PFNETLINK

PFNETLINK is a Linux socket protocol family that provides a flexible, efficient channel for communication between kernel space and user space processes. It is implemented as the PF_NETLINK protocol family (PF_NETLINK is the integer constant 17 in the Linux kernel). Unlike conventional socket families such as PF_INET, Netlink sockets are message-oriented and use a bi‑directional message passing interface rather than byte streams.

Netlink messages are sent as structures that contain a header (struct nlmsghdr) followed by a variable-length payload. The header includes fields such as message type, flags, sequence number, and a process identifier. The payload is typically formed from Netlink attributes (struct rtattr) which encode data in a type‑length‑value format. This design enables efficient parsing and extension of protocol semantics.

Kernel modules expose Netlink services via a family identifier: the two most common are NETLINK_ROUTE (value 0) for routing and link configuration, and NETLINK_GENERIC (value 16) for generic netlink services. User programs create a socket with socket(AF_NETLINK, …), bind, and then use sendmsg() and recvmsg() to exchange Netlink messages. The kernel populates the nlmsg_pid field with the kernel's process ID, enabling users to match responses to requests.

Netlink is heavily used by tools such as ip, iproute2, and iptables, as well as by the kernel’s network stack for dynamic runtime configuration. It offers atomic message delivery, sequence ordering, and traceability. Security for Netlink is controlled via kernel capabilities; the CAP_NET_ADMIN capability is required for many Netlink operations.

The PF_NETLINK socket family has been part of Linux since early 2000s and remains the preferred IPC mechanism for low‑latency kernel–user communication in modern networking stacks.