Paul Evans


Socket::Netlink - interface to Linux's PF_NETLINK socket family


 use Socket;
 use Socket::Netlink qw( :DEFAULT pack_nlmsghdr unpack_nlmsghdr );

 socket( my $sock, PF_NETLINK, SOCK_RAW, 0 ) or die "socket: $!";

 send( $sock, pack_nlmsghdr( 18, NLM_F_REQUEST|NLM_F_DUMP, 0, 0,
      "\0\0\0\0\0\0\0\0" ), 0 )
    or die "send: $!";

 recv( $sock, my $buffer, 65536, 0 ) or die "recv: $!";

 printf "Received type=%d flags=%x:\n%v02x\n",
    ( unpack_nlmsghdr( $buffer ) )[ 0, 1, 4 ];


This module contains the low-level constants and structure handling functions required to use Linux's PF_NETLINK socket family. It is suggested to use the high-level object interface to this instead; see IO::Socket::Netlink.


The following constants are exported

The packet family (for socket() calls)

The address family


The following pair of functions operate on AF_NETLINK address structures. The meainings of the parameters are:


The unique endpoint number for this netlink socket. If given as 0 to the bind() syscall, the kernel will allocate an endpoint number of the process's PID.


A 32-bit bitmask of the multicast groups to join.

$addr = pack_sockaddr_nl( $pid, $groups )

Returns a sockaddr_nl structure with the fields packed into it.

( $pid, $groups ) = unpack_sockaddr_nl( $addr )

Takes a sockaddr_nl structure and returns the unpacked fields from it.


The following function pairs operate on structure types used by netlink

$buffer = pack_nlmsghdr( $type, $flags, $seq, $pid, $body )

( $type, $flags, $seq, $pid, $body, $morebuffer ) = unpack_nlmsghdr( $buffer )

Pack or unpack a struct nlmsghdr and its payload body.

Because a single netlink message can contain more than payload body, the unpack_nlmsghdr function will return the remaining buffer after unpacking the first message, in case there are others. If there are no more, the $morebuffer list element will not be returned.

 while( defined $buffer ) {
    ( my ( $type, $flags, $seq, $pid, $body ), $buffer ) = unpack_nlmsghdr( $buffer );

There is no similar functionallity for pack_nlmsghdr; simply concatenate multiple results together to send more than one message.

$buffer = pack_nlmsgerr( $error, $msg )

( $error, $msg ) = unpack_nlmsgerr( $buffer )

Pack or unpack a struct nlmsgerr. The kernel expects or reports negative integers in its structures; these functions take or return normal positive error values suitable for use with $!.

$buffer = pack_nlattrs( %attrs )

%attrs = unpack_nlattrs( $buffer )

Pack or unpack a list of netlink attributes.

These functions take or return even-sized lists of $type, $value pairs. The type will be the number in the netlink attribute message, and the value will be a plain packed string buffer. It is the caller's responsibilty to further pack/unpack this buffer as appropriate for the specific type.

Because these functions take/return even-sized lists, they may be passed or returned into hashes.


  • netlink(7) - netlink - Communication between kernel and userspace (AF_NETLINK)

  • IO::Socket::Netlink - Object interface to AF_NETLINK domain sockets


Paul Evans <>