4 # Copyright © 2015-2017 Apple Inc.
8 # Collect network information.
11 PATH
=/bin
:/usr
/bin
:/sbin
:/usr
/sbin
13 # __SETUP_ROUTINES_BEGIN__
21 COLLECT_CONFIGURATION_FILES
="Y"
33 COLLECT_SENSITIVE_INFO
="Y"
40 REQUESTED_OUTDIR
="${i}"
51 if [ ${EUID} -ne 0 ]; then
64 cd "${REQUESTED_OUTDIR}"
68 # __SETUP_ROUTINES_END__
71 # __COMMAND_ROUTINES_BEGIN__
73 # note: the daemons dump to syslog so you need to wait a bit before
75 collect_state_dump_sensitive
() {
77 ${PRIV} /usr
/bin
/killall
-INFO mDNSResponder
2>/dev
/null
84 # network interface configuration
88 if [ ! -x /sbin
/ifconfig
]; then
92 /sbin
/ifconfig
-a -L -b -m -r -v -v > ifconfig.txt
2>&1
94 /sbin
/ifconfig
-a > ifconfig.txt
2>&1
100 # network route configuration and statistics
104 if [ ! -x /usr
/sbin
/netstat
]; then
108 echo "#" > netstat.txt
109 echo "# netstat -n -r -a -l" >> netstat.txt
110 echo "#" >> netstat.txt
111 /usr
/sbin
/netstat
-n -r -a -l >> netstat.txt
2>&1
113 echo "#" >> netstat.txt
114 echo "# netstat -A -a -l -n -v" >> netstat.txt
115 echo "#" >> netstat.txt
116 /usr
/sbin
/netstat
-A -a -l -n -v >> netstat.txt
2>&1
118 echo "#" >> netstat.txt
119 echo "# netstat -s" >> netstat.txt
120 echo "#" >> netstat.txt
121 /usr
/sbin
/netstat
-s >> netstat.txt
2>&1
123 echo "#" >> netstat.txt
124 echo "# netstat -rs" >> netstat.txt
125 echo "#" >> netstat.txt
126 /usr
/sbin
/netstat
-rs >> netstat.txt
2>&1
128 echo "#" >> netstat.txt
129 echo "# netstat -mmm" >> netstat.txt
130 echo "#" >> netstat.txt
131 /usr
/sbin
/netstat
-mmm >> netstat.txt
2>&1
133 echo "#" >> netstat.txt
134 echo "# netstat -i -n -d" >> netstat.txt
135 echo "#" >> netstat.txt
136 /usr
/sbin
/netstat
-i -n -d >> netstat.txt
2>&1
138 echo "#" >> netstat.txt
139 echo "# netstat -i -x R" >> netstat.txt
140 echo "#" >> netstat.txt
141 /usr
/sbin
/netstat
-i -x R
>> netstat.txt
2>&1
143 echo "#" >> netstat.txt
144 echo "# netstat -a -n -p mptcp" >> netstat.txt
145 echo "#" >> netstat.txt
146 /usr
/sbin
/netstat
-anp mptcp
>> netstat.txt
2>&1
148 echo "#" >> netstat.txt
149 echo "# netstat -s -p mptcp" >> netstat.txt
150 echo "#" >> netstat.txt
151 /usr
/sbin
/netstat
-s -p mptcp
>> netstat.txt
2>&1
153 echo "#" >> netstat.txt
154 echo "# netstat -g -n -s" >> netstat.txt
155 echo "#" >> netstat.txt
156 /usr
/sbin
/netstat
-g -n -s >> netstat.txt
2>&1
158 if [ -x /sbin
/ifconfig
]; then
161 IF_INFO
=`/sbin/ifconfig -v ${if}`
162 `echo $IF_INFO | grep -q TXSTART`
163 if [ $?
-eq 0 ]; then
164 echo "#" >> netstat.txt
165 echo "# netstat -qq -I ${if}" >> netstat.txt
166 echo "#" >> netstat.txt
167 /usr
/sbin
/netstat
-qq -I ${if} >> netstat.txt
2>&1
169 `echo $IF_INFO | grep -q RXPOLL`
170 if [ $?
-eq 0 ]; then
171 echo "#" >> netstat.txt
172 echo "# netstat -Q -I ${if}" >> netstat.txt
173 echo "#" >> netstat.txt
174 /usr
/sbin
/netstat
-Q -I ${if} >> netstat.txt
2>&1
186 if [ ! -x /usr
/sbin
/ndp
]; then
190 echo "#" > ndp
-info.txt
191 echo "# ndp -n -a" >> ndp
-info.txt
192 echo "#" >> ndp
-info.txt
193 /usr
/sbin
/ndp
-n -a >> ndp
-info.txt
2>&1
195 echo "#" >> ndp
-info.txt
196 echo "# ndp -n -p" >> ndp
-info.txt
197 echo "#" >> ndp
-info.txt
198 /usr
/sbin
/ndp
-n -p >> ndp
-info.txt
2>&1
200 echo "#" >> ndp
-info.txt
201 echo "# ndp -n -r" >> ndp
-info.txt
202 echo "#" >> ndp
-info.txt
203 /usr
/sbin
/ndp
-n -r >> ndp
-info.txt
2>&1
205 if [ -x /sbin
/ifconfig
]; then
208 echo "#" >> ndp
-info.txt
209 echo "# ndp -i ${if}" >> ndp
-info.txt
210 echo "#" >> ndp
-info.txt
211 /usr
/sbin
/ndp
-i ${if} >> ndp
-info.txt
2>&1
222 if [ ! -x /usr
/sbin
/arp
]; then
226 echo "#" > arp
-info.txt
227 echo "# arp -n -a" >> arp
-info.txt
228 echo "#" >> arp
-info.txt
229 /usr
/sbin
/arp
-n -a >> arp
-info.txt
2>&1
238 if [ ! -x /usr
/sbin
/ipconfig
]; then
248 echo "#" >> ipconfig
-info.txt
249 echo "# INTERFACE ${if}" >> ipconfig
-info.txt
250 echo "#" >> ipconfig
-info.txt
252 echo "DHCPv4 information:" >> ipconfig
-info.txt
254 IPCONFIG_INFO
=`/usr/sbin/ipconfig getpacket ${if}`
255 if [ "${IPCONFIG_INFO}" != "" ]; then
256 echo "${IPCONFIG_INFO}" >> ipconfig
-info.txt
258 echo "not available" >> ipconfig
-info.txt
261 echo"" >> ipconfig
-info.txt
263 echo "DHCPv6 information:" >> ipconfig
-info.txt
265 IPCONFIG_INFO
=`/usr/sbin/ipconfig getv6packet ${if}`
266 if [ "${IPCONFIG_INFO}" != "" ]; then
267 echo "${IPCONFIG_INFO}" >> ipconfig
-info.txt
269 echo "not available" >> ipconfig
-info.txt
272 echo"" >> ipconfig
-info.txt
280 # IPsec configuration
284 if [ ! -x /usr
/sbin
/setkey
-o ! -x /usr
/bin
/perl
]; then
289 echo "# setkey -D" >> ipsec.txt
290 echo "#" >> ipsec.txt
291 ${PRIV} /usr
/sbin
/setkey
-D \
292 | /usr
/bin
/perl
-l -n -e '
293 if (/^(\s+[AE]:\s+\S+\s+)"?(.*)"?\s*$/) {
294 printf "%s[redacted]%s\n", $1, $3;
301 echo "#" >> ipsec.txt
302 echo "# setkey -Pp -D" >> ipsec.txt
303 echo "#" >> ipsec.txt
304 ${PRIV} /usr
/sbin
/setkey
-Pp -D >> ipsec.txt
306 for CF
in /var
/run
/racoon
/*.conf
308 if [ ! -r "${CF}" ]; then
313 echo "#" >> ipsec.txt
314 echo "# ${CF}" >> ipsec.txt
315 echo "#" >> ipsec.txt
317 | /usr
/bin
/perl
-l -n -e '
318 if (/^(\s+shared_secret\s+use\s+)"?([^\s;"]+)"?(.*)/) {
319 printf "%s[redacted]%s\n", $1, $3;
329 # skywalk configuration and statistics
333 if [ ! -x /usr
/sbin
/skywalkctl
]; then
337 echo "#" > skywalk.txt
338 echo "# skywalkctl show" >> skywalk.txt
339 echo "#" >> skywalk.txt
340 /usr
/sbin
/skywalkctl show
>> skywalk.txt
2>&1
342 echo "#" >> skywalk.txt
343 echo "# skywalkctl flow -n" >> skywalk.txt
344 echo "#" >> skywalk.txt
345 /usr
/sbin
/skywalkctl flow
-n >> skywalk.txt
2>&1
347 echo "#" >> skywalk.txt
348 echo "# skywalkctl flow-route -n" >> skywalk.txt
349 echo "#" >> skywalk.txt
350 /usr
/sbin
/skywalkctl flow
-route -n >> skywalk.txt
2>&1
352 echo "#" >> skywalk.txt
353 echo "# skywalkctl flow-switch" >> skywalk.txt
354 echo "#" >> skywalk.txt
355 /usr
/sbin
/skywalkctl flow
-switch >> skywalk.txt
2>&1
357 echo "#" >> skywalk.txt
358 echo "# skywalkctl flow-owner" >> skywalk.txt
359 echo "#" >> skywalk.txt
360 /usr
/sbin
/skywalkctl flow
-owner >> skywalk.txt
2>&1
362 echo "#" >> skywalk.txt
363 echo "# skywalkctl flow-adv" >> skywalk.txt
364 echo "#" >> skywalk.txt
365 /usr
/sbin
/skywalkctl flow
-adv >> skywalk.txt
2>&1
367 echo "#" >> skywalk.txt
368 echo "# skywalkctl netstat -s" >> skywalk.txt
369 echo "#" >> skywalk.txt
370 /usr
/sbin
/skywalkctl netstat
-s >> skywalk.txt
2>&1
372 echo "#" >> skywalk.txt
373 echo "# skywalkctl netstat -s --global" >> skywalk.txt
374 echo "#" >> skywalk.txt
375 /usr
/sbin
/skywalkctl netstat
-s --global >> skywalk.txt
2>&1
377 echo "#" >> skywalk.txt
378 echo "# skywalkctl interface" >> skywalk.txt
379 echo "#" >> skywalk.txt
380 /usr
/sbin
/skywalkctl interface
>> skywalk.txt
2>&1
382 echo "#" >> skywalk.txt
383 echo "# skywalkctl channel" >> skywalk.txt
384 echo "#" >> skywalk.txt
385 /usr
/sbin
/skywalkctl channel
>> skywalk.txt
2>&1
387 echo "#" >> skywalk.txt
388 echo "# skywalkctl provider -D" >> skywalk.txt
389 echo "#" >> skywalk.txt
390 /usr
/sbin
/skywalkctl provider
-D >> skywalk.txt
2>&1
392 echo "#" >> skywalk.txt
393 echo "# skywalkctl netns -a" >> skywalk.txt
394 echo "#" >> skywalk.txt
395 /usr
/sbin
/skywalkctl netns
-a >> skywalk.txt
2>&1
397 echo "#" >> skywalk.txt
398 echo "# skywalkctl memory" >> skywalk.txt
399 echo "#" >> skywalk.txt
400 /usr
/sbin
/skywalkctl memory
>> skywalk.txt
2>&1
405 # skywalk configuration and statistics
409 if [ ! -x /usr
/bin
/nettop
]; then
413 echo "#" > nettop.txt
414 echo "# nettop -U -l 1" >> nettop.txt
415 echo "#" >> nettop.txt
416 /usr
/bin
/nettop
-U -l 1 >> nettop.txt
2>&1
421 # Network preferences
423 collect_configuration_files
() {
426 /Library
/Preferences
/com.apple.networkextension.plist \
427 /Library
/Preferences
/com.apple.networkextension.control.plist \
428 /Library
/Preferences
/com.apple.networkextension.necp.plist \
429 /Library
/Preferences
/com.apple.networkextension.cache.plist \
430 /Library
/Preferences
/com.apple.networkextension.uuidcache.plist \
431 /Library
/Preferences
/SystemConfiguration
/com.apple.nat.plist \
432 /Library
/Preferences
/SystemConfiguration
/com.apple.RemoteAccessServers.plist \
433 /Library
/Preferences
/SystemConfiguration
/com.apple.smb.server.plist \
434 /Library
/Preferences
/com.apple.mDNSResponder.plist \
435 /Library
/Preferences
/SystemConfiguration
/NetworkInterfaces.plist \
436 /Library
/Preferences
/SystemConfiguration
/preferences.plist \
439 if [ -e "${f}" ]; then
441 cat "${f}" > "${b}" 2>&1
445 if [ -e /etc
/resolv.conf
]; then
446 cat /etc
/resolv.conf
> etc
-resolv-conf.txt
2>&1
448 if [ -e /var
/run
/resolv.conf
]; then
449 cat /var
/run
/resolv.conf
> var
-run-resolv-conf.txt
2>&1
451 if [ -e /etc
/resolver
]; then
452 tar -c -H /etc
/resolver
> etc
-resolver.
tar 2>/dev
/null
459 collect_vpn_logs
() {
463 /var
/log
/racoon.log \
466 if [ -e "${f}" ]; then
468 ${PRIV} cat "${f}" > "${b}".txt
2>&1
478 if [ ! -x /usr
/local
/bin
/neutil
]; then
484 echo "# neutil policy dump" >> necp.txt
486 /usr
/local
/bin
/neutil policy dump
>> necp.txt
2>&1
488 echo "#" > network
-agents.txt
489 echo "# neutil agent dump" >> network
-agents.txt
490 echo "#" >> network
-agents.txt
491 /usr
/local
/bin
/neutil agent dump
>> network
-agents.txt
2>&1
493 # Generates a default-level log message containing the current file handles that UserEventAgent has
494 /usr
/local
/bin
/neutil session log
-file-handles
502 run_network_test
() {
504 if [ ! -x /usr
/local
/bin
/network_test
]; then
508 /usr
/local
/bin
/network_test path_watcher
> nw_path.txt
2>&1
513 # Network, DNS, Proxy, Reachability, Cache information
517 if [ ! -x /usr
/sbin
/scutil
]; then
521 echo "#" > network
-information.txt
522 echo "# scutil -d -v --nwi" >> network
-information.txt
523 echo "#" >> network
-information.txt
524 /usr
/sbin
/scutil
-d -v --nwi >> network
-information.txt
2>&1
527 echo "" >> network
-information.txt
528 echo "#" >> network
-information.txt
529 echo "# scutil --nwi ${if}" >> network
-information.txt
530 echo "#" >> network
-information.txt
531 scutil
--nwi ${if} >> network
-information.txt
2>&1
534 echo "#" > dns
-configuration.txt
535 echo "# scutil -d -v --dns" >> dns
-configuration.txt
536 echo "#" >> dns
-configuration.txt
537 /usr
/sbin
/scutil
-d -v --dns >> dns
-configuration.txt
2>&1
539 echo "#" > proxy
-configuration.txt
540 echo "# scutil -d -v --proxy" >> proxy
-configuration.txt
541 echo "#" >> proxy
-configuration.txt
542 /usr
/sbin
/scutil
-d -v --proxy >> proxy
-configuration.txt
2>&1
544 echo "#" > reachability
-info.txt
545 echo '# scutil -d -v -r www.apple.com' >> reachability
-info.txt
546 echo "#" >> reachability
-info.txt
547 /usr
/sbin
/scutil
-d -v -r www.apple.com
>> reachability
-info.txt
2>&1
549 echo "#" >> reachability
-info.txt
550 echo '# scutil -d -v -r 0.0.0.0' >> reachability
-info.txt
551 echo "#" >> reachability
-info.txt
552 /usr
/sbin
/scutil
-d -v -r 0.0.0.0 >> reachability
-info.txt
2>&1
554 echo "#" >> reachability
-info.txt
555 echo '# scutil -d -v -r 169.254.0.0' >> reachability
-info.txt
556 echo "#" >> reachability
-info.txt
557 /usr
/sbin
/scutil
-d -v -r 169.254.0.0 >> reachability
-info.txt
2>&1
559 echo "#" > nc
-info.txt
560 echo '# scutil --nc list' >> nc
-info.txt
561 echo "#" >> nc
-info.txt
562 /usr
/sbin
/scutil
--nc list
>> nc
-info.txt
2>&1
564 /usr
/sbin
/scutil
-p --snapshot SCDynamicStore.plist
2>&1
573 if [ ! -x /sbin
/route
]; then
577 echo "#" > route
-info.txt
578 echo '# route -n -v get www.apple.com' >> route
-info.txt
579 echo "#" >> route
-info.txt
580 /sbin
/route
-n -v get www.apple.com
>> route
-info.txt
2>&1
582 echo "#" >> route
-info.txt
583 echo '# route -n -v get 0.0.0.0' >> route
-info.txt
584 echo "#" >> route
-info.txt
585 /sbin
/route
-n -v get
0.0.0.0 >> route
-info.txt
2>&1
594 if [ ! -x /usr
/bin
/dig -o ! -f /etc
/resolv.conf
]; then
598 echo "#" > dig-info.txt
599 echo '# dig -t any -c any www.apple.com' >> dig-info.txt
600 echo "#" >> dig-info.txt
601 /usr
/bin
/dig +time=2 -t any
-c any www.apple.com
>> dig-info.txt
2>/dev
/null
610 if [ ! -x /bin
/hostname
]; then
614 /bin
/hostname
> hostname.txt
2>&1
623 if [ ! -x /usr
/sbin
/lsof
]; then
627 ${PRIV} /usr
/sbin
/lsof
-i -n -O -P -T q
> lsof.txt
2>&1 &
629 # start a watchdog for lsof
632 while [ $WAIT_TIME -gt 0 ]
634 ${PRIV} kill -0 ${LSOF_PID} 2>/dev
/null
635 if [ $?
-eq 0 ]; then
636 # lsof is [still] gathering data...
638 WAIT_TIME
=$((WAIT_TIME - 1))
642 # lsof completed gathering data
646 if [ $WAIT_TIME -eq 0 ]; then
648 ${PRIV} kill ${LSOF_PID} 2>/dev
/null
656 # collect a packet capture if netdiagnose is available
658 if [ -x /usr
/local
/bin
/netdiagnose
]; then
659 trap stop_pcap SIGINT
660 /usr
/local
/bin
/netdiagnose
-p "${REQUESTED_OUTDIR}" start sysdiagpcap
2>&1 1>/dev
/null
666 if [ ${PCAP_STARTED} -ne 0 ]; then
668 /usr
/local
/bin
/netdiagnose stop sysdiagpcap
2>&1 1>/dev
/null
672 collect_ndf_info
() {
676 collect_sensitive_info
() {
678 if [ "${COLLECT_PCAP}" == "Y" ]; then
682 collect_state_dump_sensitive
692 if [ "${COLLECT_NDF_INFO}" == "Y" ]; then
696 if [ "${COLLECT_SENSITIVE_INFO}" == "Y" ]; then
697 collect_sensitive_info
711 if [ "${COLLECT_CONFIGURATION_FILES}" == "Y" ]; then
712 collect_configuration_files
718 # __COMMAND_ROUTINES_END__
720 # __HELPER_ROUTINES_BEGIN__
724 echo "Usage: get-network-info [-c] [-n] [-s] <info-directory>"
725 echo " -c collects system configuration files"
726 echo " -n collects NDF information (lsof)"
727 echo " -P do not collect a packet capture"
728 echo " -s collects sensitive information (ARP/NDP/mDNS cache)"
729 echo " <info-directory> path to directory where all the information will be collected"
735 if [ "${REQUESTED_OUTDIR}" = "" ]; then
740 if [ ! -d ${REQUESTED_OUTDIR} ]; then
741 echo "${REQUESTED_OUTDIR} does not exist"
745 if [ ! -w ${REQUESTED_OUTDIR} ]; then
746 echo "${REQUESTED_OUTDIR} is write-protected"
752 # Collect most used command output to be used later
756 if [ ! -x /sbin
/ifconfig
]; then
760 IF_LIST
=`/sbin/ifconfig -l`
766 COLLECT_SENSITIVE_INFO
=""
767 COLLECT_CONFIGURATION_FILES
=""
773 # __HELPER_ROUTINES_END__
778 ARGS
=`getopt cnPs $*`