Currently in no particular order. Most of these are kind of ancient.

Where's all the modern documentation? So much of what I've turned up searching is other folks complaining about having few options beyond reading source code.

The OREILLY books, while dated, seem to be some of the best available. Note that these can be read with a 7-day trial. Do this! At least get through the introduction section and first chapter of each to see if it's what you're after.

https://www.netfilter.org/

BOOK OREILLY Understanding Linux Network Internals

• Doesn't really cover netfilter???

PAPER Linux Advanced Routing & Traffic Control HOWTO

Sergey's netreads:

• SLIDES The Journey of a Packet Through the Linux Network Stack
  • Cites PAPER Path of a Packet in the Linux Kernel Stack
• PAPER Linux Kernel Networking (Rami Rosen)
  • Rosen also wrote BOOK OREILLY Linux Kernel Networking: Implementation and Theory.
    • Published in 2013, it seems to be somewhat of a successor to Understanding Linux Network Internals.
    • Does cover netfilter and some other stuff not in Linux Network Internals!
    • Lots of info on Rosen's personal site
    • Lectures at the Haifa Linux Club

WIKI Generic Netlink by Example focuses on targeting Generic Netlink from within the kernel, not from user-space.

SLIDES A Map of the Networking Code in Linux Kernel 2.4.20

PAPER Linux Network Stack Walkthrough (2.4.20)

This Quora has some good diagrams in the responses. https://www.quora.com/What-is-the-best-way-resource-to-learn-Linux-networking-concepts-and-practices-like-open-source-training-manuals-and-hand-outs

See Rosen's Linux Kernel Networking.

I'd like to answer this question: https://stackoverflow.com/questions/18541517/live-socket-monitoring-with-netlink-inet-diag

These weren't sufficient:

• https://bitsup.blogspot.com/2008/04/monitoring-ip-changes-with-netlink.html (required polling, which OP didn't like)
• https://github.com/kristrev/inet-diag-example Monitors something different; OP uncertain if the same is possible with diag sockets

See also:

• http://man7.org/linux/man-pages/man7/sock_diag.7.html
• https://www.infradead.org/~tgr/libnl/
• https://netfilter.org/projects/libmnl/doxygen/html/

Netfilter: https://github.com/torvalds/linux/tree/db54615e21419c3cb4d699a0b0aa16cc44d0e9da/net/netfilterGo

ss, from iproute2: https://github.com/shemminger/iproute2/blob/master/misc/ss.c

• This should provide an example of monitoring via NETLINK+INET_DIAG sockets.

https://github.com/mdlayher/netlink

https://godoc.org/github.com/ti-mo/conntrack

• Source: https://github.com/ti-mo/conntrack
• Implemented using https://github.com/ti-mo/netfilter

https://github.com/svinota/pyroute2/blob/master/pyroute2/netlink/