rtnetlink(7)

🌸 NAME 🌸

rtnetlink — the Linux routing socket, aka rtnetlink(7), aka the girl who runs the whole network stack's group chat 💅

---

✨ SYNOPSIS ✨

#include <asm/types.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>
#include <sys/socket.h>

rtnetlink_socket = socket(AF_NETLINK, int socket_type, NETLINK_ROUTE);

---

🦋 DESCRIPTION 🦋

okay so BESTIE. rtnetlink is the thing that lets you read the kernel's routing tables and also alter them. main character behavior honestly. It gets used inside the kernel itself so all the different subsystems can gossip with each other (that internal usage is not documented here, so don't @ me), and it's also how user-space programs get to talk to the kernel.

What can you control through NETLINK_ROUTE sockets? Literally all of this:

• network routes
• IP addresses
• link parameters
• neighbor setups
• queueing disciplines
• traffic classes
• packet classifiers

It's built on top of netlink messages, so if you want the full lore go read netlink(7).

🌈 Routing attributes

Some rtnetlink messages carry optional attributes chilling right after the initial header:

struct rtattr {
    unsigned short rta_len;    /* Length of option */
    unsigned short rta_type;   /* Type of option */
    /* Data follows */
};

⚠️ Bestie, listen: you should manipulate these attributes only with the RTA_* macros or with libnetlink. See rtnetlink(3). No freestyling, no touching the bytes yourself. 🙈

💫 Messages

Rtnetlink is made up of these message types (on top of the standard netlink messages, obviously):

• RTM_NEWLINK
• RTM_DELLINK
• RTM_GETLINK — create, remove, or get info about a specific network interface. These messages contain an ifinfomsg structure, followed by a series of rtattr structures.

struct ifinfomsg {
    unsigned char  ifi_family; /* AF_UNSPEC */
    unsigned short ifi_type;   /* Device type */
    int            ifi_index;  /* Interface index */
    unsigned int   ifi_flags;  /* Device flags  */
    unsigned int   ifi_change; /* change mask */
};

ifi_flags holds the device flags — go look at netdevice(7) for those. ifi_index is the unique interface index (and since Linux 3.7 you can feed a nonzero value along with the RTM_NEWLINK message to create a link with that given ifindex, which is lowkey iconic). ifi_change is a mask that says which bits of ifi_flags should actually be applied to the device. 🌟

Routing attributes:

• IFLA_UNSPEC — value type - — unspecified
• IFLA_ADDRESS — value type hardware address — interface L2 address
• IFLA_BROADCAST — value type hardware address — L2 broadcast address
• IFLA_IFNAME — value type asciiz string — Device name
• IFLA_MTU — value type unsigned int — MTU of the device
• IFLA_LINK — value type int — Link type
• IFLA_QDISC — value type asciiz string — Queueing discipline
• IFLA_STATS — value type see below — Interface Statistics
• IFLA_PERM_ADDRESS — value type hardware address — hardware address provided by device (since Linux 5.5)

The value type for IFLA_STATS is struct rtnl_link_stats (which was struct net_device_stats back in Linux 2.4 and earlier, if you're feeling vintage 🎀).

---

• RTM_NEWADDR
• RTM_DELADDR
• RTM_GETADDR — add, remove, or receive info about an IP address tied to an interface.

History lesson real quick: in Linux 2.2 an interface can carry multiple IP addresses, which replaces the alias device concept from Linux 2.0. And in Linux 2.2 these messages support both IPv4 and IPv6 addresses. They contain an ifaddrmsg structure, optionally followed by rtattr routing attributes.

struct ifaddrmsg {
    unsigned char ifa_family;    /* Address type */
    unsigned char ifa_prefixlen; /* Prefixlength of address */
    unsigned char ifa_flags;     /* Address flags */
    unsigned char ifa_scope;     /* Address scope */
    unsigned int  ifa_index;     /* Interface index */
};

So: ifa_family is the address family type (right now that's AF_INET or AF_INET6). ifa_prefixlen is the length of the address mask of the address, if one is defined for that family (like for IPv4). ifa_scope is the address scope. ifa_index is the interface index of the interface the address is associated with. And ifa_flags is a flag word containing IFA_F_SECONDARY for a secondary address (that's the old alias interface) and IFA_F_PERMANENT for a permanent address set by the user — plus other undocumented flags, which, sure. 💀

Attributes:

• IFA_UNSPEC — value type - — unspecified
• IFA_ADDRESS — value type raw protocol address — interface address
• IFA_LOCAL — value type raw protocol address — local address
• IFA_LABEL — value type asciiz string — name of the interface
• IFA_BROADCAST — value type raw protocol address — broadcast address
• IFA_ANYCAST — value type raw protocol address — anycast address
• IFA_CACHEINFO — value type struct ifa_cacheinfo — Address information

struct ifa_cacheinfo {
    __u32 ifa_prefered; // Preferred lifetime remaining, in seconds
    __u32 ifa_valid;    // Valid lifetime remaining, in seconds
    __u32 cstamp;       // Creation timestamp, in centiseconds
    __u32 tstamp;       // Update timestamp, in centiseconds
};

🚨 Rules of the cacheinfo house: ifa_valid cannot be zero, and ifa_prefered cannot be greater than ifa_valid. A value of UINT32_MAX means an infinite lifetime. Periodt.

---

• RTM_NEWROUTE
• RTM_DELROUTE
• RTM_GETROUTE — create, remove, or receive info about a network route. These messages contain an rtmsg structure with an optional sequence of rtattr structures following it.

For RTM_GETROUTE: setting rtm_dst_len and rtm_src_len to 0 means you get all entries for the specified routing table. For the other fields — except rtm_table and rtm_protocol — 0 is the wildcard. ✨

struct rtmsg {
    unsigned char rtm_family;   /* Address family of route */
    unsigned char rtm_dst_len;  /* Length of destination */
    unsigned char rtm_src_len;  /* Length of source */
    unsigned char rtm_tos;      /* TOS filter */
    unsigned char rtm_table;    /* Routing table ID;
                                   see RTA_TABLE below */
    unsigned char rtm_protocol; /* Routing protocol; see below */
    unsigned char rtm_scope;    /* See below */
    unsigned char rtm_type;     /* See below */

    unsigned int  rtm_flags;
};

rtm_type — Route type:

• RTN_UNSPEC — unknown route
• RTN_UNICAST — a gateway or direct route
• RTN_LOCAL — a local interface route
• RTN_BROADCAST — a local broadcast route (sent as a broadcast)
• RTN_ANYCAST — a local broadcast route (sent as a unicast)
• RTN_MULTICAST — a multicast route
• RTN_BLACKHOLE — a packet dropping route
• RTN_UNREACHABLE — an unreachable destination
• RTN_PROHIBIT — a packet rejection route
• RTN_THROW — continue routing lookup in another table
• RTN_NAT — a network address translation rule
• RTN_XRESOLVE — refer to an external resolver (not implemented)

rtm_protocol — Route origin:

• RTPROT_UNSPEC — unknown
• RTPROT_REDIRECT — by an ICMP redirect (currently unused)
• RTPROT_KERNEL — by the kernel
• RTPROT_BOOT — during boot
• RTPROT_STATIC — by the administrator

Values larger than RTPROT_STATIC are not interpreted by the kernel — they're just there for your user-space info. You can use them to tag where a piece of routing info came from, or to tell multiple routing daemons apart. Check <linux/rtnetlink.h> for the routing daemon identifiers that are already assigned. 🫶

rtm_scope is the distance to the destination:

• RT_SCOPE_UNIVERSE — global route
• RT_SCOPE_SITE — interior route in the local autonomous system
• RT_SCOPE_LINK — route on this link
• RT_SCOPE_HOST — route on the local host
• RT_SCOPE_NOWHERE — destination doesn't exist

The values between RT_SCOPE_UNIVERSE and RT_SCOPE_SITE are available to the user.

The rtm_flags have the following meanings:

• RTM_F_NOTIFY — if the route changes, notify the user via rtnetlink
• RTM_F_CLONED — route is cloned from another route
• RTM_F_EQUALIZE — a multipath equalizer (not yet implemented)

rtm_table specifies the routing table:

• RT_TABLE_UNSPEC — an unspecified routing table
• RT_TABLE_DEFAULT — the default table
• RT_TABLE_MAIN — the main table
• RT_TABLE_LOCAL — the local table

---

...you can legitimately drop any arbitrary value you want in there, anywhere between RT_TABLE_UNSPEC and RT_TABLE_DEFAULT 💅 the kernel is not gonna police that, bestie.

🎀 Attributes 🎀

okay so here's the whole roster of rta_type values you might see riding along in the message, with what they hold and what they mean:

• RTA_UNSPEC — - — literally just ignored, it's giving placeholder energy 🙈
• RTA_DST — protocol address — Route destination address
• RTA_SRC — protocol address — Route source address
• RTA_IIF — int — Input interface index
• RTA_OIF — int — Output interface index
• RTA_GATEWAY — protocol address — The gateway of the route 👑
• RTA_PRIORITY — int — Priority of route
• RTA_PREFSRC — protocol address — Preferred source address
• RTA_METRICS — Route metrics (see below 👇)
• RTA_MULTIPATH — Multipath nexthop data (see below 👇)
• RTA_PROTOINFO — No longer used 💀
• RTA_FLOW — int — Route realm
• RTA_CACHEINFO — struct rta_cacheinfo (peep linux/rtnetlink.h)
• RTA_SESSION — No longer used 💀
• RTA_MP_ALGO — No longer used 💀
• RTA_TABLE — int — Routing table ID; if you set this one, rtm_table gets straight up ignored, no cap
• RTA_MARK — int
• RTA_MFC_STATS — struct rta_mfc_stats (peep linux/rtnetlink.h)
• RTA_VIA — struct rtvia — Gateway in a different AF (see below 👇)
• RTA_NEWDST — protocol address — Change packet destination address
• RTA_PREF — char — RFC4191 IPv6 router preference (see below 👇)
• RTA_ENCAP_TYPE — short — Encapsulation type for lwtunnels (see below 👇)
• RTA_ENCAP — Defined by RTA_ENCAP_TYPE
• RTA_EXPIRES — int — Expire time for IPv6 routes (in seconds)

---

so RTA_METRICS is not just one little value, bestie — it's an array of struct rtattr, each one carrying its own attribute, and they go a lil something like this:

• RTAX_UNSPEC — - — unspecified 🤷
• RTAX_LOCK — __u32 — Bit field indicating which RTAX_* attributes are locked.
• RTAX_MTU — __u32 — Maximum Transmission Unit for this route.
• RTAX_WINDOW — __u32 — Maximum size of the receive window for this route.
• RTAX_RTT — __u32 — Estimated round-trip time for this route.
• RTAX_RTTVAR — __u32 — Estimated round-trip time variation for this route.
• RTAX_SSTHRESH — __u32 — Slow start threshold to use for this route.
• RTAX_CWND — __u32 — Maximum size of the congestion window for this route.
• RTAX_ADVMSS — __u32 — Maximum Segment Size to advertise for this route.
• RTAX_REORDERING — __u32 — Initial reordering level of packets for this route.
• RTAX_HOPLIMIT — __u32 — Hop limit (TTL) to use for this route.
• RTAX_INITCWND — __u32 — Initial congestion window to use for this route.
• RTAX_FEATURES — __u32 — Features to enable for this route specifically.
• RTAX_RTO_MIN — __u32 — Minimum Retransmission TimeOut to use for this route.
• RTAX_INITRWND — __u32 — Initial size of the receive window for this route.
• RTAX_QUICKACK — __u32 — Use quick ack for this route.
• RTAX_CC_ALGO — asciiz string — Congestion Control algorithm to use for this route.
• RTAX_FASTOPEN_NO_COOKIE — __u32 — Allow TCP Fast Open without cookie.

⚠️ okay important one: metrics that are locked with RTAX_LOCK take precedence over the values the kernel would normally use (the ones it computed, or that something set via a sysctl or setsockopt(2)). So lowkey some metrics — RTAX_RTO_MIN is the classic example — do absolutely nothing unless their bit is set in RTAX_LOCK. Set the bit or it's not happening. 💅

---

and now for RTA_MULTIPATH ✨ it's a bunch of packed instances of struct rtnexthop hanging out together, plus nested RTAs (RTA_GATEWAY) tucked inside:

struct rtnexthop {
    unsigned short rtnh_len;     /* Length of struct + length
                                    of RTAs */
    unsigned char  rtnh_flags;   /* Flags (see
                                    linux/rtnetlink.h) */
    unsigned char  rtnh_hops;    /* Nexthop priority */
    int            rtnh_ifindex; /* Interface index for this
                                    nexthop */
};

there's a whole squad of RTNH_* macros that look just like the RTA_* and NLHDR_* macros, and they're the ones you want for wrangling these structures 🫶

struct rtvia {
    unsigned short rtvia_family;
    unsigned char  rtvia_addr[0];
};

rtvia_addr is the address itself, and rtvia_family is its family type. periodt.

RTA_PREF can hold the values ICMPV6_ROUTER_PREF_LOW, ICMPV6_ROUTER_PREF_MEDIUM, and ICMPV6_ROUTER_PREF_HIGH, all defined in <linux/icmpv6.h>.

RTA_ENCAP_TYPE can hold the values LWTUNNEL_ENCAP_MPLS, LWTUNNEL_ENCAP_IP, LWTUNNEL_ENCAP_ILA, or LWTUNNEL_ENCAP_IP6, defined in <linux/lwtunnel.h>.

Fill these values in! 🫡

---

💖 RTM_NEWNEIGH 💖

💖 RTM_DELNEIGH 💖

💖 RTM_GETNEIGH 💖

These three add, remove, or hand you info about a neighbor table entry (think: an ARP entry, the classic). The message is packing an ndmsg structure:

struct ndmsg {
    unsigned char ndm_family;
    int           ndm_ifindex;  /* Interface index */
    __u16         ndm_state;    /* State */
    __u8          ndm_flags;    /* Flags */
    __u8          ndm_type;
};

struct nda_cacheinfo {
    __u32         ndm_confirmed;
    __u32         ndm_used;
    __u32         ndm_updated;
    __u32         ndm_refcnt;
};

so ndm_state is a bit mask, and here's everything it can be masking, bestie:

• NUD_INCOMPLETE — a currently resolving cache entry
• NUD_REACHABLE — a confirmed working cache entry 👑
• NUD_STALE — an expired cache entry
• NUD_DELAY — an entry waiting for a timer ⏳
• NUD_PROBE — a cache entry that is currently reprobed
• NUD_FAILED — an invalid cache entry 💀
• NUD_NOARP — a device with no destination cache
• NUD_PERMANENT — a static entry

and the valid ndm_flags are:

• NTF_PROXY — a proxy arp entry
• NTF_ROUTER — an IPv6 router

meanwhile the rtattr struct has these meanings for its rta_type field:

• NDA_UNSPEC — unknown type 🙈
• NDA_DST — a neighbor cache n/w layer destination address
• NDA_LLADDR — a neighbor cache link layer address
• NDA_CACHEINFO — cache statistics

and FYI: if that rta_type field is NDA_CACHEINFO, then a struct nda_cacheinfo header follows it. 🫶

---

🌈 RTM_NEWRULE 🌈

🌈 RTM_DELRULE 🌈

🌈 RTM_GETRULE 🌈

Add, delete, or retrieve a routing rule. Carries a struct rtmsg

💅 the qdisc ops, bestie

RTM_NEWQDISC, RTM_DELQDISC, RTM_GETQDISC — these three are literally the add / remove / get trio for a queueing discipline. So if you wanna slide a new qdisc in, yeet one out, or just peek at what's there? Yeah. These.

Every one of these messages carries a struct tcmsg, and it may have a whole parade of attributes tagging along after it. Observe, bestie:

struct tcmsg {
    unsigned char    tcm_family;
    int              tcm_ifindex;   /* interface index */
    __u32            tcm_handle;    /* Qdisc handle */
    __u32            tcm_parent;    /* Parent qdisc */
    __u32            tcm_info;
};

✨ now the attributes, slay:

• TCA_UNSPEC — value type: - — it's just… unspecified. vibes only, no meaning 💀
• TCA_KIND — an asciiz string — the name of the queueing discipline 🎀
• TCA_OPTIONS — a byte sequence — the qdisc-specific options come right after this one
• TCA_STATS — a struct tc_stats — the qdisc's statistics, the receipts, the math 🧮
• TCA_XSTATS — qdisc-specific — module-specific statistics, iykyk
• TCA_RATE — a struct tc_estimator — rate limit, keep it cute, keep it capped 🌸

and ALSO, on top of all that: a whole bunch of other qdisc-module-specific attributes are allowed too. Wanna know what those are? Go read the appropriate include files, bestie, I can't read them for you 🫶

---

🚦 the class ops

RTM_NEWTCLASS, RTM_DELTCLASS, RTM_GETTCLASS — add, remove, or get a traffic class. Same energy, class edition. These messages carry a struct tcmsg exactly like the one I described up above, no cap. 👑

---

🔍 the filter ops

RTM_NEWTFILTER, RTM_DELTFILTER, RTM_GETTFILTER — add, remove, or receive info about a traffic filter. And you already know what's inside: a struct tcmsg, as described above. consistent queen ✨

---

🌈 VERSIONS

rtnetlink is a new feature of Linux 2.2. baby of the family fr fr 👶

---

💀 BUGS

This manual page is incomplete. Not me being honest — the page itself says so. The audacity. 😭

---

🦋 SEE ALSO

• cmsg(3)
• rtnetlink(3)
• ip(7)
• netlink(7)

---

okay that's a wrap on rtnetlink(7), hope u learned something bestie 💖 This lil page came from Linux man-pages 6.20, dated 2026-02-08, and yeah — that's the whole rtnetlink(7) saga, all three parts, finished. go forth and route some packets, main character 🌟