IP-MONITOR(8)

✨ IP-MONITOR(8) ✨ 💖 NAME

okay so the manual name here is ip-monitor, also known as rtmon, and it's all about 🦋 state monitoring 🦋. bestie, this is the tool that watches devices, addresses and routes changing in real time 👀

---

💅 SYNOPSIS 💅

ip monitor [ all | OBJECT-LIST ] [ file FILENAME ] [ label ] [ all-nsid
        ] [ dev DEVICE ]

---

🎀 OPTIONS 🎀

• -t, -timestamp — okay this one is giving timestamps 🕰️ It prints a timestamp before the event message, on its own separate line, in this format:

Timestamp: <Day> <Month> <DD> <hh:mm:ss> <YYYY> <usecs> usec
<EVENT>

• -ts, -tshort — the short-and-sweet version ✨ This prints a short timestamp on the same line as the event message, like this:

[<YYYY>-<MM>-<DD>T<hh:mm:ss>.<ms>] <EVENT>

---

🌸 DESCRIPTION 🌸

okay so the ip utility can monitor the state of devices, addresses and routes continuously 🫶 this option is lowkey a different vibe from the rest of the commands. the monitor command has to come first on the command line, and then the object list follows:

ip monitor [ all | OBJECT-LIST ] [ file FILENAME ] [ label ] [ all-nsid
] [ dev DEVICE ]

OBJECT-LIST is the list of object types you want to keep an eye on 👀 it can contain link, address, route, mroute, maddress, acaddress, prefix, neigh, netconf, rule, stats, nsid and nexthop. if you don't give a file argument, ip opens RTNETLINK, listens to it, and dumps state changes in the format we talked about earlier 💜

if the label option is set, a prefix shows up before each message to tell you the family of the message 🏷️ for example:

  [NEIGH]10.16.0.112 dev eth0 lladdr 00:04:23:df:2f:d0 REACHABLE
  [LINK]3: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast state
  DOWN group default
      link/ether 52:54:00:12:34:57 brd ff:ff:ff:ff:ff:ff

if the all-nsid option is set, the program listens to every network namespace that has an nsid assigned into the network namespace where the program is running 🌈 a prefix shows which network namespace the message came from. example:

  [nsid 0]10.16.0.112 dev eth0 lladdr 00:04:23:df:2f:d0 REACHABLE

if the file option is given, the program does not listen on RTNETLINK 🙅‍♀️ instead it opens the given file and dumps its contents. the file should contain RTNETLINK messages saved in binary format 🧚 you can make one with the rtmon utility, which has a command line syntax similar to ip monitor. ideally, rtmon should be started before the first network configuration command is issued. f.e. if you insert:

        rtmon file /var/log/rtmon.log

in a startup script, you'll be able to view the full history later 📜

that said, it's totally possible to start rtmon at any time 🙌 it prepends the history with the state snapshot dumped at the moment it starts.

if the dev option is given, the program only prints events related to that device 🎯

---

🦋 SEE ALSO 🦋

ip(8)

---

👑 AUTHOR 👑

Original Manpage by Michail Litvak <mci@owl.openwall.com> Manpage revised by Nicolas Dichtel <nicolas.dichtel@6wind.com>

---

bestie that's the whole tea ☕💖 iproute2, last updated 13 Dec 2012, IP-MONITOR(8) forever and ever 💅✨