Carbon Black Cloud: Diagnose MacOS Network Issues Using Network Extension Diagnostics

[#1]

Environment

• MacOS: All Supported Versions

Objective

How to Use the Network Extension Diagnostics to diagnose OS or Interoperability issue for MacOS network issues

Resolution

1. Uninstall the sensor if installed.
2. Enable debug-level logging for the content filter framework (OS level) 

   $ sudo sysctl net.cfil.log=7

3. Download the network extension files as provided on the case by Support.
4. Install the diagnostic network extension on a system without the sensor installed.

   $ cd /Applications
   $ unzip diagnostic-ne-20211116.zip

5. Start the diagnostic network extension

   $ ./test-ne.app/Contents/MacOS/test-ne

6. Verify the network extension is enabled

   $ ./test-ne.app/Contents/MacOS/test-ne --status
   Status: test-ne
              - enabled:       Yes
              - socket filter: Enabled
              - packet filter: Enabled
              - grade:         1

7. Attempt to replicate network connectivity or performance issue
   • NOTE: Record if network connectivity issues or performance degradation is seen at this point
8. Disable the data/socket filter

   $ ./test-ne.app/Contents/MacOS/test-ne --disable-socket-filter

9. Verify the data/socket filter is disabled

   $ ./test-ne.app/Contents/MacOS/test-ne --status
   Status: test-ne
              - enabled:       Yes
              - socket filter: Disabled
              - packet filter: Enabled
              - grade:         1

10. Attempt to replicate network connectivity or performance issue
    • NOTE: Record if network connectivity issues or performance degradation is seen at this point
11. Disable the packet filter, this will automatically enable the data/socket filter

    $ ./test-ne.app/Contents/MacOS/test-ne --disable-packet-filter

12. Verify the packet filter is disabled and the data/socket filter is enabled

    $ ./test-ne.app/Contents/MacOS/test-ne --status
    Status: test-ne
               - enabled:       Yes
               - socket filter: Enabled
               - packet filter: Disabled
               - grade:         1

13. Verify network connectivity. At this point if the data/socket filter is the problem, the network connectivity or performance issue should be present
    • NOTE: Record if network connectivity issues or performance degradation is seen at this point
14. Stop the diagnostic network extension

    $ ./test-ne.app/Contents/MacOS/test-ne --stop

15. Remove the diagnostic network extension from the system

    $ rm -r test-ne.app

16. Reset the logging level for the OS level content filter framework

    $ sudo sysctl net.cfil.log=3

17. Perform the following commands, immediately after the above testing, and provide all logs for analysis.

    $ log collect --last 1h --output <path>
    $ system_profiler > sys_profile.log
    $ ifconfig -a > ifconfig.log
    $ systemextensionsctl list > sysext_list.log
    $ ls -al /Applications > app_list.log
    $ ps -eaf > proc_list.log
    $ set > set_list.log

18. Bundle the files and upload them to the CBVault

    $ tar czf diagnostic-files.tar.gz *

Related Content

Carbon Black Cloud: Network is Slow or Disconnects after Sensor Installed on MacOS