Network Interfaces
Overview
Evidence: Network Interfaces
Description: Collect Network Interfaces
Category: Network
Platform: macos
Short Name: netint
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
macOS network interface information provides details about adapters, IP addresses, and configuration. This data is essential for understanding connectivity, detecting unauthorized network access, and investigating network incidents.
Data Collected
This collector gathers structured data about network interfaces.
Network Interfaces Data
| Field | Description | Example |
|---|---|---|
Interface | Interface | Example value |
Address | Address | Example value |
Mask | Mask | Example value |
Broadcast | Broadcast | Example value |
PointToPoint | Point To Point | Example value |
Type | Type | Example value |
Collection Method
This collector queries the interface_addresses table via osquery and records results into the network_interfaces table.
Forensic Value
This evidence is crucial for forensic investigations as it reveals interface configuration, aiding detection of rogue interfaces, unusual addressing, and network misconfigurations.