Function do_dns_doctor

network_diagnostics.py:1085–1121

Resolve `name` through every system resolver plus public 1.1.1.1 / 8.8.8.8, reporting per-resolver answers, query latency and the DNSSEC AD flag, whether the resolvers agree (split-DNS / hijack smell), and DoH/DoT reachability.

(name)

    try:
        return int(mac[0:2], 16)
    except (ValueError, TypeError):
        return None


def _is_laa(mac):
    """True if the locally-administered (privacy/spoof) bit is set."""
    b0 = _mac_first_octet(mac)
    return b0 is not None and bool(b0 & 0x02)


def _is_universal_prefix(oui):
    """True if a 6-hex OUI could be a legitimately-registered (LAA-clear) OUI.
    Filters junk out of the vendor table so an LAA/randomization range in a full
    manuf file can't be mistaken for a real vendor by the spoof check."""
    try:
        b0 = int(oui[0:2], 16)
    except (ValueError, TypeError, IndexError):
        return False
    return not (b0 & 0x02) and not (b0 & 0x01)


def _load_oui_db():
    """Load {6-hex-prefix: vendor} from the arp-scan / nmap OUI DB if present,
    merged over the built-in seed. Universal prefixes only; cached."""
    global _oui_db_cache
    if _oui_db_cache is not None:
        return _oui_db_cache
    with _oui_db_lock:
        if _oui_db_cache is not None:
            return _oui_db_cache
        db = {}
        for oui, vendor in _MAC_VENDOR_SEED.items():
            db[oui.replace(':', '')] = vendor
        for path in _OUI_DB_PATHS:
            try:
                with open(path, encoding='utf-8', errors='replace') as f:
                    for line in f:
                        line = line.strip()
                        if not line or line.startswith('#'):
                            continue