Re: [PATCH iproute2-next 0/3] ip: netns: report the network namespace cookie

[GMail <primalgamer@gmail.com>]

On Wed, 2026-09-23 at 19:17 +0300, Ido Schimmel wrote:
> The kernel identifies a network namespace by a 64-bit cookie that is
> assigned when the namespace is created and never changes.
> 
> The cookie is reported by a growing number of trace events such as
> the
> TCP-MD5 and TCP-AO events and the net device events (e.g.,
> net:net_dev_xmit). This allows filtering events that occur in a
> specific
> network namespace, for example:
> 
>  # perf record -a -e net:net_dev_xmit --filter 'net_cookie == 12'
> 
> It is also available to tracing BPF programs that can access
> 'net_cookie' in 'struct net'.
> 
> However, no utility currently reports the cookie of a given network
> namespace, so mapping a cookie in a trace to a namespace requires a
> custom program that calls getsockopt(SO_NETNS_COOKIE) from within the
> namespace.
> 
> Since Linux 6.18, the cookie is also the generic namespace ID and can
> be
> retrieved via the NS_GET_ID ioctl on a network namespace file
> descriptor. Unlike SO_NETNS_COOKIE, this does not require entering
> the
> namespace, so the cookie of any namespace whose file can be opened
> can
> be retrieved without privileges. A kernel selftest [1] ensures that
> both
> interfaces report the same value for a given network namespace.
> 
> This patchset extends ip-netns to display the network namespace
> cookie.

Super useful, thank you!

> 
> Patch #1 imports the nsfs.h header that defines the NS_GET_ID ioctl.
> 
> Patch #2 reports the cookie in "ip netns list". It is always reported
> in
> JSON mode and only reported with "-d" in plain text mode to avoid
> breaking scripts that rely on the current output format.
> 
> Patch #3 adds "ip netns cookie [ NETNSNAME | PID ]" to report the
> cookie
> of a single network namespace, including namespaces that are not bind
> mounted under /var/run/netns, such as those created by container
> runtimes.
> 
> [1] nsid_netns_basic in
> tools/testing/selftests/namespaces/nsid_test.c
> 
> Ido Schimmel (3):
>   uapi: import nsfs.h from last sync point
>   ip: netns: report the network namespace cookie
>   ip: netns: add "ip netns cookie" command
> 
>  include/uapi/linux/nsfs.h | 122
> ++++++++++++++++++++++++++++++++++++++
>  ip/ipnetns.c              |  71 ++++++++++++++++++++++
>  man/man8/ip-netns.8.in    |  30 +++++++++-
>  3 files changed, 222 insertions(+), 1 deletion(-)
>  create mode 100644 include/uapi/linux/nsfs.h

Ferenc