Sample Header Ad - 728x90

How to find the network namespace of a veth peer ifindex?

17 votes
4 answers
19215 views
# Task I need to unambiguously and without "holistic" guessing find the **peer** network interface of a veth end in another network namespace. # Theory ./. Reality Albeit a lot of documentation and also answers here on SO assume that the ifindex indices of network interfaces are globally unique per host across network namespaces, **this doesn't hold in many cases**: ifindex/iflink **are ambiguous**. Even the loopback already shows the contrary, having an ifindex of 1 in any network namespace. Also, depending on the container environment, **ifindex numbers get reused in different namespaces**. Which makes tracing veth wiring a nightmare, espcially with lots of containers and a host bridge with veth peers all ending in @if3 or so... # Example: link-netnsid is 0 Spin up a Docker container instance, just to get a new veth pair connecting from the host network namespace to the new container network namespace...
$ sudo docker run -it debian /bin/bash
Now, in the host network namespace list the network interfaces (I've left out those interfaces that are of no interest to this question):
$ ip link show
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
...
4: docker0:  mtu 1500 qdisc noqueue state UP mode DEFAULT group default 
    link/ether 02:42:34:23:81:f0 brd ff:ff:ff:ff:ff:ff
...
16: vethfc8d91e@if15:  mtu 1500 qdisc noqueue master docker0 state UP mode DEFAULT group default 
    link/ether da:4c:f7:50:09:e2 brd ff:ff:ff:ff:ff:ff link-netnsid 0
As you can see, while the iflink is unambiguous, but the link-netnsid is 0, despite the peer end sitting in a different network namespace. For reference, check the netnsid in the unnamed network namespace of the container:
$ sudo lsns -t net
        NS TYPE NPROCS   PID USER  COMMAND
...
...
4026532469 net       1 29616 root  /bin/bash

$ sudo nsenter -t 29616 -n ip link show
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
15: eth0@if16:  mtu 1500 qdisc noqueue state UP mode DEFAULT group default 
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0
So, for both veth ends ip link show (and RTNETLINK fwif) tells us they're in the same network namespace with netnsid 0. Which is either wrong or correct under the assumptions that link-netnsids are local as opposed to global. I could not find any documentation that make it explicit what scope link-netnsids are supposed to have. # /sys/class/net/... NOT to the Rescue? I've looked into /sys/class/net/_if_/... but can only find the ifindex and iflink elements; these are well documented. "ip link show" also only seems to show the peer ifindex in form of the (in)famous "@if#" notation. Or did I miss some additional network namespace element? # Bottom Line/Question Are there any syscalls that allow retrieving the missing network namespace information for the peer end of a veth pair?
Asked by TheDiveO (1427 rep)
May 4, 2018, 08:41 PM
Last activity: Apr 11, 2025, 01:39 AM