Analysis to collect IP, MAC Address, and DHCP Status for Mac Computers

Content Authoring
1

Hi,

I’m trying to write an analysis that’ll report the IP Address, MAC Address, and DHCP Status for my Macs. All of the Macs have multiple network adapters, but only the Ethernet (en0) is in use. I can’t get my relevance to determine if the primary network connection is a DHCP client or not. The result column shows them all as “undefined.” The whole point of the analysis is to find those with static IPs and convert them to DHCP. Here’s my DHCP relevance:

exists (dhcp enableds of adapters of network)

Where am I going wrong?

Thanks in advance.

2

I suspect a couple of things
a typo with in enabled

But the docs suggest this isn’t availble on Mac platform
https://support.bigfix.com/inspectors/Networking%20Objects_Any.html#network%20adapter

3

It seems like most of what you are looking for is available in the following analysis already:

Network Information (Mac OS X)

The DHCP part is missing, and as @gearoid points out, that particular inspector is not available.

You should still be able to find DHCP info by examining a plist or perhaps ioreg for the information you are looking for.

4

That’s a drag. So much for IEM in this round… Thanks for the info!

5

If you can get the information you are looking for on the command line, then you can have a task that would dump that info to a file, then you can read that through relevance.

Better yet would be if there is a location in a file somewhere that could be read to get this information.

There are definitely ways to work around a missing inspector.

6

I’m trying to figure out how to loop through the XML file. There’s a hierarchy to it (of course), and I have NO idea how to go about it. I have this from another thread, but it is not applicable to the file’s layout.

string 3 of array “TB Item Identifiers” of dictionary “NSToolar Configuration SafariToolbarIdentifier” of dictionary of file “/Users/Bob/Library/Preferences/com.apple.Safari.plist”

The file is:
Interface
IPv4>
ConfigMethod
Manual

7

so what is the full path to the file?

8

The file lives at /Library/Preferences/SystemConfiguration/preferences.plist
The keys are Interface/IPv4/ConfigMethod
The string is either Manual or DHCP. I am looking to display either value in the analysis.

Thanks

1 Like
9 
strings "ConfigMethod" of dictionaries "IPv4" of dictionaries of values of entries of dictionaries "NetworkServices" of dictionaries of files "/Library/Preferences/SystemConfiguration/preferences.plist"

This was what I was looking for: (I’m less familiar with where specific prefs or configs are stored on the mac)

Example results:

Q: strings "ConfigMethod" of dictionaries "IPv4" of dictionaries of values of entries of dictionaries "NetworkServices" of dictionaries of files "/Library/Preferences/SystemConfiguration/preferences.plist"
A: DHCP
A: DHCP
A: DHCP
A: Automatic
A: PPP
A: DHCP
T: 3028

This is probably closer to what you really want:

(strings "UserDefinedName" of dictionaries "Interface" of it, strings "Hardware" of dictionaries "Interface" of it, strings "ConfigMethod" of dictionaries "IPv4" of it) of dictionaries whose("Ethernet" = string "Type" of dictionaries "Interface" of it) of values of entries of dictionaries "NetworkServices" of dictionaries of files "/Library/Preferences/SystemConfiguration/preferences.plist"

Example results:

Q: (strings "UserDefinedName" of dictionaries "Interface" of it, strings "Hardware" of dictionaries "Interface" of it, strings "ConfigMethod" of dictionaries "IPv4" of it) of dictionaries whose("Ethernet" = string "Type" of dictionaries "Interface" of it) of values of entries of dictionaries "NetworkServices" of dictionaries of files "/Library/Preferences/SystemConfiguration/preferences.plist" 
A: Bluetooth PAN, Ethernet, DHCP
A: Wi-Fi, AirPort, DHCP
A: Thunderbolt Bridge, Ethernet, DHCP
A: Ethernet, Ethernet, DHCP

(this was written against 10.10.3)

1 Like
10

This is awesome! Thanks. When I put it into the analysis, the return is “multiple results.” Can we get just the Ethernet, Ethernet’s results?

11

You can, though the user defined friendly name may not always be “Ethernet” I believe.

If you hover over “multiple results” with your mouse, it will pop up the actual results. You will also see the full results if you go to the computer summary.

strings "ConfigMethod" of dictionaries "IPv4" of dictionaries whose("Ethernet" is contained by string "UserDefinedName" of dictionaries "Interface" of it) of values of entries of dictionaries "NetworkServices" of dictionaries of files "/Library/Preferences/SystemConfiguration/preferences.plist"
12

This works for reporting back all of the possible configurations, but I have run into a problem when there are multiple “Locations” setup in Network Preferences.

If you look at the previously mentioned PLIST, you will see that there is a way to get just the active information, but I do not have a solid enough understanding of relevance to get it, hoping someone can help. Here are the components, all of them are inside the preferences.plist file.

dictionary “current set” contains the current Locations (with a preceding “/Sets/”).
dictionary “Sets” has the string (minus ‘/Sets’) that is currently active.
inside of of the active set there is a dictionary Service that list more dictionaries with the configuration keys.
the keys are linked to the NetworkServices dictionary.

So using the object “name of primary internet connection” to get the active connection, is there any way to get the current set, look up the services assigned to it, look into the dictionaries matching the service keys, filter the (name of primary internet connection) and get the ConfigMethod strings.

Thanks.

Chris

1 Like
13

Yes, it can be done, but it isn’t easy.

This is all of the DeviceNames of the entries:

strings "DeviceName" of dictionaries "Interface" of dictionaries of values of entries of dictionaries "NetworkServices" of dictionaries of files "/Library/Preferences/SystemConfiguration/preferences.plist"

Here is how you get the “en0” dictionary specifically so that any subkeys can be queried:

dictionaries whose("en0" = string "DeviceName" of dictionary "Interface" of it) of values of entries of dictionaries "NetworkServices" of dictionaries of files "/Library/Preferences/SystemConfiguration/preferences.plist"

Here is how you get that same dictionary, but by first getting the name of the primary internet connection dynamically instead of always getting en0:

dictionaries whose((name of primary internet connection) = string "DeviceName" of dictionary "Interface" of it) of values of entries of dictionaries "NetworkServices" of dictionaries of files "/Library/Preferences/SystemConfiguration/preferences.plist"

It is possible to query the Sets dictionary the same way, by using either the current set or by using name of primary internet connection or both.

This will give the value of the CurrentSet:

(following texts of firsts "/Sets/" of it) of strings "CurrentSet" of dictionaries of files "/Library/Preferences/SystemConfiguration/preferences.plist"

This will give you the dictionaries of all sets so the sub elements can be queried:

dictionaries of values of entries of dictionaries "Sets" of dictionaries of files "/Library/Preferences/SystemConfiguration/preferences.plist"

This will give you only the Set dictionary of the CurrentSet:

dictionaries of values of entries whose((unique value of (following texts of firsts "/Sets/" of it) of strings "CurrentSet" of dictionaries of files "/Library/Preferences/SystemConfiguration/preferences.plist")= key of it) of dictionaries "Sets" of dictionaries of files "/Library/Preferences/SystemConfiguration/preferences.plist"

It is important to note that the following is not so much an error message, as it is warning you that the selected object does not have a direct string representation:

E: The operator "string" is not defined.

It is confusing, but that is what you should see when you select a dictionary directly.

14

Nice, so that is well over half way there. I came up with something close for the listing of the active “Location”, and thanks for the tip on the “string is not defined” error.

keys of dictionary "Service" of dictionary "Network" of dictionary (following text of last "/" of strings "CurrentSet" of dictionaries of files "/Library/Preferences/SystemConfiguration/preferences.plist") of dictionary "Sets" of dictionary of file "/Library/Preferences/SystemConfiguration/preferences.plist"

But now that we have the two pieces (1. all dictionaries from the primary internet connection, 2. all dictionaries from the “CurrentSet”), how would you find the unique dictionary/entry that would be the active internet connection for the “CurrentSet”, and how do you use it if it doesn’t have a direct string representation?

Thanks.
Chris

15

It might help if you tell me what you are looking to get as the result.

Doesn’t the current set match the current primary internet connection? It does on my machine. I’m not certain if it always does or what it means.

16

Yea, so it worked great for me on my desktop also, then I tested it on my laptop and I found the issue.

So if you create a second (or third or fourth) “Location” under the System Preference’s Network pane, you will get more configurations and sets of configurations showing up in the file. That is why I need to find what the current “Set” is (thank you), then only pull the primary internet connection from that set. I’m thinking it may need to be an intersection or something, but I am relatively new to this an still figuring it out.

What I am trying to do is pretty simple. I just want to know if the system is using DHCP or assigning itself a static IP. The only caveat is that I do NOT want to have to run a script to write to a file. Instead I want to only use relevance.

Chris

1 Like
17

Ah, okay. So you need en0 from the current set, assuming en0 is the current connection. I can do that.

It is a bit hard to wrap my head around it when I don’t have a large enough sample size to pull from to understand the need, but I definitely understand it now.

18

Awesome!

It took me a while to wrap my head around it as well. I was looking at trying to solve it three different ways, and ended up on this path, as it seems to be the one that is most dynamic and should require the least number of moving parts.

2 Likes
19

This should be what you are looking for:

entries whose((name of primary internet connection) = key of it) of dictionaries "Interface" of dictionaries "Network" of dictionaries of values of entries whose((unique value of (following texts of firsts "/Sets/" of it) of strings "CurrentSet" of dictionaries of files "/Library/Preferences/SystemConfiguration/preferences.plist")= key of it) of dictionaries "Sets" of dictionaries of files "/Library/Preferences/SystemConfiguration/preferences.plist"
20

Wish it was! Unfortunately it looks like it is looking in the wrong dictionary. I’m closer and will post an update ASAP.