@samitouri / QOSAMI-WSL-2 / commits / 2aedc74c

wip address cr

Catalin-Emil Fetoiu committed Aug 24, 2023 at 17:02 UTC 2aedc74cb8d2d2758fa58f58148c973953617bb2
4 files changed +105 -94
diagnostics/networking.bat deleted
-57
@@ -1,57 +0,0 @@
1 -@echo off
2 -:: Note: This script terminates WSL. Save your work before running it.
3 -
4 -:: Check for administrator privileges.
5 -net session >nul 2>&1 || goto :admin
6 -
7 -:: Validate that required files are here.
8 -if not exist wsl_networking.wprp (echo wsl_networking.wprp not found && exit /b 1)
9 -if not exist networking.sh (echo networking.sh not found && exit /b 1)
10 -
11 -:: Capture the store WSL version
12 -echo "WSL version (Might be help text if store WSL is not installed):"
13 -wsl.exe --version
14 -
15 -:: List installed Windows features.
16 -echo Windows features:
17 -powershell.exe -NoProfile "Get-WindowsOptionalFeature -Online | ? State -eq Enabled | select FeatureName"
18 -
19 -:: List all HNS objects.
20 -echo HNS objects:
21 -hnsdiag list all -df
22 -
23 -:: Print the Windows routing table.
24 -echo Routing table:
25 -netstat.exe -rn
26 -
27 -:: The WSL HNS network is created once per boot. Resetting it to collect network creation logs.
28 -echo Deleting HNS network
29 -powershell.exe -NoProfile "Get-HnsNetwork | Where-Object {$_.Name -eq 'WSL'} | Remove-HnsNetwork"
30 -
31 -:: Stop WSL.
32 -net.exe stop WslService || net.exe stop LxssManager
33 -
34 -:: Start packet capture.
35 -powershell.exe -NoProfile "New-NetEventSession HnsPacketCapture -CaptureMode SaveToFile -LocalFilePath %cd%\\packets.etl" || goto :fail
36 -powershell.exe -NoProfile "Add-NetEventPacketCaptureProvider -Level 5 -SessionName HnsPacketCapture -CaptureType BothPhysicalAndSwitch " || goto :fail
37 -powershell.exe -NoProfile "Start-NetEventSession HnsPacketCapture" || goto :fail
38 -
39 -:: Collect WSL logs.
40 -wpr -start wsl_networking.wprp -filemode || goto :fail
41 -wsl.exe tr -d "\r" ^| bash < ./networking.sh
42 -
43 -wpr -stop wsl.etl || goto :fail
44 -powershell -NoProfile "Stop-NetEventSession HnsPacketCapture; Remove-NetEventSession HnsPacketCapture" || goto :fail
45 -
46 -exit /b 0
47 -
48 -:: Error message if the WSL logs fail to collect.
49 -:fail
50 -echo Failed to collect WSL logs.
51 -powershell -NoProfile "Stop-NetEventSession HnsPacketCapture; Remove-NetEventSession HnsPacketCapture"
52 -exit /b 1
53 -
54 -:: Error message if the user does not have administrative privileges.
55 -:admin
56 -echo This script needs to run with administrative privileges.
57 -exit /b 1
diagnostics/networking.sh
-25
@@ -1,10 +1,4 @@
1 #! /bin/bash
2 -if (($(id -u) != 0))
3 -then
4 - printf "If you see 'ping: socket: Operation not permitted' errors, "
5 - printf "run this command as root.\n"
6 -fi
7 -
2 set -xu
3
4 # Gather distro & kernel info.
@@ -17,24 +11,5 @@ ip route show table all
11 ip neighbor
12 ip link
13
20 -# Validate that the gateway is responsive and can route ICMP correctly.
21 -if gateway=$(ip route show | awk '/default/ { print $3 }'); then
22 - ping -c 4 "$gateway"
23 -else
24 - echo 'No gateway found.'
25 -fi
26 -
27 -ping -c 4 1.1.1.1
28 -
29 -# Validate that the default route is working (won't work if traceroute isn't installed).
30 -traceroute 1.1.1.1
31 -
14 # Display the DNS configuration.
15 cat /etc/resolv.conf
34 -
35 -# Validate that everything is functioning correctly.
36 -if type curl >/dev/null 2>&1; then
37 - curl -m 5 -v https://microsoft.com
38 -else
39 - wget -T 5 -v https://microsoft.com
40 -fi
diagnostics/networking_diagnostics.bat
+35 -12
@@ -1,13 +1,31 @@
1 +:: Check for administrator privileges.
2 +net session >nul 2>&1 || goto :admin
3 +
4 +:: Validate that required files are here.
5 +if not exist wsl_networking.wprp (echo wsl_networking.wprp not found && exit /b 1)
6 +if not exist networking.sh (echo networking.sh not found && exit /b 1)
7 +
8 set networking_folder=".\networking_logs"
9 set neworking_logs_zip=".\WslNetworkingLogs.zip"
10
11 mkdir %networking_folder%
12
6 -wsl.exe tr -d "\r" ^| bash < ./networking.sh > %networking_folder%\wsl_network_configuration_before.log
7 -powershell Get-NetRoute > %networking_folder%\get_netroute.log
13 +cd %networking_folder%
14 +
15 +IF "%1"=="--stop-wsl" (
16 + :: The WSL HNS network is created once per boot. Resetting it to collect network creation logs.
17 + echo Deleting HNS network
18 + powershell.exe -NoProfile "Get-HnsNetwork | Where-Object {$_.Name -eq 'WSL'} | Remove-HnsNetwork"
19 +
20 + :: Stop WSL.
21 + net.exe stop WslService || net.exe stop LxssManager
22 +)
23
9 -powershell invoke-expression 'cmd /c start powershell -Command { .\collect-wsl-logs.ps1 }'
10 -powershell invoke-expression 'cmd /c start powershell -Command { "wsl.exe sudo tcpdump -n -i any > tcpdump.log" }'
24 +wsl.exe tr -d "\r" ^| bash < ../networking.sh > wsl_network_configuration_before.log
25 +powershell Get-NetRoute > get_netroute.log
26 +
27 +powershell invoke-expression 'cmd /c start powershell -Command { ..\collect-wsl-logs.ps1 }'
28 +powershell invoke-expression 'cmd /c start powershell -Command { "wsl.exe -u root sudo tcpdump -n -i any > tcpdump.log" }'
29
30 wpr -start .\wsl_networking.wprp -filemode -instanceName wpr_networking
31 pktmon start -c --flags 0x1A
@@ -16,22 +34,27 @@ netsh wfp capture start
34 pause
35
36 :: allow some time for the user to stop logs in all the spawned shells
19 -:: (particularly the shell running collect-wsl-logs.ps1 will take a bit to stop)
37 timeout 20
38
39 netsh wfp capture stop
40 pktmon stop
24 -wpr -stop %networking_folder%\wsl_networking.etl -instanceName wpr_networking
41 +wpr -stop wsl_networking.etl -instanceName wpr_networking
42
26 -wsl.exe tr -d "\r" ^| bash < ./networking.sh > %networking_folder%\wsl_network_configuration_after.log
43 +wsl.exe tr -d "\r" ^| bash < ../networking.sh > wsl_network_configuration_after.log
44
28 -move tcpdump.log %networking_folder%
29 -move PktMon.etl %networking_folder%
30 -move wfpdiag.cab %networking_folder%
31 -move "*zip" %networking_folder%
45 +cd ..
46
47 +del %neworking_logs_zip%
48 powershell Compress-Archive -Path %networking_folder% -DestinationPath %neworking_logs_zip%
49
50 rmdir /s /q %networking_folder%
51
37 -echo "Finished log collection"
\ No newline at end of file
52 +echo "Finished log collection - please collect the zip archive from the path below"
53 +powershell Resolve-Path %neworking_logs_zip%
54 +
55 +exit /b 0
56 +
57 +:: Error message if the user does not have administrative privileges.
58 +:admin
59 +echo This script needs to run with administrative privileges.
60 +exit /b 1
\ No newline at end of file
diagnostics/wsl_networking.wprp
+70
@@ -9,17 +9,62 @@
9 <EventProvider Id="lxcore_kernel" Name="0CD1C309-0878-4515-83DB-749843B3F5C9"/>
10 <EventProvider Id="lxcore_user" Name="D90B9468-67F0-5B3B-42CC-82AC81FFD960"/>
11 <EventProvider Id="lxcore_service" Name="B99CDB5A-039C-5046-E672-1A0DE0A40211"/>
12 + <EventProvider Id="wsl_devicehost" Name="9d6c7b9e-2581-4d8a-b8c5-b90b4a17094a"/>
13 + <EventProvider Id="wslclient" Name="8cbb7724-7223-5d6f-8137-564dac45104d"/>
14 <EventProvider Id="vm_chipset" Name="de9ba731-7f33-4f44-98c9-6cac856b9f83"/>
15 <EventProvider Id="vmcompute_dll" Name="AF7FD3A7-B248-460C-A9F5-FEC39EF8468C"/>
16 <EventProvider Id="vmcompute" Name="17103E3F-3C6E-4677-BB17-3B267EB5BE57"/>
17 <EventProvider Id="vmmm" Name="6066F867-7CA1-4418-85FD-36E3F9C0600C"/>
18 <EventProvider Id="vmwp" Name="51DDFA29-D5C8-4803-BE4B-2ECB715570FE"/>
19 <EventProvider Id="9p" Name="e13c8d52-b153-571f-78c5-1d4098af2a1e"/>
20 + <EventProvider Id="9p_errors" Name="06C601B3-6957-4F8C-A15F-74875B24429D" />
21 <EventProvider Id="p9rdr" Name="bb1d36f0-e0e0-48cc-9493-fef0e3d0b28c" />
22 <EventProvider Id="mup" Name="20c46239-d059-4214-a11e-7d6769cbe020" />
23 <EventProvider Id="rfsmon" Name="51734B23-5B7E-4892-BA8E-45BC110B735C" />
24 <EventProvider Id="hyperv_storage" Name="c7ad62c6-5c99-5a1b-bbc4-0821ae5b765e" />
25 <EventProvider Id="hns" Name="0c885e0d-6eb6-476c-a048-2457eed3a5c1" />
26 + <EventProvider Id="netmgmt" Name="93f693dc-9163-4dee-af64-d855218af242" />
27 + <EventProvider Id="EventProvider_Microsoft.Windows.Mobile.Provisioning.AppDownload" Name="0BBE6221-EF09-4A3F-82EE-BE00DBB6A98A" />
28 + <EventProvider Id="EventProvider_Microsoft.Windows.Mobile.Provisioning.Datastore" Name="42C60CEA-0FE7-4541-A86B-9E11F95BD9BF" />
29 + <EventProvider Id="EventProvider_Microsoft.Windows.Mobile.Provisioning.PhoneProvisioner" Name="B876B1FC-C7F1-443E-9012-86677F7DE580" />
30 + <EventProvider Id="EventProvider_Microsoft.Windows.Mobile.Provisioning.PPOEM" Name="7EDBED09-1FF7-4FEE-B8C3-5DB694420830" />
31 + <EventProvider Id="EventProvider_Microsoft.Windows.Provisioning.API" Name="82ADD491-01D7-4B85-9EAD-192C3CAACA23" />
32 + <EventProvider Id="EventProvider_Microsoft.Windows.Provisioning.CSP" Name="16E12400-A2D8-44B7-9479-004568EC7819" />
33 + <EventProvider Id="EventProvider_Microsoft.Windows.Provisioning.Engine" Name="A6A847B7-4429-49AA-BBA6-2AD8C191AC8C" />
34 + <EventProvider Id="EventProvider_Microsoft.Windows.Provisioning.Handlers" Name="0383D92C-2337-4F25-A0B5-A51767F04746" />
35 + <EventProvider Id="EventProvider_Microsoft.Windows.Provisioning.Migration" Name="A0AF985E-83F9-4E1A-B658-338DCFE27893" />
36 + <EventProvider Id="EventProvider_Microsoft.Windows.Provisioning.Operations" Name="7F99598F-B2C1-4371-9911-63DEE13B9EB1" />
37 + <EventProvider Id="EventProvider_Microsoft.Windows.Provisioning.Platform" Name="B1F30020-8BC3-4888-BB1B-4DD681F24209" />
38 + <EventProvider Id="EventProvider_Microsoft.Windows.Provisioning.Plugin.Engine" Name="55239D60-0EB6-495B-874E-15DE5D5F9A70" />
39 + <EventProvider Id="EventProvider_Microsoft.Windows.Provisioning.Plugin.RemovableMedia" Name="B55883E6-6C45-45C2-AB9D-800BB7B66B13" />
40 + <EventProvider Id="EventProvider_Microsoft.Windows.Provisioning.ProvTool" Name="2BF4B6BA-556E-4D05-8534-CAFEDF19FED8" />
41 + <EventProvider Id="EventProvider_Microsoft.Windows.Provisioning.CommandCsp" Name="00BB69FC-60BC-4502-9438-25608F375CCB" />
42 + <EventProvider Id="EventProvider_Microsoft.Windows.Provisioning.ProvLaunch" Name="08FACCFA-125D-4ED6-B0B7-B4A1A912E693" />
43 + <EventProvider Id="EventProvider_Microsoft.Windows.EMPS.Enrollment" Name="E74EFD1A-B62D-4B83-AB00-66F4A166A2D3" />
44 + <EventProvider Id="EventProvider_Microsoft.Windows.EnterpriseManagement.Enrollment" Name="F9E3B648-9AF1-4DC3-9A8E-BF42C0FBCE9A" />
45 + <EventProvider Id="virtdisk_wpp" Name="e14dcdd9-d1ec-4dc3-8395-a606df8ef115" Level="4">
46 + <Keywords>
47 + <Keyword Value="0xFFFFFFFFFFFFFFFF" />
48 + </Keywords>
49 + </EventProvider>
50 +
51 + <EventProvider Id="virtdisk" Name="4D20DF22-E177-4514-A369-F1759FEEDEB3" Level="4">
52 + <Keywords>
53 + <Keyword Value="0xFFFFFFFFFFFFFFFF" />
54 + </Keywords>
55 + </EventProvider>
56 +
57 + <EventProvider Id="vhdmp" Name="E2816346-87F4-4F85-95C3-0C79409AA89D" NonPagedMemory="true" Level="4">
58 + <Keywords>
59 + <Keyword Value="0xFFFFFFFFFFFFFFFD" />
60 + </Keywords>
61 + </EventProvider>
62 +
63 + <EventProvider Id="vhdmp_wpp" Name="3c70c3b0-2fae-41d3-b68d-8f7fcaf79adb" NonPagedMemory="true" Level="5">
64 + <Keywords>
65 + <Keyword Value="0xFFFFFFFFFFFFFFFF" />
66 + </Keywords>
67 + </EventProvider>
68 <EventProvider Id="LsaAudit_WPP" Name="DAA76F6A-2D11-4399-A646-1D62B7380F15" />
69 <EventProvider Id="Microsoft_Windows_ResourceManager_WPP" Name="4180C4F7-E238-5519-338F-EC214F0B49AA" />
70 <EventProvider Id="Microsoft_Windows_Security_NGC_KeyCredMgr_WPP" Name="34646397-1635-5D14-4D2C-2FEBDCCCF5E9" />
@@ -170,17 +215,42 @@
215 <EventProviderId Value="lxcore_kernel"/>
216 <EventProviderId Value="lxcore_user"/>
217 <EventProviderId Value="lxcore_service"/>
218 + <EventProviderId Value="wsl_devicehost"/>
219 + <EventProviderId Value="wslclient"/>
220 <EventProviderId Value="vm_chipset"/>
221 <EventProviderId Value="vmcompute_dll"/>
222 <EventProviderId Value="vmcompute"/>
223 <EventProviderId Value="vmmm"/>
224 <EventProviderId Value="vmwp"/>
225 <EventProviderId Value="9p"/>
226 + <EventProviderId Value="9p_errors"/>
227 <EventProviderId Value="p9rdr"/>
228 <EventProviderId Value="mup"/>
229 <EventProviderId Value="rfsmon"/>
230 <EventProviderId Value="hyperv_storage"/>
231 <EventProviderId Value="hns"/>
232 + <EventProviderId Value="netmgmt"/>
233 + <EventProviderId Value="EventProvider_Microsoft.Windows.Mobile.Provisioning.AppDownload"/>
234 + <EventProviderId Value="EventProvider_Microsoft.Windows.Mobile.Provisioning.Datastore"/>
235 + <EventProviderId Value="EventProvider_Microsoft.Windows.Mobile.Provisioning.PhoneProvisioner"/>
236 + <EventProviderId Value="EventProvider_Microsoft.Windows.Mobile.Provisioning.PPOEM"/>
237 + <EventProviderId Value="EventProvider_Microsoft.Windows.Provisioning.CSP"/>
238 + <EventProviderId Value="EventProvider_Microsoft.Windows.Provisioning.Engine"/>
239 + <EventProviderId Value="EventProvider_Microsoft.Windows.Provisioning.Migration"/>
240 + <EventProviderId Value="EventProvider_Microsoft.Windows.Provisioning.Platform"/>
241 + <EventProviderId Value="EventProvider_Microsoft.Windows.Provisioning.Operations"/>
242 + <EventProviderId Value="EventProvider_Microsoft.Windows.Provisioning.Plugin.Engine"/>
243 + <EventProviderId Value="EventProvider_Microsoft.Windows.Provisioning.Plugin.RemovableMedia"/>
244 + <EventProviderId Value="EventProvider_Microsoft.Windows.Provisioning.ProvTool"/>
245 + <EventProviderId Value="EventProvider_Microsoft.Windows.Provisioning.Operations"/>
246 + <EventProviderId Value="EventProvider_Microsoft.Windows.Provisioning.CommandCsp"/>
247 + <EventProviderId Value="EventProvider_Microsoft.Windows.Provisioning.ProvLaunch"/>
248 + <EventProviderId Value="EventProvider_Microsoft.Windows.EMPS.Enrollment"/>
249 + <EventProviderId Value="EventProvider_Microsoft.Windows.EnterpriseManagement.Enrollment"/>
250 + <EventProviderId Value="virtdisk"/>
251 + <EventProviderId Value="virtdisk_wpp"/>
252 + <EventProviderId Value="vhdmp"/>
253 + <EventProviderId Value="vhdmp_wpp"/>
254 <EventProviderId Value="LsaAudit_WPP"/>
255 <EventProviderId Value="Microsoft_Windows_ResourceManager_WPP"/>
256 <EventProviderId Value="Microsoft_Windows_Security_NGC_KeyCredMgr_WPP"/>