It would seem that basic message types are not sufficient to express all of the possible things one might want to watch for network state changes.

In addition to link events, you may also want to check:

• addition of new IPs/routes
• modification of some existing IP/route filtered by CIDR
• fields within a rtnetlink message
• state of a network neighbor

As such, it probably makes sense to turn Change into an interface which provides much more flexibility for filtering inputs. This could make it difficult to make the code cross-platform, but perhaps there are ways to keep it reasonably clean.