Linux IP netns Command

The IP netns command is used to manage network namespace. It can create a named network namespace and then refer to the network namespace by name, so it is convenient to use.

The IP netns command format is as follows:
IP [OPTIONS] netns {COMMAND | help}

You can view help for all operations of IP Netns by using the Assist command:

Network Namespace

Network namespace is logically a copy of the networking stack that has its own routing, firewall rules, and network devices.
By default, a child process inherits the network namespace of its parent process. In other words, if you do not explicitly create a new network namespace, all processes inherit the same default network namespace from the init process.
By convention, the named network namespace is an object under the /var/run/netns/ directory that can be opened. For example, if you have a network namespace object called Net1, you can refer to network namespace Net1 by the file descriptor that is generated by opening the/var/run/netns/net1 object. By referencing the file descriptor, you can modify the network namespace of the process.

Show all named Network namespace

The IP netns List command displays all the named Network Namesapce, in fact, all the network namespace objects in the/var/run/netns directory are displayed:

Create a named network namespace

The IP netns add name command creates a named network namespace:

Delete the named network namespace

The IP [-all] netns del [name] command deletes the network namespace for the specified name. If the-all option is specified, an attempt is made to delete all network namespace.

Note that if we set the network card to a network namespace and started the process in that network namespace:

sudosudo sudo ip netns exec net0 bash 

Delete the network namespace net0 in another bash process:

sudo ip netns del net0

While you can delete Netowrk namespace, the NIC remains in the network namespace you have deleted before the process exits.

viewing the network namespace of a process

The IP netns identify [PID] command is used to view the network namespace of the process. If you do not specify a PID, the network namespace of the current process is displayed:

The following command specifies the PID:

to view the PID of a process in network namespace

The IP netns pids NAME command is used to view the PID of the process in the specified network namespace. This command is actually to check all the processes under/PROC and see if the network namespace of the process is the specified network namespace:

executing commands in the specified network namespace

The IP [-all] netns exec [NAME] cmd command is used to execute commands in the specified network namespace. For example, let's take a look at what network adapters are in a network namespace:

IP netns exec followed namespace's name, such as the Neta here, and then the command to execute, as long as the legitimate shell command would work, such as the IP addr or bash above.
Even better, the execution can be any command, not just the network-related (of course, and the result of the network-independent command execution and the external execution is no different). In the example below, after executing the bash command, all subsequent commands are executed in this network namespace, with the benefit of not having to complete the IP netns exec NAME every time the command is executed, the disadvantage is that you cannot clearly know your current shell, easy to mix Xiao

With the-all parameter we can execute the command at all network namespace at the same time:

Netns in output: Indicates the result of execution in a network namespace.

Monitor operation of the network namespace

The IP netns Monitor command is used to monitor the operation of the network namespace. For example, when we delete a network namespace, we receive the corresponding notification:

Understanding the IP netns Add command

We use the following demo to understand the nature of the IP netns add command.
To view the ID of the default network namespace:

Readlink /proc/$$/ns/net

In the/var/run/netns directory, create a file to bind the network namespace, named MyNet:

sudo mkdir -p/var/run/sudotouch /var/run/netns/mynet

Create a new network namespace with the Unshare command and start a new bash in the new namespace:

sudo unshare--net bash

To view the new network namespace ID:

Readlink /proc/$$/ns/net

Mount the network namespace file for the current bash process to the MyNet file created earlier by binding the mount:

Mount --bind/proc/$$/ns/net/var/run/netns/ls -i/var/run/netns/mynet

With the ls-i command you can see that the inode number of the file mynet is the same as the ID of the network namespace, indicating that the binding succeeded:

Exit the newly created bash and check the inode of the MyNet file again:

ls -i/var/run/netns/mynet

It can be seen that the inode of the MyNet file has not changed, indicating that we have used the binding mount, although the new network namespace has no process, but the new network namespace continues to exist.

The above sequence of operations is actually equivalent to executing the command:sudo ip netns add mynet
The following Nsenter command is equivalent to executing the command: sudo ip netns exec mynet bash

sudo nsenter--net=/var/run/netns/readlink /proc/$$/ns/net

A bash process was created with the Nsenter command and added to the network namespace (net:[4026532616]) associated with MyNet.

As you can see from the example above, creating a named network namespace is actually creating a file and then binding the newly created network namespace file (/proc/$$/ns/net) to the file by binding, even if the All the processes in the network namespace have exited, the kernel retains the network namespace, and later we can join the network namespace through this bundled file.

Reference:
IP netns man page
Linux Namespace Series: Network namespace

Linux IP netns Command