Skip to main content
The netns (network namespace) section provides information about the network namespace context where an event occurred.

​
Fields

​
cookie
u64
Unique identifier for the network namespace, generated by the kernel.This cookie is obtained via bpf_get_netns_cookie() and provides a stable identifier across namespace operations. May not be available on older kernels (< 5.7).
​
inum
u32
required
Namespace inode number.This is the inode number of the network namespace, visible in /proc/PID/ns/net. Can be used to identify which namespace a process belongs to.

​
Display Format

With cookie: 
ns {cookie_hex}/{inum}
Without cookie: 
ns {inum}

​
Examples

ns 0x12345678/4026531840
ns 4026531840
ns 0xabcdef00/4026532448

​
Example JSON

{
  "netns": {
    "cookie": 305419896,
    "inum": 4026531840
  }
}

{
  "netns": {
    "cookie": null,
    "inum": 4026531840
  }
}

​
Container Namespace

{
  "netns": {
    "cookie": 2863311530,
    "inum": 4026532448
  }
}

​
Complete Event Example

{
  "common": {
    "timestamp": 7322460997041,
    "smp_id": 0,
    "task": {
      "pid": 1234,
      "tgid": 1234,
      "comm": "curl"
    }
  },
  "kernel": {
    "symbol": "__netif_receive_skb_core",
    "probe_type": "kprobe"
  },
  "netns": {
    "cookie": 305419896,
    "inum": 4026531840
  },
  "dev": {
    "name": "eth0",
    "ifindex": 2,
    "rx_ifindex": null
  },
  "packet": {
    "len": 98,
    "capture_len": 98,
    "data": "...(base64)..."
  }
}

​
When This Section Appears

The netns section is populated when:
  • The probe has access to namespace information
  • Obtained from the network device or socket (in that order)
  • The collector can retrieve namespace context

​
Namespace Identification

​
Default Namespace

The initial/default network namespace typically has inum 4026531840 on most systems.

​
Container Namespaces

Containers (Docker, Kubernetes pods, etc.) run in separate network namespaces with different inum values.

​
Finding Process Namespace

Map events to processes using the namespace inum: 
# Show namespace for a process
$ ls -l /proc/1234/ns/net
lrwxrwxrwx 1 root root 0 Mar 6 10:00 /proc/1234/ns/net -> 'net:[4026532448]'
The number in brackets (4026532448) is the inum value.

​
Listing All Network Namespaces

# List all namespaces
$ ip netns list

# Find processes in a namespace
$ ip netns identify <pid>
The cookie field provides a more stable identifier than inum:
  • cookie: Randomly generated by kernel, stable across namespace lifetime
  • inum: Can be reused after namespace deletion
Prefer using cookie when available for correlating events across time.

​
Use Cases

​
Multi-tenant Environments

In multi-tenant systems (Kubernetes, OpenStack), use namespace information to:
  • Filter events by tenant/pod
  • Isolate traffic analysis per container
  • Track cross-namespace communication

​
Namespace Transitions

Watch for namespace changes as packets traverse the stack: 
Event 1: ns 0x12345678/4026531840 if 2 (eth0)     # Host namespace
Event 2: ns 0xabcdef00/4026532448 if 10 (veth0)   # Container namespace

​
Network Debugging

Identify which namespace is experiencing issues: 
# Filter events for a specific namespace
retis print events.json --format json | \
  jq '.events[] | select(.netns.inum == 4026532448)'

# Count events per namespace
retis print events.json --format json | \
  jq -r '.events[].netns.inum' | sort | uniq -c

​
Kernel Version Compatibility

The cookie field availability depends on kernel version:
Kernel VersionCookie Support
< 5.7No (null)
>= 5.7Yes
On older kernels, only inum is available.

​
Display with Device Section

The netns and dev sections are typically displayed together: 
ns 0x12345678/4026531840 if 2 (eth0)
ns 4026532448 if 10 (veth1234) rxif 2
This compact format shows:
  • Which namespace the event occurred in
  • Which network device was involved
  • Optional receive interface
The namespace information is retrieved from the device or associated socket. If neither is available at the probe point, this section may not appear.

Build docs developers (and LLMs) love

Get started for freeTalk to us