What does "state UNKNOWN" mean in ip link output?
For example
10: enp56s0f3u4u2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN mode DEFAULT group default qlen 1000
link/ether X:X:X:X:X:X brd ff:ff:ff:ff:ff:ff
As I know a network interface can be either UP or DOWN.
Each interface has at least two different kinds of states:
Administrative state (whether the interface is enabled). This is just up/down and is controlled by you, or by networking software; after you enable the interface with ip link set eth0 up or ifconfig eth0 up, you can see it indicated as the flag <UP> near the beginning of your example.
Operational state (whether the interface works). Just because it's enabled, doesn't mean it can transfer data already – Ethernet needs a cable to be connected; Wi-Fi needs to be associated with an AP; basically it needs a carrier. For physical interfaces this is obviously an external factor and cannot be controlled with commands; it only shows up in the output as <LOWER_UP> if carrier is present.
These are more complex than up/down in reality, when e.g. Wi-Fi networks with WPA-Enterprise do have a carrier after associating, but cannot yet send data until the WPA handshake is performed, so there's a third level of "operational" state: 'dormant'.
(For virtual interfaces such as VLANs, there's yet another, 'lowerlayerdown'.)
So "state UNKNOWN" isn't the administrative "up/down" switch, it's the operational state that comes from the system itself shows a whole selection of values. This state needs to be provided by the driver – and (at least according to Linux documentation) not all drivers have the necessary bits to set the actual oper state. So if your Ethernet driver hasn't done so, you will see the default value IF_OPER_UNKNOWN (0).
The output of ip can be misleading.
The part you are looking at goes from DOWN to UNKNOWN when the interface is up, and to UP when an actual connection is made.
The part inside the angled brackets is what tells you when the interface itself is up.
