IP-MONITOR(8) Linux IP-MONITOR(8)

# [NAME](#NAME)

ip-monitor, rtmon - state monitoring

# [SYNOPSIS](#SYNOPSIS)

**ip monitor** \[ **all** | *OBJECT-LIST* ] \[ **file FILENAME** ] \[ **label** ] \[ **all-nsid** ] \[ **dev DEVICE** ]

# [OPTIONS](#OPTIONS)

[**-t**, **-timestamp**](#t)

Prints timestamp before the event message on the separated line in format:  
Timestamp: <Day> <Month> <DD> <hh:mm:ss> <YYYY> <usecs> usec  
<EVENT>

[**-ts**, **-tshort**](#ts)

Prints short timestamp before the event message on the same line in format:  
\[<YYYY>-<MM>-<DD>T<hh:mm:ss>.<ms>] <EVENT>

# [DESCRIPTION](#DESCRIPTION)

The **ip** utility can monitor the state of devices, addresses and routes continuously. This option has a slightly different format. Namely, the **monitor** command is the first in the command line and then the object list follows:

**ip monitor** \[ **all** | *OBJECT-LIST* ] \[ **file FILENAME** ] \[ **label** ] \[ **all-nsid** ] \[ **dev DEVICE** ]

*OBJECT-LIST* is the list of object types that we want to monitor. It may contain **link**, **address**, **route**, **mroute**, **maddress**, **acaddress**, **prefix**, **neigh**, **netconf**, **rule**, **stats**, **nsid** and **nexthop**. If no **file** argument is given, **ip** opens RTNETLINK, listens on it and dumps state changes in the format described in previous sections.

If the **label** option is set, a prefix is displayed before each message to show the family of the message. For example:

\[NEIGH]10.16.0.112 dev eth0 lladdr 00:04:23:df:2f:d0 REACHABLE \[LINK]3: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo\_fast state DOWN group default  
link/ether 52:54:00:12:34:57 brd ff:ff:ff:ff:ff:ff

If the **all-nsid** option is set, the program listens to all network namespaces that have a nsid assigned into the network namespace were the program is running. A prefix is displayed to show the network namespace where the message originates. Example:

\[nsid 0]10.16.0.112 dev eth0 lladdr 00:04:23:df:2f:d0 REACHABLE

If the **file** option is given, the program does not listen on RTNETLINK, but opens the given file, and dumps its contents. The file should contain RTNETLINK messages saved in binary format. Such a file can be generated with the **rtmon** utility. This utility has a command line syntax similar to **ip monitor**. Ideally, **rtmon** should be started before the first network configuration command is issued. F.e. if you insert:

rtmon file /var/log/rtmon.log

in a startup script, you will be able to view the full history later.

Nevertheless, it is possible to start **rtmon** at any time. It prepends the history with the state snapshot dumped at the moment of starting.

If the **dev** option is given, the program prints only events related to this device.

# [SEE ALSO](#SEE_ALSO)

[**ip**(8)](/man/os/iproute2/ip.8)

# [AUTHOR](#AUTHOR)

Original Manpage by Michail Litvak <mci@owl.openwall.com>  
Manpage revised by Nicolas Dichtel <nicolas.dichtel@6wind.com>

13 Dec 2012 iproute2

---

Document: ip-monitor(8) from iproute2 7.3.0-r0 (Chainguard OS)
Source: https://kernel.googlesource.com/pub/scm/network/iproute2/iproute2