From f695d1264be9e3241c71888ef55c49ba7c06b5ce Mon Sep 17 00:00:00 2001
From: Mark Gardner <133483+mjgardner@users.noreply.github.com>
Date: Fri, 7 Mar 2025 11:39:37 -0600
Subject: [PATCH] fix(systemadmin): don't hardcode http20 network interface

The hardcoded `eth0` network interface in the `http20` function doesn't
exist on macOS. It's more reliable to dynamically determine the
appropriate interface, so this change checks what would be used to reach
Cloudflare's public 1.1.1.1 DNS service (yes, another hardcoded thing,
but at least it's common across the Internet) and uses that interface.

For example, on my macOS system, it returns either `en0` (Wi-Fi) or
`en7` (the Ethernet slot on my Thunderbolt dock).

On Linux, this uses the commonly installed `ip route` command from the
[iproute2](https://wiki.linuxfoundation.org/networking/iproute2)
project. The macOS port of some of these utilities is available from
[Homebrew](https://brew.sh) by running `brew install iproute2mac`.

This change also splits the pipeline in the function across multiple
lines per this project's
[Code Style Guide](https://github.com/ohmyzsh/ohmyzsh/wiki/Code-Style-Guide).
---
 plugins/systemadmin/systemadmin.plugin.zsh | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/plugins/systemadmin/systemadmin.plugin.zsh b/plugins/systemadmin/systemadmin.plugin.zsh
index fa7e5f786..fa614d5fb 100644
--- a/plugins/systemadmin/systemadmin.plugin.zsh
+++ b/plugins/systemadmin/systemadmin.plugin.zsh
@@ -94,7 +94,13 @@ function req20() {
 
 # top20 of Using tcpdump port 80 access to view
 function http20() {
-  sudo tcpdump -i eth0 -tnn dst port 80 -c 1000 | awk -F"." '{print $1"."$2"."$3"."$4}' | sort | uniq -c | sort -nr | head -n 20
+  sudo tcpdump -i $(ip route get 1.1.1.1 \
+    | awk '/^1.1.1.1 via / {print $5}') -tnn dst port 80 -c 1000 \
+    | awk -F"." '{print $1"."$2"."$3"."$4}' \
+    | sort \
+    | uniq -c \
+    | sort -nr \
+    | head -n 20
 }
 
 # top20 of Find time_wait connection