rtnetlink

Rtnetlink, short for routing netlink, is a netlink-based interface provided by the Linux kernel for configuring networking state. It enables communication between user-space programs and the kernel to query and modify routing tables, interfaces, addresses, and related networking parameters.

The rtnetlink interface uses the NETLINK_ROUTE family to carry messages between kernel space and user space. Messages are defined in the rtnetlink headers and exchanged via netlink sockets. User-space tools and libraries construct these messages to perform operations such as creating or deleting network interfaces, assigning addresses, adding or removing routes, and configuring traffic control and policy-based routing.

Common message types cover a range of tasks. For example, RTM_NEWLINK, RTM_DELLINK, and RTM_GETLINK manage network interfaces; RTM_NEWADDR, RTM_DELADDR, and RTM_GETADDR handle IP addresses; RTM_NEWROUTE, RTM_DELROUTE, and RTM_GETROUTE manage routing entries. Additional message families enable configuration of other networking subsystems, including tunnels, bridge devices, and QoS components. Attributes within messages encode parameters such as interface indices, IP addresses, and network masks.

In user space, the iproute2 suite (the ip command and related tools) is the primary user of rtnetlink, issuing netlink messages to shape the kernel’s networking state. Other programs and libraries, such as libnl, provide higher-level abstractions for interacting with rtnetlink.

Security and access control are important considerations. Access to rtnetlink sockets typically requires appropriate privileges (for example, CAP_NET_ADMIN) and may be restricted by network namespaces and user permissions.