Capability

Built-in Network Diagnostics

Diagnose from your browser — inspect network and security issues in production without shell access.

TR7 Built-in Network Diagnostics lets operations teams investigate network, DNS, HTTP, TLS, packet capture and system-level issues directly from the TR7 interface or CLI — without granting server shell access for every incident. TR7 operates with 28 whitelisted sys-cmd tools and up to 8 levels of pipe chaining. ping, traceroute, dig, curl, tcpdump, sslscan, ss, nmap, ipcalc and similar tools run with controlled parameters; pipe operations such as grep, sort, tail, wc and to-file let teams filter output or write it to a file. Packet capture output, TLS scan results or any command output can be written via `to-file` and downloaded from the interface. RBAC and the audit log record who ran which diagnostic command, when, and in which zone context. The result: TR7 removes production diagnostics from the realm of uncontrolled shell access and turns it into a safe, auditable operation with a whitelisted command set, downloadable artifacts, RBAC and a full audit trail.

28
Whitelisted sys-cmd Linux diagnostic tools
8
Maximum pipe chain depth
4
Command groups: network, HTTP, TLS/packet, system

Handing out shell access to fix a production issue looks fast — but it is expensive from a security and compliance standpoint.

When an application sees a 5xx spike, a backend becomes slow or a TLS handshake fails, the operations team needs data quickly. The traditional path is usually SSH, a jump host, VPN, a dedicated diagnostics machine and a manual command chain — losing time and making it hard to collect data from the exact point where the traffic problem is occurring.

Running dig on a separate server for DNS problems, conducting TLS scans on yet another machine and accessing the production device directly for packet capture all fragment the operation. When the network context where the issue exists differs from where the test is run, results can be misleading. The closer the diagnostic tool is to where traffic actually flows, the more valuable the result.

At the same time, granting full shell access in a production environment creates serious risk. Arbitrary command execution, deleting critical files with wrong parameters, unauthorized network scanning, unmonitored data export and missing audit trails are unacceptable in enterprise environments. Regulated infrastructures in particular require a clear answer to "who did what, and when?"

Safe diagnostics require two balances to hold at once: the operations team must have powerful enough tools, but those tools must not become a pass to run arbitrary commands. A whitelist, RBAC, audit log, sandbox and downloadable output management are critical for exactly this reason.

TR7's built-in network diagnostic approach meets production debug needs with a controlled command set — enabling packet, DNS, TLS, HTTP and system data collection without opening shell access.

Our approach

TR7 makes network diagnostics safe through a whitelisted command set, controlled pipe chaining, downloadable output and an audit trail.

A whitelist command set blocks arbitrary execution

In TR7, diagnostic commands run against a pre-defined sys-cmd list. Users do not run free-form Linux commands — they diagnose through permitted tools and safe usage patterns only.

Pipe chaining delivers filtering power in a controlled form

grep, wc, sort, head, tail, uniq, cut and to-file pipe operations are supported. This gives bash-like output processing convenience while staying under the control of the whitelist and depth limit.

to-file turns output into downloadable evidence

Packet captures, TLS scans or any command output can be written to a file. Operations teams download the pcap or text artifact from the interface and use it for analysis, support or compliance review.

RBAC and audit make production diagnostics traceable

Command execution rights are controlled per role. Every invocation is recorded with user, timestamp, command and zone context, delivering fully auditable diagnostics in production.

Capabilities

TR7 Built-in Network Diagnostics consolidates core operations needs — from network connectivity to TLS, HTTP testing and system visibility — in a single controlled interface.

Network connectivity tests surface access and route problems quickly

`ping`, `ping6`, `traceroute`, `fping`, `arping` and related tools let teams inspect connectivity and path issues. IPv4 and IPv6 access can be tested independently. Multi-host ping gives a quick status view across multiple targets. These tools help distinguish whether a backend access outage is network-related, route-related or target-related.

DNS diagnostic tools clarify record and resolution issues

`dig` and `nslookup` query DNS records — A, AAAA, MX, TXT, CNAME and more. Running tests against different DNS servers reveals propagation gaps or resolver discrepancies. This is valuable after GTM changes, domain migrations or record updates. The team receives results from the network context where TR7 itself resides.

HTTP tools test application reachability and response behavior

`curl` and `wget` directly test HTTP/HTTPS endpoints. Headers, status codes, content and redirect behavior can be inspected quickly. `h1load` and `wrk` enable controlled load tests or basic performance observations. This makes it easier to separate an application access problem from a network problem.

TLS and packet tools make handshake failures visible

`sslscan` inspects protocol support, cipher suites and certificate behavior. `ssldump` provides more detailed tracing of TLS handshakes and packet flow. `tcpdump` captures packets on a specific interface, host or port. Output can be saved as a pcap via `to-file` and downloaded for deep analysis.

Socket and connection visibility delivers real-time state analysis

`netstat` and `ss` are available for open connections, listening ports and socket statistics. Heavy connection loads, TIME_WAIT increases, unexpected port usage or service listening state can all be checked quickly. Application-layer and OS connection state can be compared from the same screen during production incidents, accelerating response.

System and addressing tools support infrastructure control

`ip`, `ipcalc`, `route-table`, `arp` and `htop` provide interface, subnet, route, ARP and process visibility. Core operations checks such as subnet planning, route validation and resource usage can be performed. Utility operations such as the disk extend wizard and temporary file management complete the diagnostic workflow, reducing the need for separate server access.

nmap and protocol clients verify service reachability

`nmap` enables port status checks, service detection and host discovery. `ftp` and `telnet` clients can be used for basic connectivity tests on legacy or custom protocol access. These tools are especially useful during internal service migrations to confirm that target ports are genuinely open and reachable. The whitelist approach ensures usage never devolves into uncontrolled shell access.

Pipe chaining makes command output practically processable

TR7 supports up to 8 levels of pipe chaining using grep, wc, sort, head, tail, uniq, cut and to-file. Operations teams can search large outputs, count lines, sort or trim results. `to-file` turns output into a downloadable file. This structure makes raw output more readable and shareable during rapid debugging sessions.

Operational depth

Built-in diagnostic tools are bounded by whitelist, sandbox, permission, output and audit controls so they operate safely in production.

01

Authoritative command list

The authoritative source for permitted commands is the sys-cmd and pipe lists in the WebConsole configuration. Users cannot run arbitrary system commands. This approach preserves debug power while constraining the executable surface.

02

Pipe depth limit

Pipe chains are capped at 8 steps. This limit provides output-processing flexibility while preventing complex, hard-to-control command chains. Operations teams enjoy bash-like ergonomics, but system behavior remains predictable.

03

Multiple output formats

Command output can be retrieved in JSON, tab-separated, comma-separated, semicolon or compact formats. This supports both human-readable output and data intended for onward tooling. Format selection reduces effort during reporting and incident analysis.

04

Sandbox execution model

Diagnostic commands run in a restricted shell and sandbox. Only the capabilities required for network diagnostics — NET_ADMIN and NET_RAW — are enabled; unnecessary system privileges are dropped. This model reduces the risk of command execution causing harm in the production environment.

05

Audit record chain

Every sys-cmd invocation is logged with user, timestamp, command and zone context. These records are important for post-incident review and compliance audits. Who took which diagnostic step in production can be traced retrospectively.

06

Downloadable evidence files

`to-file` output makes pcap, text or scan result files available for download from the interface. Files can be shared with support teams, used for deep packet analysis or attached to incident records. Diagnostics cease to be ephemeral screen output and become persistent, shareable evidence.

When to use it

Packet capture during a production 5xx spike

The operations team can capture traffic to a specific backend using `tcpdump` with a bounded packet count. Once downloaded as a pcap, application, network and security teams can all analyze the same evidence.

TLS cipher suite and certificate issue investigation

When a client reports a TLS error connecting to a specific application, `sslscan` checks protocol support and cipher suite behavior. Results can be written to a file and shared with the customer or internal teams.

DNS propagation and resolver discrepancy check

After a domain change, `dig` queries can be run against different DNS servers. The operations team sees which resolver returns which value for the record — directly from the TR7 interface.

Backend latency and bandwidth analysis

`ping`, `tail`, `iftop` and socket tools enable inspection of latency, traffic load and connection state. This makes it faster to determine whether slowness stems from the network, service capacity or traffic volume.

Frequently asked questions

Which diagnostic tools are on the whitelist?
28 sys-cmd tools are organized into four groups: network (ping, ping6, traceroute, dig, nslookup, fping, iftop, netstat, ss, nmap), HTTP (curl, wget, h1load, wrk), TLS/packet (tcpdump, ssldump, sslscan) and system (arp, arping, ip, ipcalc, route-table, htop and utility tools). The list is defined in the WebConsole configuration; users cannot run commands outside it.
How is packet capture output downloaded?
When `tcpdump` is used with the `to-file probe.pcap` pipe, TR7 writes the output to a file. The file is then downloadable from the interface — it can be opened in tools such as Wireshark for deep analysis or shared during support processes.
Which commands can be restricted per role with RBAC?
Command execution rights are configured per role. Certain roles may be limited to network connectivity tests while others also have access to packet capture or TLS scanning. Every command invocation is written to the audit log with user, timestamp, command and zone context.
Why is the pipe chain depth capped at 8?
The eight-step limit provides bash-like filtering flexibility while preventing complex and unpredictable command chains. Operations teams can meet real needs with combinations of grep, sort, tail and to-file, and system behavior remains predictable.
How does the diagnostic sandbox model work?
Commands run in a restricted shell environment where only the system capabilities required for network diagnostics — NET_ADMIN and NET_RAW — are active. Unnecessary privileges are dropped, reducing the risk that an incorrect or malicious command can damage the production environment.
In which formats can command output be retrieved?
Output is available in JSON, tab-separated, comma-separated, semicolon and compact formats. Plain text suits human review while structured formats serve automation and reporting needs. Combined with `to-file`, output is turned directly into a downloadable artifact.

Make production diagnostics safe and auditable

Resolve network issues with ping, traceroute, tcpdump, sslscan and 28 tools — without granting shell access. Let's walk through a live demo on your own environment.