fir3net
PPS-Firenetbanner-780.5x190-30-03-17

Linux Network Namespaces

The Linux Network Namespace (netns) is a feature within the 2.6.27+ Linux kernel. Normally a Linux process will run within a network namespace. By default this is inherited from its parent process[1]. Network namespaces allow for the process to run within a different network namespace. This allows  for virtual instances of the Linux network stack each with its own routes, firewall rules and network devices.

A great example of network namespaces in use can be seen within OpenStack Neutron.  Neutron, the networking component of OpenStack uses network namespaces  to provide network isolation between tenants.

LIST NameSpaces

First of all to list the current namespaces the ip netns list command is used. 

root@controller01:~# ip netns list
qrouter-e945b6b1-54be-49ef-95ed-5d524d2f3616
qdhcp-dae14f7d-c7f9-4dbc-9635-603f0fbc3f09

EXEC Namespace

To execute a command within the namespace the command ip netns <namespace_id> <command>

root@controller01:~# ip netns exec qrouter-e945b6b1-54be-49ef-95ed-5d524d2f3616 ifconfig
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

qg-e5b9712e-b0 Link encap:Ethernet  HWaddr fa:16:3e:a7:8a:df
          inet addr:172.16.100.30  Bcast:172.16.100.255  Mask:255.255.255.0
          inet6 addr: fe80::f816:3eff:fea7:8adf/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:384847 errors:0 dropped:0 overruns:0 frame:0
          TX packets:16 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:62660634 (62.6 MB)  TX bytes:1200 (1.2 KB)

qr-76de6d23-a8 Link encap:Ethernet  HWaddr fa:16:3e:32:78:9d
          inet addr:10.1.1.1  Bcast:10.1.1.255  Mask:255.255.255.0
          inet6 addr: fe80::f816:3eff:fe32:789d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:266390 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:51963537 (51.9 MB)  TX bytes:864 (864.0 B)

Some typical Linux network commands that can be used are,

  • ip route list - display routes
  • ip addr list - display ip addresses
  • ifconfig - display ip addresses (different format to the above)
  • iptables -vnL - display the stats and chains for your running iptables

Additional Commands

This example touches only on the listing and exec of the network namespaces. There are other commands available such as creating and removing namespaces. Further details on these commands can be found here.

Usage: ip netns list
       ip netns add NAME
       ip netns delete NAME
       ip netns identify PID
       ip netns pids NAME
       ip netns exec NAME cmd ...
       ip netns monitor

References

[1] http://docs.openstack.org/networking-guide/intro_network_namespaces.html 

Additional Links

Tags: Linux, Namespaces

About the Author

RDonato

R Donato

Rick Donato is the Founder and Chief Editor of Fir3net.com. He currently works as a Principal Network Security Engineer and has a keen interest in automation and the cloud.

You can find Rick on Twitter @f3lix001