ip [ ip-OPTIONS ] monitor [ all | OBJECT-LIST ] [ file FILENAME ]
ip monitor [ all | OBJECT-LIST ] [ file FILENAME ]
OBJECT-LIST is the list of object types that we want to monitor. It may contain link, address, route, mroute, prefix, neigh and netconf. If no file argument is given, ip opens RTNETLINK, listens on it and dumps state changes in the format described in previous sections.
If the file option is given, the program does not listen on RTNETLINK, but opens the given file, and dumps its contents. The file should contain RTNETLINK messages saved in binary format. Such a file can be generated with the rtmon utility. This utility has a command line syntax similar to ip monitor. Ideally, rtmon should be started before the first network configuration command is issued. F.e. if you insert:
rtmon file /var/log/rtmon.log
in a startup script, you will be able to view the full history later.
Nevertheless, it is possible to start rtmon at any time. It prepends the history with the state snapshot dumped at the moment of starting.