Eu usei strace para verificar o que o vizinho de ip realmente faz.
Quando eu filtrou strace output para números que estavam na saída do comando ip , descobri que há uma sequência de chamadas sendmsg e recvmsg. Essas mensagens são interessantes:
sendmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base={{len=36, type=RTM_GETNEIGH, flags=NLM_F_REQUEST|NLM_F_DUMP, seq=1539003976, pid=0}, {ndm_family=AF_UNSPEC, ndm_ifindex=0, ndm_state=0, ndm_flags=0, ndm_type=RTN_UNSPEC}, {{nla_len=8, nla_type=NDA_IFINDEX}, if_nametoindex("enp0s8")}}, iov_len=36}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0)
recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[{{len=76, type=RTM_NEWNEIGH, flags=NLM_F_MULTI|NLM_F_DUMP_FILTERED, seq=1539003976, pid=15530}, {ndm_family=AF_INET, ndm_ifindex=if_nametoindex("enp0s8"), ndm_state=NUD_NOARP, ndm_flags=0, ndm_type=RTN_MULTICAST}, [{{nla_len=8, nla_type=NDA_DST}, 224.0.0.22}, {{nla_len=10, nla_type=NDA_LLADDR}, 1.0.94.0}, {{nla_len=8, nla_type=NDA_PROBES}, 0}, {{nla_len=20, nla_type=NDA_CACHEINFO}, {ndm_confirmed=2192723, ndm_used=2186723, ndm_updated=2186723, ndm_refcnt=0}}]}, {{len=76, type=RTM_NEWNEIGH, flags=NLM_F_MULTI|NLM_F_DUMP_FILTERED, seq=1539003976, pid=15530}, {ndm_family=AF_INET, ndm_ifindex=if_nametoindex("enp0s8"), ndm_state=NUD_NOARP, ndm_flags=0, ndm_type=RTN_MULTICAST}, [{{nla_len=8, nla_type=NDA_DST}, 224.0.0.251}, {{nla_len=10, nla_type=NDA_LLADDR}, 1.0.94.0}, {{nla_len=8, nla_type=NDA_PROBES}, 0}, {{nla_len=20, nla_type=NDA_CACHEINFO}, {ndm_confirmed=2192699, ndm_used=2186699, ndm_updated=2186699, ndm_refcnt=0}}]}, {{len=76, type=RTM_NEWNEIGH, flags=NLM_F_MULTI|NLM_F_DUMP_FILTERED, seq=1539003976, pid=15530}, {ndm_family=AF_INET, ndm_ifindex=if_nametoindex("enp0s8"), ndm_state=NUD_STALE, ndm_flags=0, ndm_type=RTN_UNICAST}, [{{nla_len=8, nla_type=NDA_DST}, 10.11.0.23}, {{nla_len=10, nla_type=NDA_LLADDR}, 8.0.39.3}, {{nla_len=8, nla_type=NDA_PROBES}, 1}, {{nla_len=20, nla_type=NDA_CACHEINFO}, {ndm_confirmed=206484, ndm_used=206707, ndm_updated=202203, ndm_refcnt=0}}]}, {{len=88, type=RTM_NEWNEIGH, flags=NLM_F_MULTI|NLM_F_DUMP_FILTERED, seq=1539003976, pid=15530}, {ndm_family=AF_INET6, ndm_ifindex=if_nametoindex("enp0s8"), ndm_state=NUD_NOARP, ndm_flags=0, ndm_type=RTN_MULTICAST}, [{{nla_len=20, nla_type=NDA_DST}, ff02::1:ff4b:3614}, {{nla_len=10, nla_type=NDA_LLADDR}, "\x33\x33\xff\x4b\x36\x14"}, {{nla_len=8, nla_type=NDA_PROBES}, 0}, {{nla_len=20, nla_type=NDA_CACHEINFO}, {ndm_confirmed=2192670, ndm_used=2186670, ndm_updated=2186670, ndm_refcnt=0}}]}, {{len=88, type=RTM_NEWNEIGH, flags=NLM_F_MULTI|NLM_F_DUMP_FILTERED, seq=1539003976, pid=15530}, {ndm_family=AF_INET6, ndm_ifindex=if_nametoindex("enp0s8"), ndm_state=NUD_NOARP, ndm_flags=0, ndm_type=RTN_MULTICAST}, [{{nla_len=20, nla_type=NDA_DST}, ff02::16}, {{nla_len=10, nla_type=NDA_LLADDR}, "\x33\x33\x00\x00\x00\x16"}, {{nla_len=8, nla_type=NDA_PROBES}, 0}, {{nla_len=20, nla_type=NDA_CACHEINFO}, {ndm_confirmed=2192723, ndm_used=2186723, ndm_updated=2186723, ndm_refcnt=0}}]}, {{len=88, type=RTM_NEWNEIGH, flags=NLM_F_MULTI|NLM_F_DUMP_FILTERED, seq=1539003976, pid=15530}, {ndm_family=AF_INET6, ndm_ifindex=if_nametoindex("enp0s8"), ndm_state=NUD_NOARP, ndm_flags=0, ndm_type=RTN_MULTICAST}, [{{nla_len=20, nla_type=NDA_DST}, ff02::fb}, {{nla_len=10, nla_type=NDA_LLADDR}, "\x33\x33\x00\x00\x00\xfb"}, {{nla_len=8, nla_type=NDA_PROBES}, 0}, {{nla_len=20, nla_type=NDA_CACHEINFO}, {ndm_confirmed=2192536, ndm_used=2186536, ndm_updated=2186536, ndm_refcnt=0}}]}, {{len=88, type=RTM_NEWNEIGH, flags=NLM_F_MULTI|NLM_F_DUMP_FILTERED, seq=1539003976, pid=15530}, {ndm_family=AF_INET6, ndm_ifindex=if_nametoindex("enp0s8"), ndm_state=NUD_NOARP, ndm_flags=0, ndm_type=RTN_MULTICAST}, [{{nla_len=20, nla_type=NDA_DST}, ff02::2}, {{nla_len=10, nla_type=NDA_LLADDR}, "\x33\x33\x00\x00\x00\x02"}, {{nla_len=8, nla_type=NDA_PROBES}, 0}, {{nla_len=20, nla_type=NDA_CACHEINFO}, {ndm_confirmed=2192568, ndm_used=2186568, ndm_updated=2186568, ndm_refcnt=0}}]}], iov_len=580}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0)
Quando tentei localizar números do comando ip neigh na saída strace, descobri que ip neigh exibe valores ndm_used, ndm_confirmed, ndm_updated divididos por 100.
Isso me levou a man 7 rtnetlink :
Rtnetlink allows the kernel's routing tables to be read and altered (...). Network routes, IP addresses, link parameters, neighbor setups, queueing disciplines, traffic classes and packet classifiers may all be controlled through NETLINK_ROUTE sockets. It is based on netlink messages.
E mais tarde:
RTM_NEWNEIGH, RTM_DELNEIGH, RTM_GETNEIGH
Add, remove or receive information about a neighbor table entry (e.g., an ARP entry). The message contains an ndmsg structure.
struct ndmsg {
unsigned char ndm_family;
int ndm_ifindex; /* Interface index */
__u16 ndm_state; /* State */
__u8 ndm_flags; /* Flags */
__u8 ndm_type;
};
struct nda_cacheinfo {
__u32 ndm_confirmed;
__u32 ndm_used;
__u32 ndm_updated;
__u32 ndm_refcnt;
};
ndm_state is a bit mask of the following states:
NUD_INCOMPLETE a currently resolving cache entry
NUD_REACHABLE a confirmed working cache entry
NUD_STALE an expired cache entry
NUD_DELAY an entry waiting for a timer
NUD_PROBE a cache entry that is currently reprobed
NUD_FAILED an invalid cache entry
NUD_NOARP a device with no destination cache
NUD_PERMANENT a static entry
Valid ndm_flags are:
NTF_PROXY a proxy arp entry
NTF_ROUTER an IPv6 router
The rtattr struct has the following meanings for the rta_type field:
NDA_UNSPEC unknown type
NDA_DST a neighbor cache n/w layer destination address
NDA_LLADDR a neighbor cache link layer address
NDA_CACHEINFO cache statistics.
If the rta_type field is NDA_CACHEINFO, then a struct nda_cacheinfo header follows.
A estrutura nda_cacheinfo é definida em <linux/neighbour.h>
Os comentários em <linux/neighbour.h> não são muito úteis se você quiser saber o que esses valores indicam e também não consegui encontrá-los na Internet.