When working with Linux traffic control (tc), a common frustration arises when trying to delete previously configured filters. The command structure isn't always intuitive, especially when moving from filter creation to deletion. The specific error message "RTNETLINK answers: No such file or directory" typically indicates a mismatch between the deletion command syntax and how the filter was originally created.

The original filter was created using:

tc filter add dev eth0 parent 1: protocol ip handle 6 fw flowid 1:6

This command creates a filter that:

• Operates on interface eth0
• Attaches to parent class 1:
• Matches IP protocol packets
• Uses handle 6
• Uses fwmark (firewall mark) classification
• Directs traffic to flowid 1:6

To successfully delete this filter, you need to mirror the creation parameters exactly. Here are three working approaches:

# Method 1: Full specification
tc filter del dev eth0 parent 1: protocol ip handle 6 fw

# Method 2: Using priority (may be needed in some cases)
tc filter del dev eth0 parent 1: prio 1 protocol ip handle 6 fw

# Method 3: If you know the pref value
tc filter del dev eth0 parent 1: pref 49152 protocol ip handle 6 fw

The key elements often missed in deletion attempts are:

1. The parent specification must match exactly
2. The protocol must be included
3. The handle number is crucial
4. The classifier type (fw in this case) must be specified

Omitting any of these will trigger the "No such file or directory" error.

When unsure about the exact filter parameters, first list all filters:

tc filter show dev eth0 parent 1:

Then use the displayed pref value for precise deletion:

tc filter del dev eth0 parent 1: pref [value]

This method is particularly useful for complex filter configurations.

If you have multiple filters with similar parameters but need to delete a specific one, you can combine multiple match criteria:

tc filter del dev eth0 parent 1: \
    protocol ip \
    handle 6 \
    fw \
    flowid 1:6

The more specific your deletion criteria, the less chance of accidentally removing the wrong filter.

When working with Linux traffic control (tc), many developers encounter difficulties when trying to remove filters they previously added. The common error RTNETLINK answers: No such file or directory appears when the deletion command isn't properly structured to match the original filter creation.

The filter you created:

tc filter add dev eth0 parent 1: protocol ip handle 6 fw flowid 1:6

contains several key components that must be replicated exactly in the deletion command:

• Device specification (dev eth0)
• Parent class (parent 1:)
• Protocol (protocol ip)
• Handle (handle 6)
• Filter type (fw)

To properly delete this filter, you need to mirror all these parameters:

tc filter del dev eth0 parent 1: protocol ip handle 6 fw

Notice we omit the flowid parameter in deletion as it's not needed for identification.

If you're unsure of the exact handle or parameters, you can:

1. List all filters first:

tc filter show dev eth0 parent 1:

2. Delete by pref (shown in filter list):

tc filter del dev eth0 parent 1: pref 49152

• Always check tc filter show output before deletion
• Root privileges are required (sudo)
• Verify interface name is correct (eth0 vs eth1, etc.)
• For complex setups, consider flushing all filters: tc filter del dev eth0 parent 1:

Here's a complete workflow:

# Add filter
sudo tc filter add dev eth0 parent 1: protocol ip handle 6 fw flowid 1:6

# Verify
tc filter show dev eth0 parent 1:

# Delete
sudo tc filter del dev eth0 parent 1: protocol ip handle 6 fw