What is veth?

A veth (virtual Ethernet) pair is two linked virtual interfaces on Linux that act like a cable: a frame sent into one end comes out of the other.

You create a pair with a command such as ip link add veth0 type veth peer name veth1. Neither end is attached to any hardware; the kernel simply hands every frame transmitted on one end to the other end as if it had just been received. The power comes from moving one end into a different network namespace, which is Linux's way of giving a process its own interfaces, addresses, routing table and firewall. Put one end inside a namespace and the other in the host, or attach it to a Linux bridge, and the namespace is connected to the network. Each end gets its own MAC address and can carry IP addresses, VLAN tags or anything else a normal Ethernet interface can.

This is exactly how Docker, Podman and Kubernetes networking connect containers. Inside a container you'll typically see an interface listed as eth0@if7: the @if7 means its peer is interface number 7 in another namespace, and on the host that peer is usually attached to a bridge such as docker0. Matching interface indexes is how you find which host-side veth belongs to which container. veth pairs are also handy for building labs on a single machine: several namespaces acting as hosts, joined by veth "cables" to a bridge acting as a switch, which is the approach the Switching basics lab uses. A common surprise is that if either end is deleted, or its namespace goes away, the other end disappears too. Packets on a veth can be captured with tcpdump like any other interface. The Linux Network Connectivity lesson explores interfaces and addresses with iproute2.