IP-MONITOR(8)             (13 Dec 2012)             IP-MONITOR(8)

     NAME
          ip-monitor, rtmon - state monitoring

     SYNOPSIS
          ip monitor [ all | OBJECT-LIST ] [ file FILENAME ] [ label ]
                  [ all-nsid ] [ dev DEVICE ]

     OPTIONS
          -t, -timestamp
               Prints timestamp before the event message on the sepa-
               rated line in format:
                   Timestamp: <Day> <Month> <DD> <hh:mm:ss> <YYYY>
               <usecs> usec
                   <EVENT>

          -ts, -tshort
               Prints short timestamp before the event message on the
               same line in format:
                   [<YYYY>-<MM>-<DD>T<hh:mm:ss>.<ms>] <EVENT>

     DESCRIPTION
          The ip utility can monitor the state of devices, addresses
          and routes continuously. This option has a slightly differ-
          ent format.  Namely, the monitor command is the first in the
          command line and then the object list follows:

          ip monitor [ all | OBJECT-LIST ] [ file FILENAME ] [ label ]
          [ all-nsid ] [ dev DEVICE ]

          OBJECT-LIST is the list of object types that we want to mon-
          itor.  It may contain link, address, route, neigh, netconf,
          rule, If no file argument is given, ip opens RTNETLINK, lis-
          tens on it and dumps state changes in the format described
          in previous sections.

          If the label option is set, a prefix is displayed before
          each message to show the family of the message. For example:

            [NEIGH]10.16.0.112 dev eth0 lladdr 00:04:23:df:2f:d0
            REACHABLE [LINK]3: eth1: <BROADCAST,MULTICAST> mtu 1500
            qdisc pfifo_fast state DOWN group default
                link/ether 52:54:00:12:34:57 brd ff:ff:ff:ff:ff:ff

     Page 1                      iproute2            (printed 5/25/22)

     IP-MONITOR(8)             (13 Dec 2012)             IP-MONITOR(8)

          If the all-nsid option is set, the program listens to all
          network namespaces that have a nsid assigned into the net-
          work namespace were the program is running.  A prefix is
          displayed to show the network namespace where the message
          originates. Example:

            [nsid 0]10.16.0.112 dev eth0 lladdr 00:04:23:df:2f:d0
            REACHABLE

          If the file option is given, the program does not listen on
          RTNETLINK, but opens the given file, and dumps its contents.
          The file should contain RTNETLINK messages saved in binary
          format.  Such a file can be generated with the rtmon util-
          ity. This utility has a command line syntax similar to ip
          monitor.  Ideally, rtmon should be started before the first
          network configuration command is issued. F.e. if you insert:

                  rtmon file /var/log/rtmon.log

          in a startup script, you will be able to view the full his-
          tory later.

          Nevertheless, it is possible to start rtmon at any time.  It
          prepends the history with the state snapshot dumped at the
          moment of starting.

          If the dev option is given, the program prints only events
          related to this device.

     SEE ALSO
          ip(8)

     AUTHOR
          Original Manpage by Michail Litvak <mci@owl.openwall.com>
          Manpage revised by Nicolas Dichtel
          <nicolas.dichtel@6wind.com>

     Page 2                      iproute2            (printed 5/25/22)