How to monitor link, route, and neighbor changes with ip monitor

Monitoring network changes with ip monitor is useful when a link flaps, a route appears or disappears, or a neighbor entry changes too quickly to catch with repeated ip link, ip route, or ip neigh commands. A successful monitor session stays open and prints each matching kernel event as it happens so the change can be correlated with the test, reboot, failover, or cabling action that triggered it.

The ip monitor command can watch multiple object types at once, and the current ip-monitor(8) syntax also supports `label`, `dev DEVICE`, and timestamp options such as `-ts` for easier reading during troubleshooting. In practice, labeled and timestamped output is the quickest way to distinguish whether the change was a link transition, a route update, or a neighbor-cache event.

A quiet monitor window does not automatically mean the command failed. It usually means the kernel has not emitted a matching link, route, or neigh event for the interface or object list being watched while the problem is reproduced.

Steps to monitor link, route, and neighbor changes with ip monitor:

Start a timestamped monitor for the object types involved in the problem.

$ ip -ts monitor link route neigh label
[2026-03-25T01:35:29.478057] [LINK]13: lab0@peer1: &lt;BROADCAST,MULTICAST&gt; mtu 1500 qdisc noqueue state DOWN group default
    link/ether 56:b4:75:16:33:86 brd ff:ff:ff:ff:ff:ff

Add a device filter when only one interface is relevant to keep the stream focused.
```
$ ip -ts monitor link route neigh label dev eth0
```
The `dev` filter is useful on multi-homed hosts where unrelated routing or neighbor chatter would otherwise hide the event you care about.
Reproduce the link flap, route change, or reachability test in another terminal or from another host while the monitor is still running.

Do not restart the monitor between tests; leave it attached so the event order stays visible.
Read the event labels to see which kernel object actually changed.
```
[2026-03-25T01:35:31.488547] [ROUTE]198.51.100.0/24 dev lab0 scope link
[2026-03-25T01:35:35.560540] [NEIGH]192.0.2.20 dev lab0 FAILED
```
`[LINK]` points to interface state changes, `[ROUTE]` shows routing-table updates, and `[NEIGH]` shows ARP or IPv6 neighbor-cache changes.
Stop the monitor with Ctrl+C after the needed events have been captured.

If the terminal stays quiet during the test, widen the object list or remove the `dev` filter before assuming the network problem is elsewhere.

Author: Mohd Shakir Zakaria
Mohd Shakir Zakaria is a cloud architect with deep roots in software development and open-source advocacy. Certified in AWS, Red Hat, VMware, ITIL, and Linux, he specializes in designing and managing robust cloud and on-premises infrastructures.