Changes for Duplicate IP detection script for Rokos

scripts/duplicateIpDetection/DetectDuplicateIpAddr.ps1

@@ -0,0 +1,55 @@
+Write-Host "Detecting duplicate IP addresses on the node..."
+
+$BaseDir = "c:\k\debug"
+
+Write-Host "Trying to load HNS module..."
+
+ipmo $BaseDir\hns.v2.psm1 -Force | Write-Host
+
+$iter = 1
+
+pktmon stop # Stopping if pktmon is already running
+
+# Start pktmon
+Write-Host "Starting pktmon with trace level 6 for HNS"
+pktmon start --trace -p Microsoft-Windows-Host-Network-Service -l 6 -f traces.etl -s 2048
+
+while($true){
+    $ipAddresses = ((Get-HnsEndpoint).IpConfigurations).IpAddress
+
+    Write-Host "Checking for duplicate IP addresses inside the loop..."
+    $duplicateIpAddr = $ipAddresses | Group-Object | Where-Object { $_.Count -gt 1 }
+
+    if($duplicateIpAddr.Count -gt 0){
+        break
+    }
+
+    $iter++
+
+    Start-Sleep -Seconds 60
+}
+
+Write-Host "Duplicate IP addresses found on the node, Duplicate IP addresses are:"
+
+foreach($ipGroup in $duplicateIpAddr){
+    Write-Host $ipGroup.Name
+}
+
+Write-Host "Stopping pktmon..."
+# Stop pktmon
+pktmon stop
+
+Write-Host "Collecting Windows logs..."
+$collectWindowsLogs = "$BaseDir\collect-windows-logs.ps1" 
+powershell $collectWindowsLogs | Write-Host
+
+Write-Host "Collected Windows logs and trace are at $PWD"
+
+while($true){
+    if ($iter -Eq 1) {
+		Write-Host "The issue was detected in the first iteration and it may have happened already, and log rotation may have occurred."
+	} else {
+		Write-Host "Issue detected. Please download and review the collected Windows logs and also traces from the following path: $PWD\traces.etl"
+	}
+    Start-Sleep -Seconds 3600
+}

scripts/duplicateIpDetection/DetectDuplicateIpAddress.yaml

@@ -0,0 +1,39 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: detect-dup-ip
+  labels:
+    app: detect-dup-ip
+spec:
+  selector:
+    matchLabels:
+      name: detect-dup-ip
+  template:
+    metadata:
+      labels:
+        name: detect-dup-ip
+    spec:
+      securityContext:
+        windowsOptions:
+          hostProcess: true
+          runAsUserName: "NT AUTHORITY\\SYSTEM"
+      hostNetwork: true
+      containers:
+      - name: detect-dup-ip
+        image: mcr.microsoft.com/dotnet/framework/samples:aspnetapp
+        command:
+        - powershell.exe
+        - -command
+        - |
+            Write-Host "Detecting duplicate IP addresses on the node..."; $BaseDir = "c:\k\debug"; Write-Host "Trying to load HNS module..."; ipmo $BaseDir\hns.v2.psm1 -Force | Write-Host; $iter = 1; pktmon stop; Write-Host "Starting pktmon with trace level 6 for HNS"; pktmon start --trace -p Microsoft-Windows-Host-Network-Service -l 6 -f traces.etl -s 2048; while($true){ $ipAddresses = ((Get-HnsEndpoint).IpConfigurations).IpAddress; Write-Host "Checking for duplicate IP addresses inside the loop..."; $duplicateIpAddr = $ipAddresses | Group-Object | Where-Object { $_.Count -gt 1 }; if($duplicateIpAddr.Count -gt 0){ break }; $iter++; Start-Sleep -Seconds 60 }; Write-Host "Duplicate IP addresses found on the node, Duplicate IP addresses are:"; foreach($ipGroup in $duplicateIpAddr){ Write-Host $ipGroup.Name }; Write-Host "Stopping pktmon..."; pktmon stop; Write-Host "Collecting Windows logs..."; $collectWindowsLogs = "$BaseDir\collect-windows-logs.ps1"; powershell $collectWindowsLogs | Write-Host; Write-Host "Collected Windows logs and trace are at $PWD"; while($true){ if ($iter -Eq 1) { Write-Host "The issue was detected in the first iteration and it may have happened already, and log rotation may have occurred." } else { Write-Host "Issue detected. Please download and review the collected Windows logs and also traces from the following path: $PWD\traces.etl" }; Start-Sleep -Seconds 3600 }
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - powershell.exe
+              - -Command
+              - "pktmon stop;sleep 20"
+        securityContext:
+          privileged: true
+      nodeSelector:
+        kubernetes.azure.com/os-sku: Windows2022

scripts/duplicateIpDetection/README.md

@@ -0,0 +1,7 @@
+The script uses the  Get-HnsEndpoint  cmdlet to retrieve all IP addresses associated with the endpoints on the host. It then groups the IP addresses by value and filters the groups to include only those with more than one IP address.
+
+ To run the script, open a PowerShell window and run the following command: 
+ PS> .\DetectDuplicateIpAddrs.ps1
+
+Once a duplicate IP address is detected, it breaks out of the while loop and then collects Windows logs on the node. 
+