Ethtool gets information from the SIOCETHTOOL ioctl and AF_NETLINK sockets. The former are traditional ioctls that can be performed on any socket (e.g. AF_INET), the latter is a message-oriented protocol for communicating networking information to/from the kernel. (For example, “ip route” and “route” tools transact routing info through RT_NETLINK messages on AF_NETLINK sockets.) There are many different protocols that sit on top of NETLINK sockets.