Are we talking Ethernet or with an Ethernet dongle, or Wi-Fi? I assume the former, but wasn't 100% sure. Maybe its for both?
The way it would be done for each type of port is going to be different. Should be possible to write one EA that can capture that for whatever the active connection is though.

it would be Ethernet and Ethernet with a dongle. No Wi-Fi.

Ok, well, I put this together, which will get the results for either one. You can I guess modify it to only report on Ethernet. Just change the if/then block to simply report N/A or something if it doesn't see an active Ethernet type port.

#!/bin/bash

ALLPORTS=$(networksetup -listallhardwareports | awk -F' ' '/Device:/{print $NF}')

while read PORT; do
    if [[ $(ifconfig "$PORT" 2>/dev/null | awk '/status:/{print $NF}') == "active" ]]; then
        ActivePort="$PORT"
        ActivePortName=$(networksetup -listallhardwareports | grep -B1 "$PORT" | awk -F': ' '/Hardware Port/{print $NF}')
        break
    fi
done < <(printf '%s
' "$ALLPORTS")

if [[ "$ActivePortName" =~ "Ethernet" ]]; then
    LinkSpeed=$(ifconfig $ActivePort | awk -F': ' '/media:/{print $NF}')

Results="Port: ${ActivePortName}
Speed:  $LinkSpeed"

elif [[ "$ActivePortName" =~ "Wi-Fi" ]]; then
    MaxLinkSpeed=$(/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -I | awk '/maxRate/{print $NF}')
    CurrentLinkSpeed=$(/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -I | awk '/lastTxRate/{print $NF}')

Results="Port:     ${ActivePortName}
Max:        $MaxLinkSpeed
Current:    $CurrentLinkSpeed"

else

Results="Unknown"

fi

echo "<result>$Results</result>"

You could also edit it so the Results variable doesn't contain any labels in it like I've done. Just set the speed result as the $Results variable.

Wow! I was hoping somebody had one I could grab. I never expected someone to write on… especially within an hour of me posting the request.

Thank you. It works perfectly.

You're welcome. To be honest, it came from a few different snippets of code from similar scripts, so I didn't really write it from scratch. :)
I just noticed that for some reason the version I posted was getting the active port name twice, which is unnecessary.

For the purpose of anyone else that might happen upon this, I edited the version above to remove the redundant line.

Stumbled on this looking around for a way to distinguish if a user's connecting through a cellular data connection, and if so, to not execute a policy that otherwise pushes large content to the device. It's tricky... because they could be tethered over WiFi to a phone or hotspot, which might show as the maximum WiFi speed which might be faster than the cellular data connection's actual speed (and we don't want our users pulling down gigs of their limited data for a software update.)

Nevermind. I just realized/remembered the (right/easy/good enough) way to do this is to include/exclude specific network segments from the scoping of such policies.