Decode netlink message for veth device creation in Linux

I want to understand the netlink messages exchanged with the kernel when I run the following commmand to create a pair of veth devices (I am using Ubuntu 16.04): $ sudo ip link add veth1 type veth peer name veth2 I tried to follow the tutorial at this [link](https://docs.pyroute2.org/debug.html) . I used strace and got the following trace related to netlink: $ sudo strace -e trace=network -x -s 16384 -f -o out ip link add veth1 type veth peer name veth2 $ cat out socket(PF_NETLINK, SOCK_RAW|SOCK_CLOEXEC, NETLINK_ROUTE) = 3 setsockopt(3, SOL_SOCKET, SO_SNDBUF, , 4) = 0 setsockopt(3, SOL_SOCKET, SO_RCVBUF, , 4) = 0 bind(3, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 0 getsockname(3, {sa_family=AF_NETLINK, pid=6001, groups=00000000}, ) = 0 send(3, "\x20\x00\x00\x00\x10\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 32, 0) = 32 recvmsg(3, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\x34\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x71\x17\x00\x00\xed\xff\xff\xff\x20\x00\x00\x00\x10\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16384}], msg_controllen=0, msg_flags=0}, 0) = 52 socket(PF_LOCAL, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4 sendmsg(3, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\x5c\x00\x00\x00\x10\x00\x05\x06\x38\xa2\x16\x5d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x76\x65\x74\x68\x31\x00\x00\x00\x30\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x24\x00\x02\x00\x20\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x76\x65\x74\x68\x32\x00\x00\x00", 92}], msg_controllen=0, msg_flags=0}, 0) = 92 recvmsg(3, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\x24\x00\x00\x00\x02\x00\x00\x00\x38\xa2\x16\x5d\x71\x17\x00\x00\x00\x00\x00\x00\x5c\x00\x00\x00\x10\x00\x05\x06\x38\xa2\x16\x5d\x00\x00\x00\x00", 32768}], msg_controllen=0, msg_flags=0}, 0) = 36 For example, I try decoding the messages related to sending. // my test did not have any line breaks $ echo'\x20\x00\x00\x00\x10\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00' >> message $ python tests/decoder/decoder.py pyroute2.netlink.rtnl.rtmsg.rtmsg message 20:00:00:00:10:00:05:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 :00:00:00:00:00:00:00:00:00:00 {'attrs': [('RTA_UNSPEC', None)], 'dst_len': 0, 'family': 0, 'flags': 0, 'header': {'flags': 5, 'length': 32, 'pid': 0, 'sequence_number': 0, 'type': 16}, 'proto': 0, 'scope': 0, 'src_len': 0, 'table': 0, 'tos': 0, 'type': 0} ........................................ $ echo '\x5c\x00\x00\x00\x10\x00\x05\x06\x38\xa2\x16\x5d\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x0a\x00\x03\x00\x76\x65\x74\x68\x31\x00\x00\x00\x30\x00 \x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x24\x00\x02\x00\x20\x00 \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x0a\x00\x03\x00\x76\x65\x74\x68\x32\x00\x00\x00' >> message $ python tests/decoder/decoder.py pyroute2.netlink.rtnl.rtmsg.rtmsg message 5c:00:00:00:10:00:05:06:38:a2:16:5d:00:00:00:00:00:00:00:00:00:00: 00:00:00:00:00:00:00:00:00:00:0a:00:03:00:76:65:74:68:31:00:00:00: 30:00:12:00:08:00:01:00:76:65:74:68:24:00:02:00:20:00:01:00:00:00: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:0a:00:03:00:76:65:74:68: 32:00:00:00 {'attrs': [('RTA_UNSPEC', None), ('RTA_IIF', 1752458614), ('RTA_VIA', {'addr': '01:00:76:65:74:68:24:00:02:00:20:00:01:00:00:00:00:00:00:00:00: 00:00:00:00:00:00:00:00:00:0a:00:03:00:76:65:74:68:32:00:00:00', 'family': 8})], 'dst_len': 0, 'family': 0, 'flags': 0, 'header': {'flags': 1541, 'length': 92, 'pid': 0, 'sequence_number': 1561764408, 'type': 16}, 'proto': 0, 'scope': 0, 'src_len': 0, 'table': 0, 'tos': 0, 'type': 0} I was expecting the decoding to indicate something about veth1 or veth2, but the decoding does not seem to correlate with veth devices. I did repeat the decoding in a related [tutorial](https://jvns.ca/blog/2017/09/03/debugging-netlink-requests/) and could get the same result as in the tutorial. I want to ask if the decoding above is correct, and if so, how can it be interpreted ?