Subject: Re: [RFC PATCH net-next 3/3] packet: nlmon: virtual netlink monitoring device for packet sockets

From: Daniel Borkmann <[email-masked]>
Date: Thu, 20 Jun 2013 10:07:10 +0200

On 06/19/2013 08:59 PM, Stephen Hemminger wrote:
> On Wed, 19 Jun 2013 20:04:46 +0200
> Daniel Borkmann <[email-masked]> wrote:
>
>> Currently, there is no good possibility to debug netlink traffic that
>> is being exchanged between kernel and user space. Therefore, this patch
>> implements a netlink virtual device, so that netlink messages will be
>> made visible to PF_PACKET sockets. Once there was an approach with a
>> similar idea [1], but it got forgotten somehow.
>
> ip monitor all

Well, but this is only restricted to debugging rtnl and there are many other
subsystems using netlink. Also, it's not about low-level debugging netlink
in general from what I see from the code. So it's not really the same resp.
comparable to each other.