netlink-watch

# Description

netlink-watch (cpp-netlink-watch) is a Linux kernel netlink socket monitor written in C++23 with zero external dependencies. It reads /proc/net/netlink (10 columns per row) and shows every netlink socket: protocol family with symbolic name (23 families from linux/netlink.h: ROUTE, AUDIT, KOBJECT_UEVENT, GENERIC/genetlink, NETFILTER, INET_DIAG, RDMA, CRYPTO, SMC, DEVLINK, DATAPATH...), owning port id / PID (0 = kernel/unbound, shown as -kernel-; port ids can exceed 2^31-1 since they are not real pids, printed in full), multicast group mask in hex with popcount (--groups filters subscribers), RX/WMEM memory, in-progress dump flag, locks and dropped messages (drops, typically ENOBUFS) highlighted in red with the --drops filter. Port-id -> process resolution via /proc/<pid>/comm only for real pid ranges, tolerant to dead processes. Watch mode (--watch N) with deltas of new/closed sockets between snapshots. JSON output (--json) with summary + sockets array validated with python -m json.tool. --demo with 33 sockets from a synthetic udev + audit + route + apps host and --file for dumps with # comments (sample-netlink.table included). Filters --proto N, --groups, --drops, --pid N and --top N. Selftest 56 checks: parser, 23 families, group popcount, drops, filters, demo, JSON and real /proc reads. Zero deps: g++ -std=c++23 -O2 -Wall -Wextra.

$ ./deploy.sh $ git clone

# Key features

$ Reads /proc/net/netlink: 23 symbolic netlink families (ROUTE, AUDIT, KOBJECT_UEVENT, GENERIC, ...)

$ Multicast groups: hex mask + popcount (--groups filters subscribers)

$ Dropped messages (ENOBUFS) highlighted in red with --drops filter

$ Owning port id / PID, 0 = kernel/unbound; port ids above 2^31-1 supported

$ Port id -> process resolution via /proc/<pid>/comm, tolerant to dead processes

$ Watch mode (--watch N) with new/closed socket deltas between snapshots

$ Validatable JSON output with summary + sockets array; --demo with 33 synthetic sockets

$ --file parses dumps with # comments (sample-netlink.table); --no-color with mutable ANSI palette

# Gallery

Project terminal

Mobile view

# Technologies used

C++23