In this lesson, you will learn how to bridge the gap between low-level kernel network events and user-space automation using udev and netlink.
When a physical network cable is unplugged or a virtual interface is toggled, the Linux kernel updates the link state. While you could poll ip link in a loop, that is inefficient and resource-heavy. Instead, the kernel broadcasts changes via netlink sockets, which udev intercepts to trigger automated system responses.
Leveraging Udev for Link Events
udev isn’t just for hardware devices; it monitors the kernel’s uevent stream. When an interface state changes, the kernel sends an event that udev can match. You can write rules in /etc/udev/rules.d/ to execute scripts the moment a link goes "up" or "down."
For example, to restart a specific service or update firewall rules when eth0 transitions, you could create a rule like this:
SUBSYSTEM=="net", ACTION=="change", KERNEL=="eth0", ENV{IF_OPERSTATE}=="up", RUN+="/usr/local/bin/link-up-script.sh"
Understanding Netlink
While udev is excellent for high-level management, netlink is the raw communication protocol between the kernel’s network stack and user-space. When an interface changes state, the kernel sends an RTM_NEWLINK message to any process listening on a NETLINK_ROUTE socket.
Advanced network daemons (like systemd-networkd or NetworkManager) bind to these sockets. They receive the link state notification in real-time, allowing them to re-run DHCP client requests, reconfigure routing tables, or trigger failover logic for bonding interfaces immediately, without waiting for a polling timer to expire.
By utilizing these event-driven architectures, you shift from "checking the status" to "reacting to the transition." This ensures that your system remains responsive to hardware failures or configuration changes, maintaining the integrity of your network stack architecture without placing unnecessary load on the CPU.
Key Takeaway: Rather than polling, use udev rules or netlink-aware listeners to trigger immediate, event-driven responses to interface state transitions.