How to Capture and Debug Kernel Netlink Traffic in Linux Using nlmon Interfaces

In modern Linux networking, communication between the kernel network subsystem and user-space daemons—such as NetworkManager, systemd-networkd, dynamic routing protocols (BGP/OSPF via FRRouting or BIRD), and firewall frameworks—occurs primarily via Netlink sockets. When an interface changes state, an IP address is assigned, or a route table updates, the kernel emits Netlink messages (specifically rtnetlink). Unlike standard network packets traversing Ethernet or Wi-Fi interfaces, Netlink communication is internal inter-process communication (IPC) and is invisible to standard network capture commands listening on physical devices. To capture, inspect, and debug raw kernel Netlink messages, Linux provides the specialized nlmon (Netlink Monitor) virtual interface.

Understanding Netlink Sockets and the nlmon Virtual Device

Netlink is a socket-based protocol (AF_NETLINK) designed as an asynchronous, bidirectionally capable replacement for traditional ioctl system calls. Netlink carries diverse subsystem traffic across defined families:

• NETLINK_ROUTE (rtnetlink): Routing tables, IP addresses, link parameters, neighbor tables, and queuing disciplines.
• NETLINK_GENERIC (genl): Extended subsystem commands, including Wi-Fi (nl80211) and hardware telemetry (devlink).
• NETLINK_NETFILTER: Stateful packet inspection and connection tracking state tables.
• NETLINK_AUDIT: Kernel security auditing and SELinux/AppArmor audit event records.

The nlmon virtual driver acts as a passive tap into the kernel Netlink bus. Once created, standard packet capture utilities like tcpdump and Wireshark can bind directly to the nlmon interface, capturing every Netlink request, notification, and error response emitted across the operating system.

Creating and Activating an nlmon Interface

The nlmon driver is a built-in virtual link type managed via iproute2. To create a Netlink monitor device:

sudo ip link add name nlmon0 type nlmon

Once created, bring the virtual monitor interface online:

sudo ip link set dev nlmon0 up

To verify that the interface is active in the kernel link registry:

ip link show dev nlmon0

The device reports its operational state:

4: nlmon0: <NOARP,UP,LOWER_UP> mtu 3776 qdisc noqueue state UNKNOWN mode DEFAULT group default
    link/netlink

Notice the link type: link/netlink. This confirms that the interface processes raw Netlink framing headers rather than conventional 802.3 Ethernet frames.

Capturing Live Netlink Traffic with tcpdump

With nlmon0 active, you can bind tcpdump to capture live routing, link, and configuration events as they traverse between daemons and the kernel.

To view real-time Netlink messages in your terminal:

sudo tcpdump -i nlmon0 -n -vvv

While monitoring this stream in one terminal window, execute a network configuration change in another window (for example, adding a secondary IP address or assigning a route):

sudo ip addr add 192.168.50.10/24 dev eth0

The tcpdump capture immediately records the exact Netlink packet exchange:

10:48:12.124501 Netlink 0x00000000, length 48:
  RTM_NEWADDR, Flags [Request, Acknowledge, Create], seq 1730977200, pid 14820
  Family: AF_INET, Prefix Length: 24, Flags: [Permanent]
  Attributes:
    IFA_ADDRESS: 192.168.50.10
    IFA_LOCAL: 192.168.50.10
    IFA_LABEL: eth0

The capture reveals:

• RTM_NEWADDR: The rtnetlink command type.
• pid: The process ID of the user-space process that submitted the request (e.g., the ip command or NetworkManager daemon).
• Attributes: The exact Netlink Type-Length-Value (TLV) attributes passed to the kernel.

Exporting PCAP Files for In-Depth Wireshark Analysis

For complex network debugging—such as troubleshooting why a container orchestration CNI plugin (e.g., Calico or Cilium) fails to configure routing or drops routes during pod creation—capturing Netlink traffic to a PCAP file enables visual inspection in Wireshark:

sudo tcpdump -i nlmon0 -w /tmp/netlink-debug.pcap

Open the resulting .pcap file in Wireshark on Linux or macOS. Wireshark includes a native dissector for Linux Netlink protocols, parsing:

• Routing commands (RTM_NEWROUTE, RTM_DELROUTE) and metric tables.
• Link status state machines (RTM_NEWLINK, RTM_DELLINK) detailing interface flags, MTU negotiations, and carrier changes.
• Neighbor table discovery packets (RTM_NEWNEIGH) tracking ARP and IPv6 neighbor solicitations.

Deactivating and Removing the nlmon Interface

When diagnostic packet capture is complete, remove the monitor device to conserve kernel resources:

sudo ip link set dev nlmon0 down
sudo ip link delete dev nlmon0

The kernel cleanly unloads the tap from the Netlink bus without interrupting active network routing or interface traffic.