Detecting that a network interface is "physical" or "virtual" using only RTNETLINK on Linux?

Question

I would like to detect whether a network interface is "physical" or "virtual", where "physical" means that the interface has hardware attached, even if that "hardware" is virtualized by a hypervisor. "Virtual" then means that it's one of the Linux kernel elements, such as bridges, veths, macvlans, et cetera.

I'm aware that by using /sys/class/net/[nif]/... I can follow the device link and thus differentiate between (virtual) physical and "real" (sic!) virtual network interfaces, based on the device path containing the "virtual" sub directory or not. However, when dealing with network namespaces, this requires a properly remounted sysfs in order to be able to see the correct /sys/class/net/... entries. So a simpler method relying solely on RTNETLINK data might be more suitable.

When using RTNETLINK to discover the available network interfaces is there some property/attribute which allows me to differentiate without the need to check /sys/class/net/[nif]?

Answer 1

The only way seems to look at the IFLA_INFO_KIND attribute returned from a RTM_GETLINK. This is an optional attribute that's missing for physical devices, and also for the lo loopback device.

When it's present, it contains a string such as veth, bridge, et cetera. Comparing this to a list of well-known virtual link types (see ip link help) then identifies virtual network interfaces, leaving all other network interfaces in the "physical network interface" ballpark.

Not perfect, but works without having to consult /sys/class/net/[IFNAME], which isn't always be correctly present and needs sysfs (re)mounting, see also Identify if a network interface is a veth using /sys/class/net?