How can I tell whether a network interface is physical (device) or virtual (alias)?

You can check /sys:

anthony@Zia:/sys/class/net$ ls -l /sys/class/net/
total 0
lrwxrwxrwx 1 root root 0 Dec 11 15:38 br0 -> ../../devices/virtual/net/br0
lrwxrwxrwx 1 root root 0 Dec 11 15:38 lan -> ../../devices/pci0000:00/0000:00:1e.0/0000:07:01.0/net/lan
lrwxrwxrwx 1 root root 0 Dec 11 15:38 lo -> ../../devices/virtual/net/lo
lrwxrwxrwx 1 root root 0 Dec 11 15:38 tun0 -> ../../devices/virtual/net/tun0

So, actual devices show in /sys/class/net. Note that aliases (like lan:0) do not (so you can tell which are aliases). And you can clearly see which are actual hardware (lan) and which aren't (br0, lo, tun0).

to clarify

You can tell which are real in the above because the virtual ones are all in virtual. And lan is on the PCI bus.

In your case, you have six: eth0, wan, and lan1–4. This is rather odd, since you say you only have five ports total. I'd guess eth0 is actually hardwired to a a switch-ish chip, and the other 5 ports are ports on that switch. wlan0 is probably real as well (would be the wireless adapter), though it isn't showing in /sys….

So, I'd say that for all practical purposes, your real ports are wan, lan1–4, and wlan0. br-lan is a bridge set up to make all 4 lan ports function as a switch (so you might be able to split that switch).

Assuming your interface MAC address was not spoofed, you can try to use ethtool:

ethtool -P {Network interface name}

"Permanent address: 00:00:00:00:00:00" will indicate it's a virtual network interface.

The following bash loop will display MAC address for all network interfaces:

for i in $(ip -o link show | awk -F': ' '{print $2}'); \
do mac=$(ethtool -P $i) \
&& printf '%-10s %-10s\n' "$i" "$mac"; \
done

---

lo         Permanent address: 00:00:00:00:00:00
enp5s0f0   Permanent address: 44:1e:a1:73:39:c8
enp4s0f0   Permanent address: 00:9c:02:b0:ef:20
enp5s0f1   Permanent address: 44:1e:a1:73:39:c9
enp4s0f1   Permanent address: 00:9c:02:b0:ef:24
virbr1     Permanent address: 00:00:00:00:00:00
virbr1-nic Permanent address: 00:00:00:00:00:00
virbr0     Permanent address: 00:00:00:00:00:00
virbr0-nic Permanent address: 00:00:00:00:00:00
vnet0      Permanent address: 00:00:00:00:00:00
vnet1      Permanent address: 00:00:00:00:00:00

I would start by looking in /etc/network/config ; most distros have a similar file to define and configure network devices. In debian/Ubuntu, it's /etc/network/interfaces. If you were to post the contents of that, we could identify alias, bond, and bridge entries; the rest would be your physical devices.

By looking at the ifconfig output, you can tell (as you mentioned) by the devices that have interrupts (IRQs); many also have memory assigned, which virtual interfaces don't.

You can't ever judge by mac addresses alone, since bonds (link aggregation) will override the mac of individual devices, and bridges will use the same. So if you have two devices bonded and bridged--a common configuration for HA virtual hosts and routers--there will be four devices with the same mac:

eth0  - physical device 1
eth1  - physical device 2
bond0 - the virtual device that uses either or both of the above
br0   - the bridge that uses bond0 and allows sharing/forwarding across bond0

Clearly the aliases used in openwrt are not the ones above, but the concept holds; I used these because they are standard practice.