List Generic Netlink Families with genl

Use genl to see which generic netlink families your kernel has registered, without touching a single network setting. You will list families, look one up by name or numeric ID, and watch controller notifications. The examples use genl from iproute2 6.1.0, installed here as package version 6.1.0-1ubuntu6.4.

Allow about ten minutes.

• You need: a shell with iproute2 installed.
• Privileges: everything here is read-only, so you normally need no elevation.
• One thing that keeps running: the monitor example runs until you stop it, on purpose.

1. Confirm the installed command

Check the binary and its version before you trust any output in a script:

$ command -v genl
/usr/sbin/genl
$ genl -V
genl utility, iproute2-6.1.0

The version matters because the man page has fallen behind. The installed ctrl help output advertises a policy command, but the local 2015 man page documents only the older operations. Treat the installed help and the output you observe as the contract for this machine, and check again after an iproute2 upgrade.

2. Read the controller help

Ask the ctrl object what it supports:

$ genl ctrl help
Usage: ctrl <CMD>
CMD   := get <PARMS> | list | monitor | policy <PARMS>
PARMS := name <name> | id <id>

The useful read-only operations on this installation are:

• list: every registered family.
• get: one family, by name or ID.
• monitor: a live feed of controller notifications.

The help also lists policy, but the supplied man page describes neither its output nor its arguments beyond the syntax above.

3. List registered families

Run the list operation:

$ genl ctrl list

The output is one block per registered user of the generic netlink controller. A typical block begins like this on the guide machine:

Name: nlctrl
        ID: 0x10  Version: 0x2  header size: 0  max attribs: 0
        commands supported:
                #1:  ID-0x3
                #2:  ID-0xa

        multicast groups:
                #1:  ID-0x10  name: notify

Further blocks include families such as ethtool, devlink and nl80211, depending on the kernel and loaded drivers. The list is not a fixed inventory: a different kernel, hardware set or module set can add or remove families.

Read the fields as discovery data:

• ID: the numeric address netlink uses for the family.
• Version: the version the family reports.
• Commands and multicast groups: the interfaces the family exposes.

None of that tells you a command is safe for an unprivileged caller. The installed output marks some commands as needing administrator permission.

$ genl ctrl list > /tmp/genl-families.txt
$ grep -A3 '^Name: ' /tmp/genl-families.txt

4. Query one family by name

Once the list gives you an exact name, query that family directly. nlctrl is available on this machine and makes a handy controller-level test:

$ genl ctrl get name nlctrl
Name: nlctrl
        ID: 0x10  Version: 0x2  header size: 0  max attribs: 0
        commands supported:
                #1:  ID-0x3
                #2:  ID-0xa
        multicast groups:
                #1:  ID-0x10  name: notify

Copy the name from your own list rather than guessing it from a package name. A missing or misspelled family gives you an error instead of a useful block.

This is still pure observation. It does not enable the family, load a kernel module, alter a network device or subscribe your shell to notifications.

5. Query the same family by ID

The list displays IDs in hexadecimal, and the installed command accepts that value in the id form:

$ genl ctrl get id 0x10
Name: nlctrl
        ID: 0x10  Version: 0x2  header size: 0  max attribs: 0
        commands supported:
                #1:  ID-0x3
                #2:  ID-0xa

Numeric family IDs can differ between boots and between hosts, so an ID is only good for the current kernel view. If a script needs a stable selection, resolve an exact family name, then verify the returned Name and Version.

6. Watch notifications

Start a monitor when you need to see controller notifications:

$ genl ctrl monitor

It is a foreground listener, not a one-shot query. It waits for events and may print nothing until a relevant notification arrives. Stop it with Ctrl-C when your observation window is over. There is no persistent configuration to undo.

For a bounded capture, let the shell stop it after a chosen interval:

$ timeout 30s genl ctrl monitor
$ printf 'monitor status: %s\n' "$?"

Read the status like this:

• 124: GNU timeout stopped the monitor after 30 seconds. That is expected for a quiet window, not evidence that genl found an error.
• 0: the monitor ended normally, usually because it received a termination signal or the session closed.

7. Choose output options

The global options -s, -d and -r request statistics, details or raw output. They change presentation, not the family being queried:

$ genl -d ctrl get name nlctrl
$ genl -r ctrl get name nlctrl

Raw output suits another tool consuming the result, but it is a poor fit for a human checklist. Do not parse decorative spacing, and do not assume command numbers map to the same operations across family versions. The family-specific interface remains the authority on what a command means.

Common traps

• Confusing generic netlink with IP configuration. genl inspects generic netlink controller data. It does not replace the ip commands that configure links, addresses or routes.
• Assuming the list is stable. Driver loading and kernel changes alter the registered families. Compare snapshots only when you also record the host and kernel context.
• Leaving a monitor running. It is long-lived by design. Use Ctrl-C or timeout, especially in a terminal shared with another diagnostic task.
• Trusting an old man page blindly. This binary exposes policy in its help even though the local synopsis is narrower. Check genl ctrl help on the target host.