Network + TLS diagnostics

v0.3.2

DNS lookups, reachability probes, TLS certificate inspection, and HTTP timing tests. All read-only. Use for "is X reachable?" and "what's the cert expiry on Y?" questions.

14 allowed by default

Pack ID

network-tls

Vendor

emisar

linux

Actions

Required binaries. Install these on the host before relying on the pack. An action that calls a missing binary fails at run time.


              bash


              curl

dig

jq

mtr

nc


              openssl


              ping


              whois

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below before copying it into the runner's packs dir. That hash covers the exact bytes this page was built from, so a tampered copy is rejected. The command reloads a running daemon itself, so you don't need to restart it manually.

on the runner host

sudo emisar pack install network-tls --hash sha256:8e099cfbde7db768cc14fb16e324a131964138974e65907be30a7903fe5bce9b

Setup

Probes the remote host, endpoint, or domain you pass as an action argument (host:port / name / URL) from the runner — no host-side credentials, but the runner needs outbound network reach to the target.

Host access

Run these commands yourself on the runner host. Emisar shows and copies setup recipes; it never runs them.

Open raw ICMP sockets with CAP_NET_RAW.

net.traceroute_mtrnet.ping_extended

Grant CAP_NET_RAW to the Emisar service

Grant access

sudo install -d -m 0755 /etc/systemd/system/emisar.service.d
printf '%s\n' '[Service]' 'AmbientCapabilities=CAP_NET_RAW' | sudo tee /etc/systemd/system/emisar.service.d/10-network-tls-host-access.conf >/dev/null
sudo systemctl daemon-reload
sudo systemctl restart emisar

Verify access

systemctl show emisar --property=AmbientCapabilities --value | grep -Fwi cap_net_raw

Impact: Every Emisar action on this runner inherits CAP_NET_RAW and can open raw sockets — sending crafted packets and reading traffic on this host's interfaces — well beyond mtr and ping.

Notes

DNS/whois/ipinfo go to public resolvers and services; reachability and TLS probes need a network path from the runner to the target, so firewalls or egress rules can block them.

Verify it works

Runs net.tls_cert_expiry, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host

sudo emisar pack verify network-tls

Install and configure a pack walks through the whole sequence on a host.

Actions 14 total

View on GitHub

net.dig_dnssec exec low

dig +dnssec (DNSSEC validation)

Issue a DNSSEC-validating query. Returns RRSIG records and the AD (authenticated-data) flag if validation succeeded.
View source on GitHub
net.dig_record exec low

dig (DNS lookup)

`dig +short <type> <name> @<resolver>` — look up one DNS record. Type defaults to A; specify AAAA, MX, NS, TXT, CNAME, SRV. Resolver defaults to system default.
View source on GitHub
net.dig_reverse exec low

dig -x (reverse DNS)

Look up the reverse PTR record for an IPv4 or IPv6 address (`dig -x <ip>`).
View source on GitHub
net.dig_trace exec low

dig +trace (full delegation chain)

Trace the DNS delegation chain from the root to the authoritative server (`dig +trace`). Use to debug "the wrong nameservers are answering."
View source on GitHub
net.http_headers script low

HTTP response headers (curl -I)

Dump response headers from a URL, following redirects. Use to confirm cache-control / hsts / set-cookie / cors setup. Set insecure=true to skip TLS verification for an internal or self-signed certificate. An optional resolve mapping selects one IP for the URL's exact hostname and port while preserving Host, SNI, and certificate verification. Redirects keep that mapping only for the same hostname and port; other destinations use normal DNS. A mapping bypasses proxies for the whole redirect chain; without it, normal proxy settings apply.
View source on GitHub
net.http_probe script low

HTTP probe with timing

Probe a URL with curl, returning HTTP status, DNS / TCP / TLS / total timings, and bytes transferred. Use as a synthetic check. Set insecure=true to skip TLS verification when the endpoint serves an internal or self-signed certificate (otherwise such a probe reports http_code=000). HTTP 4xx and 5xx responses are successful probe executions: the status is the evidence, not a reason to repeat the same request. A DNS, connection, or TLS failure exits unsuccessfully with curl's diagnostic; do not retry it unchanged unless the target may have recovered. An optional resolve mapping selects one destination IP for the URL's exact hostname and port, without changing Host, SNI, or certificate verification. A mapping bypasses proxies for this request; without it, normal proxy and DNS settings apply. This probe does not follow redirects.
View source on GitHub
net.ipinfo_lookup exec low

ipinfo (geo + ASN for an IP)

Look up an IP at ipinfo.io. Returns city/region/country/org/asn. Outbound HTTP to ipinfo.io required.
View source on GitHub
net.ping_extended exec low

ping (with count + timeout)

Send N ICMP echo requests with explicit per-probe timeout. Needs CAP_NET_RAW on the runner identity where the host does not open `net.ipv4.ping_group_range`: ping ships setuid or file-capability elevation, and the runner's `no_new_privs` blocks both, so grant the capability from this pack's setup before enabling the action.
View source on GitHub
net.tcp_probe script low

Probe one TCP port

Attempt one bounded TCP connection from the runner to a host and port. A successful handshake proves TCP reachability only; it does not validate an application protocol, TLS, authentication, or service health.
View source on GitHub
net.tls_cert_expiry script low

TLS cert expiry probe

Connect to host:port with SNI and show certificate subject, issuer, notBefore, and notAfter. Connection, DNS, plaintext, and handshake failures retain the OpenSSL diagnostic instead of being reported as a certificate parse error. Accept a DNS name, IPv4 address, or bare IPv6 address. A separate DNS SNI name can select a virtual host. This inspects the presented certificate; it does not verify its trust chain or hostname. Use for "when does this cert expire?" alerts.
View source on GitHub
net.tls_chain_dump exec low

TLS chain dump

Dump the full certificate chain a server returns. Use to debug "browsers see incomplete chain" errors.
View source on GitHub
net.tls_protocol_check script low

TLS protocol support check

Probe TLS 1.0/1.1/1.2/1.3 on host:port one at a time. OK means this probe completed a handshake; REFUSED means it did not, which can also reflect cipher, signature or client-certificate policy. UNSUPPORTED-BY-CLIENT leaves the server's support unknown. Fails when the target cannot be reached. Ignores the system MinProtocol floor and lowers the OpenSSL security level only for the 1.0/1.1 probes. Does not verify certificate trust.
View source on GitHub
net.traceroute_mtr exec low

mtr report (route + loss statistics)

Trace the network path to a host with per-hop packet loss and latency (`mtr --report`, 5 cycles) — the combined traceroute + ping report. Needs CAP_NET_RAW on the runner identity: mtr ships setuid or file-capability elevation, and the runner's `no_new_privs` blocks both, so grant the capability from this pack's setup before enabling the action.
View source on GitHub
net.whois_summary script low

Domain registration summary

Show registrar, dates and nameservers from WHOIS, falling back to RDAP when WHOIS fails or has no recognized fields. RDAP uses IANA's DNS bootstrap and returns only registrar names/IDs, domain events and nameserver names, not contact records. Accepts ASCII or punycode domain names. Bounds each response to 16 MiB and clips the rendered summary at 8 KiB with a notice. A failed or missing lookup does not establish that a domain is available to register.
View source on GitHub

← Back to registry

Pack reference Publish your own