Function _nmcli_global_values

network_diagnostics.py:744–760

Collect values for an nmcli field (e.g. IP4.DOMAINS, IP4.DNS) across all devices. nmcli prints repeated keys as `FIELD[1]:value`.

(field)

# single MAC answering for many IPs (one host impersonating the whole subnet).
# The kernel neighbour table is authoritative and needs no capture, so this is
# cheap enough to run on a schedule from the integrity monitor.
# --------------------------------------------------------------------------

_ARP_BASELINE_PATH = os.path.join(os.path.dirname(os.path.abspath(__file__)),
                                  'data', 'arp_baseline.json')
_arp_baseline_lock = threading.Lock()
# A MAC bound to at least this many IPs in the neighbour table is treated as a
# possible impersonator. Proxy-ARP routers can legitimately answer for a few, so
# keep the floor above normal noise.
_ARP_IMPERSONATOR_MIN_IPS = 4


def _neigh_entries(iface=None):
    """Parse `ip -4 neigh` into [(ip, mac, state)] for entries with a lladdr.
    Scoped to one interface's segment when `iface` is given."""
    cmd = ['ip', '-4', 'neigh', 'show']
    if iface:
        cmd += ['dev', iface]
    res = _run(cmd, timeout=5)
    out = []