ID:
RTM_GETLINK_VPNCategory: Interfaces Status in RKNHardering 2.10.0: Active check Role in the verdict: High
This page describes the actual implementation in RKNHardering 2.10.0. It distinguishes what can be done without root, what requires root, and where a mitigation only reduces one signal without hiding the VPN as a whole.
The probe opens AF_NETLINK/NETLINK_ROUTE, sends RTM_GETLINK with NLM_F_DUMP, and parses RTM_NEWLINK messages and the IFLA_IFNAME attribute. It searches for the exact names tun0, tun1, utun0, wg0, ppp0, and xfrm0; the receive loop uses poll(..., 2000) and recv().
The complete link dump contains at least one RTM_NEWLINK message with a fixed VPN interface name.
This is one of the most important paths: an ordinary app obtains the network-device list directly from the kernel even when /proc or /sys is inaccessible. A match is a strong local indicator.
How the line affects the report: The line sets detected=true and is treated as a high-confidence local indicator.
Only six exact names are checked. The probe does not strictly validate multipart truncation or sequence/PID values; a send, poll, or receive failure silently produces no result. A userspace hook that covers only getifaddrs() does not close this path.
This line must be evaluated together with neighboring signals. A clean result from a single API does not simultaneously cover Java Binder, libc, raw netlink/syscalls, procfs/sysfs, local sockets, and server-side indicators.
The most reliable non-root approach is not to create a VPN interface on the phone being tested: move the tunnel to a router, travel router, separate gateway phone, or another network node. Per-app bypass in VpnService changes the route used by the selected app, but establish() still creates a system VPN interface, so local interface checks may continue to trigger. A local HTTP/SOCKS proxy mode without TUN can sometimes remove this specific vector, but it leaves listening ports and proxy settings and does not cover apps that ignore the proxy. A secondary Android user does not receive a separate network namespace, so work and personal profiles normally see the same RTM_GETLINK dump.
Laboratory-grade hiding usually requires both a system Java layer and one native backend. With VPNHide, that means the APK plus Vector/LSPosed scoped only to System Framework, and exactly one of kmod, KPM, or Zygisk. For a check that may use a direct syscall or netlink, kmod or KPM is preferable: a userspace Zygisk hook can be bypassed and leaves traces inside the process. Review the VPNHide coverage map first, and download builds only from the official release page. VPNHide Next claims broader coverage, but it also warns about possible boot loops and kernel panics; test it only on a dedicated device. Raw netlink requires a kernel-level filter or equivalent system isolation. Zygisk would need to intercept the specific family of receive calls and would still remain bypassable; upstream VPNHide explicitly documents this limitation.
adb shell ip -details link show
adb shell 'ip -o link | grep -E "tun0|tun1|utun0|wg0|ppp0|xfrm0"'
ip also uses rtnetlink, but the shell UID may receive a differently filtered view.
After any change, force-stop both RKNHardering and the VPN client, start them again, and repeat the full scan. Zygisk, Xposed, and kernel modules usually require a reboot. Compare not only this line but also neighboring signals: a partial hook often creates inconsistencies between APIs.
The probe itself runs with ordinary app permissions and does not request root. The ADB commands below are for orientation only: adb shell runs under a different UID and may see either more or less than the app process. The decisive test is to run the check again after a force-stop.
A faulty skb/netlink filter may hang during a dump, corrupt a multipart reply, or break networking for system UIDs.
Revert the most recent change: disable the added module or rule through its normal manager, reboot the device, and repeat the baseline scan. Do not layer another hook on top of an unknown state.
High. Verified from RTM_GETLINK, RTM_NEWLINK, IFLA_IFNAME, the six-name allowlist, and the HIGH_CONFIDENCE set.
The status of a third-party solution does not automatically carry over to this device. A module developer’s claim is only the initial hypothesis; confirmation requires a reproducible RKNHardering result on the specific Android version, firmware, and kernel.
native_signs_probe.cpp — native probe implementation.VpnNativeDetectorChecker.kt — deep VPN verdict and confidence.NativeSignalId.kt — complete ID registry.NativeSignalCatalog.kt — category, slug, and line mapping.Related signals: getifaddrs-vpn, trim-oracle, ifindexname-vpn, interface-enumeration.