
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
net_prof is a network profiler library aimed to profile the HPE Cray Cassini Network Interface Card (NIC) on a compute node to collect, analyze and visualize the network counter events. This tool will help to compare and diagnose a successful workload without any network issues with an unsuccessful workload due to a network issue. net-prof summary reports help to understand, analyze, and optimize current network bandwidth usage for any type of communication — whether it’s ping, point-to-point, send-receive, MPI collectives, or PyTorch CCL collectives — by pinpointing why the current communication API is not achieving its theoretical peak performance.
pip install net_prof
collect(input_directory, output.json)
summarize(before, after)
dump(summary)
dump_html(summary, output.html)
import net_prof
net_prof.collect("../sys/class/cxi", "/path/to/file/before.json"))
# Perform some sort of action between before and after.
net_prof.collect("../sys/class/cxi", "/path/to/file/after.json"))
summary = net_prof.summarize("/path/to/file/before.json", "/path/to/file/after.json")
net_prof.dump(summary)
net_prof.dump_html(summary, "/path/to/file/report.html")
If you want to collect a single-NIC, pass in the /telemetry/ directory, otherwise, provide a /cxi/ directory. For example: Instead of giving a ../sys/class/cxi/ directory:
net_prof.collect("../sys/class/cxi", os.path.join(script_dir, "before.json"))
pass in the whole directory up to /telemetry of specific NIC:
net_prof.collect("../sys/class/cxi/cxi0/device/telemetry", os.path.join(script_dir, "before.json"))
import os
import net_prof
target_host = "x4306c7s2b0n0.hostmgmt2306.cm.aurora.alcf.anl.gov"
net_prof.collect("/sys/class/cxi/","/lus/flare/projects/datascience/kaushik/network/net-prof-tests/ping-test/before.json")
os.system(f"ping -c 4 {target_host}")
net_prof.collect("/sys/class/cxi/","/lus/flare/projects/datascience/kaushik/network/net-prof-tests/ping-test/after.json")
summary = net_prof.summarize("/lus/flare/projects/datascience/kaushik/network/net-prof-tests/ping-test/before.json", "/lus/flare/projects/datascience/kaushik/network/net-prof-tests/ping-test/after.json")
net_prof.dump(summary)
net_prof.dump_html(summary, "/lus/flare/projects/datascience/kaushik/network/net-prof-tests/ping-test/net_prof_report.html")
import net_prof
import torch.distributed as dist
net_prof.collect("../sys/class/cxi", "/path/to/file/before.json"))
dist.init_process_group(backend="nccl") # or gloo
x = torch.tensor([1.0], device="cuda")
dist.all_reduce(x, op=dist.ReduceOp.SUM)
net_prof.collect("../sys/class/cxi", "/path/to/file/after.json"))
summary = net_prof.summarize("/path/to/file/before.json", "/path/to/file/after.json")
net_prof.dump(summary)
net_prof.dump_html(summary, "/path/to/file/report.html")
Net-Prof lets you contrast a good and bad run to pinpoint which NIC counters change.
# Simulated "Healthy Node"
import net_prof, os
target = "good-node"
net_prof.collect("/sys/class/cxi", "before_healthy.json")
os.system(f"ping -c 4 {target}")
net_prof.collect("/sys/class/cxi", "after_healthy.json")
net_prof.dump_html(net_prof.summarize("before_healthy.json", "after_healthy.json"),
"report_healthy.html")
# Simulated "Faulty Node"
import net_prof, os
target = "bad-node" # simulate issue (e.g., firewall drop)
net_prof.collect("/sys/class/cxi", "before_faulty.json")
os.system(f"ping -c 4 {target}") # expect high loss / timeout
net_prof.collect("/sys/class/cxi", "after_faulty.json")
net_prof.dump_html(net_prof.summarize("before_faulty.json", "after_faulty.json"),
"report_faulty.html")
It could be implemented as such:
# DO NOT FOLLOW THIS CODE. THIS IS A REPRESENTATION OF WHAT CAPABALITIES I WANT net_prof TO HAVE IN THE FUTURE
# psuedocode:
net_prof.collect(before_idle.json)
time.sleep(5) # doing effectively "nothing" or just idling...
net_prof.collect(after_idle.json)
idle_test = net_prof.summarize(before_idle.json, after_idle.json)
net_prof.collect(before_ping.json)
os.system(f"ping -c 4 {target}")
net_prof.collect(after_ping.json)
ping_test = net_prof.summarize(before_ping.json, after_ping.json)
compare(idle_test, ping_test, report_idle_vs_ping.html)
https://cpe.ext.hpe.com/docs/latest/getting_started/HPE-Cassini-Performance-Counters.html
FAQs
Network Profiler for the HPE Cassini Cray NIC
We found that net-prof demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.