How to filter physical ethernet links using rtnetlink

A rtnetlink RTM_GETLINK dump returns every network interface on the system: loopback, physical NICs, bridges, veth pairs, VLANs, WireGuard tunnels, TUN devices, and so on. If you only want physical wired Ethernet adapters, you need to filter out three categories:

1. Non-Ethernet link types — loopback (ARPHRD_LOOPBACK), WireGuard/TUN (ARPHRD_NONE), etc.
2. Virtual Ethernet interfaces — bridges, veths, VLANs, bonds, macvlan, etc. These all report ifi_type == ARPHRD_ETHER but carry an IFLA_LINKINFO attribute identifying their kind.
3. Wireless interfaces — Wi-Fi adapters also report ARPHRD_ETHER and have no IFLA_LINKINFO, so they are indistinguishable from wired Ethernet via netlink alone.

This post shows a compact C++ program that applies all three filters and prints only the physical wired Ethernet links.

The three filters

Filter 1: ifi_type == ARPHRD_ETHER

The ifi_type field in struct ifinfomsg holds the ARP hardware type. Wired Ethernet, Wi-Fi, bridges, and veths all report ARPHRD_ETHER (1). Loopback reports 772 (ARPHRD_LOOPBACK), and tunnel interfaces (WireGuard, TUN) report 65534 (ARPHRD_NONE). This filter removes everything that is not Ethernet-framed at L2.

Filter 2: no IFLA_LINKINFO

Virtual Ethernet interfaces — bridges (Kind: bridge), veths (Kind: veth), VLANs (Kind: vlan), bonds (Kind: bond), macvlan, etc. — all carry the nested IFLA_LINKINFO attribute with an IFLA_INFO_KIND inside it. Physical interfaces (both wired and wireless) do not have IFLA_LINKINFO at all.

So: if IFLA_LINKINFO is present in the attribute list, the interface is virtual and should be skipped.

Filter 3: no /sys/class/net/<name>/wireless

Wi-Fi adapters are physical devices with no IFLA_LINKINFO, so they pass filters 1 and 2. The kernel does not expose a “is wireless” flag in the rtnetlink link dump (the IFLA_WIRELESS attribute is only sent in wireless extension events, not in dump replies).

The reliable way to detect Wi-Fi is to check for the existence of /sys/class/net/<name>/wireless — the kernel creates this directory for wireless interfaces only. This requires a stat() call per candidate interface, which is negligible since there are typically only a handful.

The program

#include <iostream>
#include <cstdint>
#include <cstring>
#include <string>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>
#include <linux/if_arp.h>

int main() {
    int sock_fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
    if (sock_fd < 0) { perror("socket"); return 1; }

    struct sockaddr_nl sa{};
    sa.nl_family = AF_NETLINK;
    sa.nl_pid = getpid();
    bind(sock_fd, reinterpret_cast<struct sockaddr*>(&sa), sizeof(sa));

    // Request a dump of all links (AF_UNSPEC = all address families).
    struct {
        struct nlmsghdr nlh;
        struct ifinfomsg ifm;
    } req{};

    req.nlh.nlmsg_len = NLMSG_LENGTH(sizeof(struct ifinfomsg));
    req.nlh.nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP;
    req.nlh.nlmsg_type = RTM_GETLINK;
    req.ifm.ifi_family = AF_UNSPEC;

    struct sockaddr_nl dest{};
    dest.nl_family = AF_NETLINK;
    struct iovec iov = { &req, req.nlh.nlmsg_len };
    struct msghdr msg = { &dest, sizeof(dest), &iov, 1, nullptr, 0, 0 };
    sendmsg(sock_fd, &msg, 0);

    char buf[16384];
    bool running = true;

    while (running) {
        ssize_t len = recv(sock_fd, buf, sizeof(buf), 0);
        if (len < 0) break;

        auto* nlh = reinterpret_cast<struct nlmsghdr*>(buf);
        for (; NLMSG_OK(nlh, len); nlh = NLMSG_NEXT(nlh, len)) {
            if (nlh->nlmsg_type == NLMSG_DONE) { running = false; break; }
            if (nlh->nlmsg_type != RTM_NEWLINK) continue;

            auto* ifi = reinterpret_cast<struct ifinfomsg*>(NLMSG_DATA(nlh));

            // Filter 1: only Ethernet hardware type (excludes loopback,
            // WireGuard, TUN, and other non-Ethernet link types).
            if (ifi->ifi_type != ARPHRD_ETHER) continue;

            // Walk attributes to extract the name and detect IFLA_LINKINFO.
            int attr_len = IFLA_PAYLOAD(nlh);
            struct rtattr* rta = IFLA_RTA(ifi);
            std::string name;
            bool has_linkinfo = false;

            for (; RTA_OK(rta, attr_len); rta = RTA_NEXT(rta, attr_len)) {
                if (rta->rta_type == IFLA_IFNAME)
                    name = reinterpret_cast<char*>(RTA_DATA(rta));
                if (rta->rta_type == IFLA_LINKINFO)
                    has_linkinfo = true;
            }

            // Filter 2: skip virtual interfaces (bridge, veth, vlan, ...).
            // They all carry IFLA_LINKINFO with an IFLA_INFO_KIND inside.
            if (has_linkinfo) continue;

            // Filter 3: skip Wi-Fi adapters. The kernel exposes a
            // /sys/class/net/<name>/wireless directory only for wireless
            // interfaces; rtnetlink itself has no "is wireless" flag
            // in the dump reply.
            std::string sysfs_wireless = "/sys/class/net/" + name + "/wireless";
            struct stat st;
            if (stat(sysfs_wireless.c_str(), &st) == 0) continue;

            std::cout << name << " (ifindex=" << ifi->ifi_index
                      << " flags=0x" << std::hex << ifi->ifi_flags
                      << std::dec << ")\n";
        }
    }

    close(sock_fd);
    return 0;
}

Note: <linux/if_arp.h> and <net/if.h> both define the IFF_* flags and conflict if included together. This program only needs ARPHRD_ETHER from <linux/if_arp.h>, so <net/if.h> is omitted. If you need IFF_* flag constants, include only <net/if.h> and hardcode ARPHRD_ETHER as 1.

Building and running

g++ -o list_phys_eth list_phys_eth.cpp
./list_phys_eth

No special privileges are required.

Example output

On a host with loopback, Wi-Fi, several Docker bridges and veth pairs, WireGuard tunnels, and a single USB Ethernet adapter, the program prints only the physical wired Ethernet link:

enx8e4f6eac342f (ifindex=467 flags=0x11043)

For comparison, the same host has 30+ interfaces in the full rtnetlink dump — all filtered out by the three checks above.

Why not just check the interface name?

Interface names follow conventions (enX = wired Ethernet, wlX = Wi-Fi, brX = bridge, vethX = veth pair), but these are conventions, not guarantees. USB Ethernet adapters use enx<MAC> by default but can be renamed with udev rules or ip link set name. The IFLA_LINKINFO + sysfs approach is robust against renaming because it inspects what the kernel reports about the interface, not what the user called it.

Also see How to list all network links using rtnetlink API for the full link-dump program this filter is derived from, How to filter VLAN interfaces using rtnetlink for the complementary VLAN filter, and How to iterate rtnetlink rtattr attributes for the attribute-walking idiom.