In this lesson, you will learn how to leverage low-level kernel data structures to dynamically generate a visual map of your network architecture, moving beyond static diagrams.
Understanding Topology via Kernel State
While standard utilities like ip route or netstat provide snapshots of your connectivity, they don't capture the fluid, complex relationships existing within the kernel's networking stack—especially when dealing with virtual bridges, namespaces, and eBPF-redirected flows. To visualize topology at an expert level, we must query the kernel's neighbor tables and interface adjacency graphs directly.
By tapping into the kernel's netlink interface or utilizing eBPF kprobes, we can trace how packets traverse virtual devices (like veth pairs) and identify hidden dependencies, such as which process is bound to a specific socket behind a virtual switch.
Mapping Connectivity with bpftool and Graphing
You can extract connectivity data by inspecting the bpf_link objects and the net_device hierarchy. For instance, you can use bpftool net show to identify active XDP programs or TC (Traffic Control) hooks attached to interfaces. This data effectively acts as the "edges" in your topology graph.
Here is a simplified conceptual approach to identifying interface relationships using ip commands derived from kernel netlink data:
# Display the physical-to-virtual interface mapping
ip -d link show | grep -E "link-netnsid|master"
By parsing the output of these kernel-managed relationships, you can construct a JSON representation of your network:
- Nodes: Physical NICs, virtual bridges (
br0), containers, and namespaces. - Edges: The
masterdevice links, virtual cable (veth) endpoints, and eBPF-defined redirection paths.
By feeding this state data into a graph visualization tool like Graphviz (dot), you transform raw kernel netlink dumps into an actionable topological map. This allows you to see if a packet destined for a service is actually traversing a loopback bridge you hadn't accounted for, or if a specific namespace is experiencing "ghost" traffic due to an incorrectly configured policy.
Key Takeaway: Network topology visualization in the Linux kernel is achieved by programmatically extracting device adjacency data and flow redirection hooks, then mapping these relationships to reveal the true, runtime structure of your networking stack.