InfiniBand device

a bond master interface

an 802.1Q VLAN interface

ADSL modem

a bridge master interface

a team master interface

a TUN or TAP interface

a IP tunnel interface

a MACVLAN interface

a VXLAN interface

a VETH interface

a MACsec interface

a dummy interface

a PPP interface

a Open vSwitch interface

a Open vSwitch port

a Open vSwitch bridge

a IEEE 802.15.4 (WPAN) MAC Layer Device

6LoWPAN interface

a WireGuard interface

an 802.11 Wi-Fi P2P device. Since: 1.16.

A VRF (Virtual Routing and Forwarding) interface. Since: 1.24.

a loopback interface. Since: 1.42.

A HSR/PRP device. Since: 1.46.

device has no special capabilities

NetworkManager supports this device

this device can indicate carrier status

this device is a software device

this device supports single-root I/O virtualization

device has no encryption/authentication capabilities

device supports 40/64-bit WEP encryption

device supports 104/128-bit WEP encryption

device supports TKIP encryption

device supports AES/CCMP encryption

device supports WPA1 authentication

device supports WPA2/RSN authentication

device supports Access Point mode

device supports Ad-Hoc mode

device reports frequency capabilities

device supports 2.4GHz frequencies

device supports 5GHz frequencies

device supports 6GHz frequencies. Since: 1.46.

device supports acting as a mesh point. Since: 1.20.

device supports WPA2/RSN in an IBSS network. Since: 1.22.

access point has no special capabilities

access point requires authentication and encryption (usually means WEP)

access point supports some WPS method

access point supports push-button WPS

access point supports PIN-based WPS

the access point has no special security requirements

40/64-bit WEP is supported for pairwise/unicast encryption

104/128-bit WEP is supported for pairwise/unicast encryption

TKIP is supported for pairwise/unicast encryption

AES/CCMP is supported for pairwise/unicast encryption

40/64-bit WEP is supported for group/broadcast encryption

104/128-bit WEP is supported for group/broadcast encryption

TKIP is supported for group/broadcast encryption

AES/CCMP is supported for group/broadcast encryption

WPA/RSN Pre-Shared Key encryption is supported

802.1x authentication and key management is supported

WPA/RSN Simultaneous Authentication of Equals is supported

WPA/RSN Opportunistic Wireless Encryption is supported

WPA/RSN Opportunistic Wireless Encryption transition mode is supported. Since: 1.26.

WPA3 Enterprise Suite-B 192 bit mode is supported. Since: 1.30.

the device or access point mode is unknown

for both devices and access point objects, indicates the object is part of an Ad-Hoc 802.11 network without a central coordinating access point.

the device or access point is in infrastructure mode. For devices, this indicates the device is an 802.11 client/station. For access point objects, this indicates the object is an access point that provides connectivity to clients.

the device is an access point/hotspot. Not valid for access point objects; used only for hotspot mode on the local machine.

the device is a 802.11s mesh point. Since: 1.20.

device has no usable capabilities

device provides Dial-Up Networking capability

device provides Network Access Point capability

modem has no usable capabilities

modem uses the analog wired telephone network and is not a wireless/cellular device

modem supports at least one of CDMA 1xRTT, EVDO revision 0, EVDO revision A, or EVDO revision B

modem supports at least one of GSM, GPRS, EDGE, UMTS, HSDPA, HSUPA, or HSPA+ packet switched data capability

modem has LTE data capability

modem has 5GNR data capability. Since: 1.36.

unknown network type

home network

partner network

roaming partner network

the device's state is unknown

the device is recognized, but not managed by NetworkManager

the device is managed by NetworkManager, but is not available for use. Reasons may include the wireless switched off, missing firmware, no ethernet carrier, missing supplicant or modem manager, etc.

the device can be activated, but is currently idle and not connected to a network.

the device is preparing the connection to the network. This may include operations like changing the MAC address, setting physical link properties, and anything else required to connect to the requested network.

the device is connecting to the requested network. This may include operations like associating with the Wi-Fi AP, dialing the modem, connecting to the remote Bluetooth device, etc.

the device requires more information to continue connecting to the requested network. This includes secrets like WiFi passphrases, login passwords, PIN codes, etc.

the device is requesting IPv4 and/or IPv6 addresses and routing information from the network.

the device is checking whether further action is required for the requested network connection. This may include checking whether only local network access is available, whether a captive portal is blocking access to the Internet, etc.

the device is waiting for a secondary connection (like a VPN) which must activated before the device can be activated

the device has a network connection, either local or global.

a disconnection from the current network connection was requested, and the device is cleaning up resources used for that connection. The network connection may still be valid.

the device failed to connect to the requested network and is cleaning up the connection request

No reason given

Unknown error

Device is now managed

Device is now unmanaged

The device could not be readied for configuration

IP configuration could not be reserved (no available address, timeout, etc)

The IP config is no longer valid

Secrets were required, but not provided

802.1x supplicant disconnected

802.1x supplicant configuration failed

802.1x supplicant failed

802.1x supplicant took too long to authenticate

PPP service failed to start

PPP service disconnected

PPP failed

DHCP client failed to start

DHCP client error

DHCP client failed

Shared connection service failed to start

Shared connection service failed

AutoIP service failed to start

AutoIP service error

AutoIP service failed

The line is busy

No dial tone

No carrier could be established

The dialing request timed out

The dialing attempt failed

Modem initialization failed

Failed to select the specified APN

Not searching for networks

Network registration denied

Network registration timed out

Failed to register with the requested network

PIN check failed

Necessary firmware for the device may be missing

The device was removed

NetworkManager went to sleep

The device's active connection disappeared

Device disconnected by user or client

Carrier/link changed

The device's existing connection was assumed

The supplicant is now available

The modem could not be found

The Bluetooth connection failed or timed out

GSM Modem's SIM Card not inserted

GSM Modem's SIM Pin required

GSM Modem's SIM Puk required

GSM Modem's SIM wrong

InfiniBand device does not support connected mode

A dependency of the connection failed

Problem with the RFC 2684 Ethernet over ADSL bridge

ModemManager not running

The Wi-Fi network could not be found

A secondary connection of the base connection failed

DCB or FCoE setup failed

teamd control failed

Modem failed or no longer available

Modem now ready and available

SIM PIN was incorrect

New connection activation was enqueued

the device's parent changed

the device parent's management changed

problem communicating with Open vSwitch database

a duplicate IP address was detected

The selected IP method is not supported

configuration of SR-IOV parameters failed

The Wi-Fi P2P peer could not be found

The device handler dispatcher returned an error. Since: 1.46

The metered status is unknown

Metered, the value was explicitly configured

Not metered, the value was explicitly configured

Metered, the value was guessed

Not metered, the value was guessed

indicates that the per-connection setting is unspecified. In this case, it will fallback to the default value, which is %NM_CONNECTION_MULTI_CONNECT_SINGLE.

the connection profile can only be active once at each moment. Activating a profile that is already active, will first deactivate it.

the profile can be manually activated multiple times on different devices. However, regarding autoconnect, the profile will autoconnect only if it is currently not connected otherwise.

the profile can autoactivate and be manually activated multiple times together.

the state of the connection is unknown

a network connection is being prepared

there is a connection to the network

the network connection is being torn down and cleaned up

the network connection is disconnected and will be removed

The reason for the active connection state change is unknown.

No reason was given for the active connection state change.

The active connection changed state because the user disconnected it.

The active connection changed state because the device it was using was disconnected.

The service providing the VPN connection was stopped.

The IP config of the active connection was invalid.

The connection attempt to the VPN service timed out.

A timeout occurred while starting the service providing the VPN connection.

Starting the service providing the VPN connection failed.

Necessary secrets for the connection were not provided.

Authentication to the server failed.

The connection was deleted from settings.

Master connection of this connection failed to activate.

Could not create the software device link.

The device this connection depended on disappeared.

no special behavior; by default no user interaction is allowed and requests for secrets are fulfilled from persistent storage, or if no secrets are available an error is returned.

allows the request to interact with the user, possibly prompting via UI for secrets if any are required, or if none are found in persistent storage.

explicitly prompt for new secrets from the user. This flag signals that NetworkManager thinks any existing secrets are invalid or wrong. This flag implies that interaction is allowed.

set if the request was initiated by user-requested action via the D-Bus interface, as opposed to automatically initiated by NetworkManager in response to (for example) scan results or carrier changes.

indicates that WPS enrollment is active with PBC method. The agent may suggest that the user pushes a button on the router instead of supplying a PSK.

Internal flag, not part of the D-Bus API.

Internal flag, not part of the D-Bus API.

the agent supports no special capabilities

the agent supports passing hints to VPN plugin authentication dialogs.

Unknown/unset tunnel mode

IP in IP tunnel

GRE tunnel

SIT tunnel

ISATAP tunnel

VTI tunnel

IPv6 in IPv6 tunnel

IPv4 in IPv6 tunnel

IPv6 GRE tunnel

IPv6 VTI tunnel

GRETAP tunnel

IPv6 GRETAP tunnel

no flags

when creating a new checkpoint, destroy all existing ones.

upon rollback, delete any new connection added after the checkpoint. Since: 1.6.

upon rollback, disconnect any new device appeared after the checkpoint. Since: 1.6.

by default, creating a checkpoint fails if there are already existing checkpoints that reference the same devices. With this flag, creation of such checkpoints is allowed, however, if an older checkpoint that references overlapping devices gets rolled back, it will automatically destroy this checkpoint during rollback. This allows to create several overlapping checkpoints in parallel, and rollback to them at will. With the special case that rolling back to an older checkpoint will invalidate all overlapping younger checkpoints. This opts-in that the checkpoint can be automatically destroyed by the rollback of an older checkpoint. Since: 1.12.

during rollback, by default externally added ports attached to bridge devices are preserved. With this flag, the rollback detaches all external ports. This only has an effect for bridge ports. Before 1.38, this was the default behavior. Since: 1.38.

during rollback, by default changes to global DNS via D-BUS interface are preserved. With this flag, the rollback reverts the global DNS changes made via D-Bus interface. Global DNS defined in [global-dns] section of NetworkManager.conf is not impacted by this flag. Since: 1.48.

the rollback succeeded.

the device no longer exists.

the device is now unmanaged.

other errors during rollback.

an alias for numeric zero, no flags set.

the connection is not saved to disk. That either means, that the connection is in-memory only and currently is not backed by a file. Or, that the connection is backed by a file, but has modifications in-memory that were not persisted to disk.

A connection is "nm-generated" if it was generated by NetworkManger. If the connection gets modified or saved by the user, the flag gets cleared. A nm-generated is also unsaved and has no backing file as it is in-memory only.

The connection will be deleted when it disconnects. That is for in-memory connections (unsaved), which are currently active but deleted on disconnect. Volatile connections are always unsaved, but they are also no backing file on disk and are entirely in-memory only.

the profile was generated to represent an external configuration of a networking device. Since: 1.26.

an alias for numeric zero, no flags set.

the device is a master.

the device is a slave.

layer2 is activated and ready.

IPv4 setting is completed.

IPv6 setting is completed.

The master has any slave devices attached. This only makes sense if the device is a master.

the lifetime of the activation is bound to the visibility of the connection profile, which in turn depends on "connection.permissions" and whether a session for the user exists. Since: 1.16.

the active connection was generated to represent an external configuration of a networking device. Since: 1.26.

an alias for numeric zero, no flags set.

to persist the connection to disk.

to make the connection in-memory only.

usually, when the connection has autoconnect enabled and gets added, it becomes eligible to autoconnect right away. Setting this flag, disables autoconnect until the connection is manually activated.

an alias for numeric zero, no flags set.

to persist the connection to disk.

makes the profile in-memory. Note that such profiles are stored in keyfile format under /run. If the file is already in-memory, the file in /run is updated in-place. Otherwise, the previous storage for the profile is left unchanged on disk, and the in-memory copy shadows it. Note that the original filename of the previous persistent storage (if any) is remembered. That means, when later persisting the profile again to disk, the file on disk will be overwritten again. Likewise, when finally deleting the profile, both the storage from /run and persistent storage are deleted (or if the persistent storage does not allow deletion, and nmmeta file is written to mark the UUID as deleted).

this is almost the same as %NM_SETTINGS_UPDATE2_FLAG_IN_MEMORY, with one difference: when later deleting the profile, the original profile will not be deleted. Instead a nmmeta file is written to /run to indicate that the profile is gone. Note that if such a nmmeta tombstone file exists and hides a file in persistent storage, then when re-adding the profile with the same UUID, then the original storage is taken over again.

this is like %NM_SETTINGS_UPDATE2_FLAG_IN_MEMORY, but if the connection has a corresponding file on persistent storage, the file will be deleted right away. If the profile is later again persisted to disk, a new, unused filename will be chosen.

This can be specified with either %NM_SETTINGS_UPDATE2_FLAG_IN_MEMORY, %NM_SETTINGS_UPDATE2_FLAG_IN_MEMORY_DETACHED or %NM_SETTINGS_UPDATE2_FLAG_IN_MEMORY_ONLY. After making the connection in-memory only, the connection is marked as volatile. That means, if the connection is currently not active it will be deleted right away. Otherwise, it is marked to for deletion once the connection deactivates. A volatile connection cannot autoactivate again (because it's about to be deleted), but a manual activation will clear the volatile flag.

usually, when the connection has autoconnect enabled and is modified, it becomes eligible to autoconnect right away. Setting this flag, disables autoconnect until the connection is manually activated.

when a profile gets modified that is currently active, then these changes don't take effect for the active device unless the profile gets reactivated or the configuration reapplied. There are two exceptions: by default "connection.zone" and "connection.metered" properties take effect immediately. Specify this flag to prevent these properties to take effect, so that the change is restricted to modify the profile. Since: 1.20.

no flag set.

during reapply, preserve external IP addresses and routes.

use the globally-configured default value.

the option is disabled.

the option is enabled.

an alias for numeric zero, no flags set. This reloads everything that is supported and is identical to a SIGHUP.

reload the NetworkManager.conf configuration from disk. Note that this does not include connections, which can be reloaded via Setting's ReloadConnections().

update DNS configuration, which usually involves writing /etc/resolv.conf anew.

means to restart the DNS plugin. This is for example useful when using dnsmasq plugin, which uses additional configuration in /etc/NetworkManager/dnsmasq.d. If you edit those files, you can restart the DNS plugin. This action shortly interrupts name resolution.

all flags.

an alias for numeric zero, no flags set.

the interface is enabled from the administrative point of view. Corresponds to kernel IFF_UP.

the physical link is up. Corresponds to kernel IFF_LOWER_UP.

receive all packets. Corresponds to kernel IFF_PROMISC. Since: 1.32.

the interface has carrier. In most cases this is equal to the value of @NM_DEVICE_INTERFACE_FLAG_LOWER_UP. However some devices have a non-standard carrier detection mechanism.

the flag to indicate device LLDP status. Since: 1.32.

unknown or no permission

controls whether networking can be globally enabled or disabled

controls whether Wi-Fi can be globally enabled or disabled

controls whether WWAN (3G) can be globally enabled or disabled

controls whether WiMAX can be globally enabled or disabled

controls whether the client can ask NetworkManager to sleep and wake

controls whether networking connections can be started, stopped, and changed

controls whether a password protected Wi-Fi hotspot can be created

controls whether an open Wi-Fi hotspot can be created

controls whether connections that are available to all users can be modified

controls whether connections owned by the current user can be modified

controls whether the persistent hostname can be changed

modify persistent global DNS configuration

controls access to Reload.

permission to create checkpoints.

controls whether device statistics can be globally enabled or disabled

controls whether connectivity check can be enabled or disabled

controls whether wifi scans can be performed

unknown or no authorization

the permission is available

authorization is necessary before the permission is available

permission to perform the operation is denied by system policy

an alias for numeric zero, no flags set.

A Wireless LAN device or rfkill switch is detected in the system.

A Wireless WAN device or rfkill switch is detected in the system.

The default, meaning that no MPTCP flags are set.

don't configure MPTCP endpoints on the device.

MPTCP is enabled and endpoints will be configured. This flag is implied if any of the other flags indicate that MPTCP is enabled and therefore in most cases unnecessary. Note that if "/proc/sys/net/mptcp/enabled" sysctl is disabled, MPTCP handling is disabled despite this flag. This can be overruled with the "also-without-sysctl" flag. Note that by default interfaces that don't have a default route are excluded from having MPTCP endpoints configured. This can be overruled with the "also-without-default-route" and this affects endpoints per address family.

even if MPTCP handling is enabled via the "enabled" flag, it is ignored unless "/proc/sys/net/mptcp/enabled" is on. With this flag, MPTCP endpoints will be configured regardless of the sysctl setting.

even if MPTCP handling is enabled via the "enabled" flag, it is ignored per-address family unless NetworkManager configures a default route. With this flag, NetworkManager will also configure MPTCP endpoints if there is no default route. This takes effect per-address family.

Flag for the MPTCP endpoint. The endpoint will be announced/signaled to each peer via an MPTCP ADD_ADDR sub-option.

Flag for the MPTCP endpoint. If additional subflow creation is allowed by the MPTCP limits, the MPTCP path manager will try to create an additional subflow using this endpoint as the source address after the MPTCP connection is established.

Flag for the MPTCP endpoint. If this is a subflow endpoint, the subflows created using this endpoint will have the backup flag set during the connection process. This flag instructs the peer to only send data on a given subflow when all non-backup subflows are unavailable. This does not affect outgoing data, where subflow priority is determined by the backup/non-backup flag received from the peer

Flag for the MPTCP endpoint. If this is a subflow endpoint and additional subflow creation is allowed by the MPTCP limits, the MPTCP path manager will try to create an additional subflow for each known peer address, using this endpoint as the source address. This will occur after the MPTCP connection is established. If the peer did not announce any additional addresses using the MPTCP ADD_ADDR sub-option, this will behave the same as a plain subflow endpoint. When the peer does announce addresses, each received ADD_ADDR sub-option will trigger creation of an additional subflow to generate a full mesh topology.