---
name: "ip-monitor"
section: "8"
platform: "linux"
package: "iproute2"
version: "7.3.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/ip-monitor"
---

# ip-monitor(8)

state monitoring

## NAME

ip-monitor, rtmon - state monitoring

## SYNOPSIS

**ip monitor** \[ **all** \| *OBJECT-LIST* \] \[ **file** *FILENAME*  \] \[ **label** \] \[ **all-nsid** \] \[ **dev** *DEVICE*  \]

## OPTIONS

- **-t**, **-timestamp**

  Prints timestamp before the event message on the separated line in format:\
       Timestamp: \<Day\> \<Month\> \<DD\> \<hh:mm:ss\> \<YYYY\> \<usecs\> usec\
       \<EVENT\>

- **-ts**, **-tshort**

  Prints short timestamp before the event message on the same line in format:\
       \[\<YYYY\>-\<MM\>-\<DD\>T\<hh:mm:ss\>.\<ms\>\] \<EVENT\>

## DESCRIPTION

The **ip** utility can monitor the state of devices, addresses and routes continuously. This option has a slightly different format. Namely, the **monitor** command is the first in the command line and then the object list follows:

**ip monitor** \[ **all** \| *OBJECT-LIST* \] \[ **file** *FILENAME*  \] \[ **label** \] \[ **all-nsid** \] \[ **dev** *DEVICE*  \]

*OBJECT-LIST* is the list of object types that we want to monitor. It may contain **link**, **address**, **route**, **mroute**, **maddress**, **acaddress**,  **prefix**, **neigh**, **netconf**, **rule**, **stats**, **nsid** and  **nexthop**. If no **file** argument is given, **ip** opens RTNETLINK, listens on it and dumps state changes in the format described in previous sections.

If the **label** option is set, a prefix is displayed before each message to show the family of the message. For example:

\[NEIGH\]10.16.0.112 dev eth0 lladdr 00:04:23:df:2f:d0 REACHABLE \[LINK\]3: eth1: \<BROADCAST,MULTICAST\> mtu 1500 qdisc pfifo\_fast state DOWN group default\
     link/ether 52:54:00:12:34:57 brd ff:ff:ff:ff:ff:ff

If the **all-nsid** option is set, the program listens to all network namespaces that have a nsid assigned into the network namespace were the program is running. A prefix is displayed to show the network namespace where the message originates. Example:

\[nsid 0\]10.16.0.112 dev eth0 lladdr 00:04:23:df:2f:d0 REACHABLE

If the **file** option is given, the program does not listen on RTNETLINK, but opens the given file, and dumps its contents. The file should contain RTNETLINK messages saved in binary format. Such a file can be generated with the **rtmon** utility. This utility has a command line syntax similar to **ip monitor**. Ideally, **rtmon** should be started before the first network configuration command is issued. F.e. if you insert:

rtmon file /var/log/rtmon.log

in a startup script, you will be able to view the full history later.

Nevertheless, it is possible to start **rtmon** at any time. It prepends the history with the state snapshot dumped at the moment of starting.

If the **dev** option is given, the program prints only events related to this device.

## SEE ALSO

[**ip**(8)](/ip/8.md)

## AUTHOR

Original Manpage by Michail Litvak \<mci@owl.openwall.com\>\
 Manpage revised by Nicolas Dichtel \<nicolas.dichtel@6wind.com\>