How to find the network namespace of a veth peer ifindex?
17
votes
4
answers
19215
views
# Task
I need to unambiguously and without "holistic" guessing find the **peer** network interface of a veth end in another network namespace.
# Theory ./. Reality
Albeit a lot of documentation and also answers here on SO assume that the ifindex indices of network interfaces are globally unique per host across network namespaces, **this doesn't hold in many cases**:
ifindex/iflink
**are ambiguous**. Even the loopback already shows the contrary, having an ifindex of 1 in any network namespace. Also, depending on the container environment, **ifindex
numbers get reused in different namespaces**. Which makes tracing veth wiring a nightmare, espcially with lots of containers and a host bridge with veth peers all ending in @if3 or so...
# Example: link-netnsid
is 0
Spin up a Docker container instance, just to get a new veth
pair connecting from the host network namespace to the new container network namespace...
$ sudo docker run -it debian /bin/bashNow, in the host network namespace list the network interfaces (I've left out those interfaces that are of no interest to this question):
$ ip link show 1: lo: mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 ... 4: docker0: mtu 1500 qdisc noqueue state UP mode DEFAULT group default link/ether 02:42:34:23:81:f0 brd ff:ff:ff:ff:ff:ff ... 16: vethfc8d91e@if15: mtu 1500 qdisc noqueue master docker0 state UP mode DEFAULT group default link/ether da:4c:f7:50:09:e2 brd ff:ff:ff:ff:ff:ff link-netnsid 0As you can see, while the
iflink
is unambiguous, but the link-netnsid
is 0, despite the peer end sitting in a different network namespace.
For reference, check the netnsid in the unnamed network namespace of the container:
$ sudo lsns -t net NS TYPE NPROCS PID USER COMMAND ... ... 4026532469 net 1 29616 root /bin/bash $ sudo nsenter -t 29616 -n ip link show 1: lo: mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 15: eth0@if16: mtu 1500 qdisc noqueue state UP mode DEFAULT group default link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0So, for both veth ends
ip link show
(and RTNETLINK fwif) tells us they're in the same network namespace with netnsid 0. Which is either wrong or correct under the assumptions that link-netnsids are local as opposed to global. I could not find any documentation that make it explicit what scope link-netnsids are supposed to have.
# /sys/class/net/...
NOT to the Rescue?
I've looked into /sys/class/net/_if_/... but can only find the ifindex and iflink elements; these are well documented. "ip link show" also only seems to show the peer ifindex in form of the (in)famous "@if#" notation. Or did I miss some additional network namespace element?
# Bottom Line/Question
Are there any syscalls that allow retrieving the missing network namespace information for the peer end of a veth pair?
Asked by TheDiveO
(1427 rep)
May 4, 2018, 08:41 PM
Last activity: Apr 11, 2025, 01:39 AM
Last activity: Apr 11, 2025, 01:39 AM