How do I find all interfaces that have been configured in Linux, including those of containers?

Question

I know that you can display interfaces by doing ip a show. That only displays the interfaces that the host can see, but virtual interfaces configured by containers don't appear in this list. I've tried using ip netns as well, and they don't show up either. Should I recompile another version of iproute2? In /proc/net/fb_trie, you can see the local/broadcast addresses for, I assume, as a use for the forwarding database.

Where can I find any of this information, or command to list all interfaces including containers?

To test this out, start up a container. In my case, it is a lxc container on snap. Do an ip a or ip l. It will show the host machine's view, but not the container configured interface. I'm grepping through procfs, since containers are just cgrouped processes, but I don't get anything other than the fib_trie and the arp entry. I thought it could be due to a netns namespace obfuscation, but ip netns also shows nothing.

You can use conntrack -L to display all incoming and outgoing connections that are established, because lxd needs to connection track the forwarding of the packets, but I'd like to list all ip addresses that are configured on the system, like how I'd be able to tell using netstat or lsof.

Answer 1

An interface, at a given time, belongs to one network namespace and only one. The init (initial) network namespace, except for inheriting physical interfaces of destroyed network namespaces has no special ability over other network namespaces: it can't see directly their interfaces. As long as you are still in init's pid and mount namespaces, you can still find the network namespaces by using different informations available from /proc and finally display their interfaces by entering those network namespaces.

I'll provide examples in shell.

• enumerate the network namespaces

  For this you have to know how those namespaces are existing: as long as a resource keep them up. A resource here can be a process (actually a process' thread), a mount point or an open file descriptor (fd). Those resources are all referenced in /proc/ and point to an abstract pseudo-file in the nsfs pseudo-filesystem enumerating all namespaces. This file's only meaningful information is its inode, representing the network namespace, but the inode can't be manipulated alone, it has to be the file. That's why later we can't just keep only the inode value (given by stat -c %i /proc/some/file): we'll keep the inode to be able to remove duplicates and a filename to still have an usable reference for nsenter later.

  • process (actually thread)

    The most common case: for usual containers. Each thread's network namespace can be known via the reference /proc/pid/ns/net: just stat them and enumerate all unique namespaces. The 2>/dev/null is to hide when stat can't find ephemeral processes anymore.

    find /proc/ -mindepth 1 -maxdepth 1 -name '[1-9]*' | while read -r procpid; do
            stat -L -c '%20i %n' $procpid/ns/net
    done 2>/dev/null
    

    This can be done faster with the specialized lsns command which deals with namespaces, but appears to handle only processes (not mount points nor open fd as seen later):

    lsns -n -u -t net -o NS,PATH
    

    (which would have to be reformatted for later as lsns -n -u -t net -o NS,PATH | while read inode path; do printf '%20u %s\n' $inode "$path"; done)

  • mount point

    Those are mostly used by the ip netns add command which creates permanent network namespaces by mounting them, thus avoiding them disappearing when there is no process nor fd resource keeping them up, then also allowing for example to run a router, firewall or bridge in a network namespace without any linked process.

    Mounted namespaces (handling of mount and perhaps pid namespaces is probably more complex but we're only interested in network namespaces anyway) appear like any other mount point in /proc/mounts, with the filesystem type nsfs. There's no easy way in shell to distinguish a network namespace from an other type of namespace, but since two pseudo-files from the same filesystem (here nsfs) won't share the same inode, just elect them all and ignore errors later in the interface step when trying to use a non-network namespace reference as network namespace. Sorry, below I won't handle correctly mount points with special characters in them, including spaces, because they are already escaped in /proc/mounts's output (it would be easier in any other language), so I won't bother either to use null terminated lines.

    awk '$3 == "nsfs" { print $2 }' /proc/mounts | while read -r mount; do
            stat -c '%20i %n' "$mount"
    done
    

  • open file descriptor

    Those are probably even more rare than mount points except temporarily at namespace creation, but might be held and used by some specialized application handling multiple namespaces, including possibly some containerization technology.

    I couldn't devise a better method than search all fd available in every /proc/pid/fd/, using stat to verify it points to a nsfs namespace and again not caring for now if it's really a network namespace. I'm sure there's a more optimized loop, but this one at least won't wander everywhere nor assume any maximum process limit.

    find /proc/ -mindepth 1 -maxdepth 1 -name '[1-9]*' | while read -r procpid; do
            find $procpid/fd -mindepth 1 | while read -r procfd; do
                    if [ "$(stat -f -c %T $procfd)" = nsfs ]; then
                            stat -L -c '%20i %n' $procfd 
                    fi
            done
    done 2>/dev/null
    

  Now remove all duplicate network namespace references from previous results. Eg by using this filter on the combined output of the 3 previous results (especially from the open file descriptor part):

  sort -k 1n | uniq -w 20
  

• in each namespace enumerate the interfaces

  Now we have the references to all the existing network namespaces (and also some non-network namespaces which we'll just ignore), simply enter each of them using the reference and display the interfaces.

  Take the previous commands' output as input to this loop to enumerate interfaces (and as per OP's question, choose to display their addresses), while ignoring errors caused by non-network namespaces as previously explained:

  while read -r inode reference; do
      if nsenter --net="$reference" ip -br address show 2>/dev/null; then
              printf 'end of network %d\n\n' $inode
      fi
  done
  

The init network's inode can be printed with pid 1 as reference:

echo -n 'INIT NETWORK: ' ; stat -L -c %i /proc/1/ns/net

Example (real but redacted) output with a running LXC container,an empty "mounted" network namepace created with ip netns add ... having an unconnected bridge interface, a network namespace with an other dummy0 interface, kept alive by a process not in this network namespace but keeping an open fd on it, created with:

unshare --net sh -c 'ip link add dummy0 type dummy; ip address add dev dummy0 10.11.12.13/24; sleep 3' & sleep 1; sleep 999 < /proc/$!/ns/net &

and a running Firefox which isolates each of its "Web Content" threads in an unconnected network namespace (all those down lo interfaces):

lo               UNKNOWN        127.0.0.1/8 ::1/128 
eth0             UP             192.0.2.2/24 2001:db8:0:1:bc5c:95c7:4ea6:f94f/64 fe80::b4f0:7aff:fe76:76a8/64 
wlan0            DOWN           
dummy0           UNKNOWN        198.51.100.2/24 fe80::108a:83ff:fe05:e0da/64 
lxcbr0           UP             10.0.3.1/24 2001:db8:0:4::1/64 fe80::216:3eff:fe00:0/64 
virbr0           DOWN           192.168.122.1/24 
virbr0-nic       DOWN           
vethSOEPSH@if9   UP             fe80::fc8e:ff:fe85:476f/64 
end of network 4026531992

lo               DOWN           
end of network 4026532418

lo               DOWN           
end of network 4026532518

lo               DOWN           
end of network 4026532618

lo               DOWN           
end of network 4026532718

lo               UNKNOWN        127.0.0.1/8 ::1/128 
eth0@if10        UP             10.0.3.66/24 fe80::216:3eff:fe6a:c1e9/64 
end of network 4026532822

lo               DOWN           
bridge0          UNKNOWN        fe80::b884:44ff:feaf:dca3/64 
end of network 4026532923

lo               DOWN           
dummy0           DOWN           10.11.12.13/24 
end of network 4026533021

INIT NETWORK: 4026531992

Answer 2

ip netns list will only list the networks namespaces which were configured via the ip-netns(8) utility.

The lsns(1) program from the util-linux package is also highly deficient: it will list only those namespaces which are accessible via the /proc/<pid>/ns/* files, omitting all the per-thread namespaces and those kept alive by a bind mount or an open file descriptor.

The following demo script tries to do better: it will look for bind mounts through the /proc/<pid>/task/<tid>/mountinfo files, and for open fds through /proc/<pid>/task/<tid>/fd files.

For each namespace, it will print a path through which it is accessible:

# perl ./lsnsx.pl
...
mnt      3
   4026531840  /proc/1/ns/mnt
   4026531860  /proc/30/ns/mnt
   4026532374  /proc/3119/ns/mnt
net      6
   4026531992  /proc/1/ns/net
   4026532376  /proc/25781/fd/9
   4026532465  /proc/28373/fd/7
...

You can then use that path with nsenter(1), eg.

nsenter --net=/proc/28373/fd/7 ip link

The script could be easily changed to do that itself, or show other info, like the whole list of processes which use a namespace.

If the path is not accessible, it will follow it by the parent/mount ids and the /proc/<pid>/mountinfo file where it was found. Escaped newlines, tabs and spaces will be left as they are:

net      9
   ...
   4026532732  /v/net\040ns   /proc/3119/mountinfo 60 41

Since it has to read all those /proc/*/task/* files, this may get slow on any machine where heavily threaded programs are used; unfortunately I wasn't able to find any quick way to check if two threads/tasks share the same namespace(s): kcmp(2) will only tell if they're sharing the same address space, file descriptor table, etc; not anything namespace-related.

lsnsx.pl:

#! /usr/bin/perl
use strict;
my %t2n = (
    # the CLONE_NEW* from sched.h
    0x02000000 => "cgroup", 0x04000000 => "uts", 0x08000000 => "ipc",
    0x10000000 => "user", 0x20000000 => "pid", 0x40000000 => "net",
    0x00020000 => "mnt" # CLONE_NEWNS
);
my (%ns);
my $nsfs_dev = (stat "/proc/self/ns/mnt")[0];
my $type = shift || qr/\w+/;
sub unescape { $_[0] =~ s/\\([0-7]{3})/chr oct $1/ger }
# NS_GET_NSTYPE = 0xb7 << 8 | 3
sub nstype { my $h; open $h, $_[0] and ioctl $h, 0xb7 << 8 | 3, 0 }
for(</proc/[0-9]*/task/[0-9]*/{ns/*,fd/*,mountinfo}>){
    s{/([0-9]*)/task/\1/}{/$1/};
    if(my ($procpid) = m{(.*)/mountinfo$}){
        open my $h, $_ or next;
        LOOP: while(<$h>){
            next unless (my @s = split)[2] eq "0:$nsfs_dev";
            if(my($t, $i) = $s[3] =~ /^($type):\[(\d+)\]$/){
                next if exists $ns{$t}{$i};
                for ("", "$procpid/root"){
                    my ($d, $i1) =
                        (stat $_.unescape $s[4])[0, 1];
                    $ns{$t}{$i} = $_.$s[4], next LOOP
                        if $d == $nsfs_dev && $i == $i1;
                }
                $ns{$t}{$i} = "@s[4, 0, 1] $procpid/mountinfo"
            }
        }
    }elsif(m{/ns/}){
        $ns{$1}{$2} //= $_ if readlink =~ /^($type):\[(\d+)\]$/;
    }else{
        next unless my ($dev, $ino) = stat $_;
        next unless $dev == $nsfs_dev;
        next unless my $t = nstype $_;
        next if ($t = $t2n{$t}) and $t !~ $type;
        $ns{$t // '???'}{$ino} //= $_;
    }
}
for my $type (sort keys %ns){
    my $h = $ns{$type}; my @i = sort {$a<=>$b} keys %$h;
    printf "%-8s %d\n", $type, scalar @i;
    printf "   %-11d %s\n", $_, $$h{$_} for @i;
}