NETLINKROUTE

NETLINKROUTE is the Netlink protocol family in the Linux kernel used for communication between user space and kernel space to manage networking. It serves as the primary interface for configuring routing tables, interfaces, addresses, neighbours, and related policies. Applications and tools such as iproute2 rely on NETLINKROUTE to read and modify kernel routing state.

Messages are sent as Netlink messages with types beginning with RTM_. These include RTM_NEWLINK/RTM_DELLINK and RTM_GETLINK for link state; RTM_NEWADDR/RTM_DELADDR and RTM_GETADDR for IP addresses; RTM_NEWROUTE/RTM_DELROUTE/RTM_GETROUTE for routes; RTM_NEWNEIGH/RTM_GETNEIGH for neighbour cache; and RTM_NEWQDISC/RTM_DELLQDISC for traffic control components. Messages carry attributes encoded as Netlink attributes (NLA), carrying fields such as ifindex, address, gateway, and route metrics.

Netlink sockets are created with protocol NETLINK_ROUTE and can subscribe to multicast groups to receive asynchronous updates on events. The kernel's rtnetlink subsystem handles filtering and dispatching messages to user space and to kernel modules. Tools like iproute2 and its libnl-based libraries use NETLINKROUTE to implement commands such as ip link set, ip addr add, ip route add, and to monitor state via route dumps and event streams.

Implementation and headers: In the Linux kernel, the routing netlink interface is implemented under the rtnetlink subsystem; the user-visible API is defined in headers such as linux/netlink.h and linux/rtnetlink.h. The protocol has evolved to cover advanced features including policy routing, virtual links, bridges, tunneling, and IP rule-based routing.

Security and permissions: Access to NETLINKROUTE messages is subject to Linux capabilities; modifying kernel routing state typically requires elevated privileges (for example, CAP_NET_ADMIN). Reading state is generally allowed to unprivileged users for monitoring.

See also: Netlink, rtnetlink.h, iproute2.