An Overview of netlink sockets

Netlink is used to transfer information between kernel modules and user space processes, it provides kernel/user space bidirectional communication links. It consists of a standard sockets based interface for user processes and an internal kernel API for kernel modules.

A netlink socket in the user space can be created by

 
sock_fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);

The domain is AF_NETLINK, the type of socket is SOCK_RAW, however netlink is a datagram oriented service. Both SOCK_RAW and SOCK_DGRAM are valid values for socket_type but the netlink protocol does not distinguish between datagram and raw sockets.

Netlink_family selects the kernel module or netlink group to communicate with. The currently assigned netlink families are:

• NETLINK_ROUTE : Receives routing updates and may be used to modify the IPv4 routing table, network routes, ip addresses, link parameters, neighbour setups, queueing disciplines, traffic classes and packet classifiers may all be controlled through NETLINK_ROUTE sockets

• NETLINK_FIREWALL : Receives packets sent by the IPv4 firewall code.

• NETLINK_ARPD : For managing the arp table from user space.

• NETLINK_ROUTE6 : Receives and sends IPv6 routing table updates.

• NETLINK_IP6_FW : To receive packets that failed the IPv6 firewall checks (currently not implemented).

• NETLINK_TAPBASE...NETLINK_TAPBASE+15 : Are the instances of the ethertap device. Ethertap is a pseudo network tunnel device that allows an ethernet driver to be simulated from user space.

• NETLINK_SKIP : Reserved for ENskip.