CB Defense: How Does the Mac Sensor Determine the Internal IP Address Reported in the PSC Console

[#1]

Environment

• CB Defense PSC Sensor: All Supported Versions
• CB Defense PSC Console: All Supported Versions
• Apple macOS: 10.8.x and Higher

Question

How does the Mac Sensor determine which network interface is reported as the internal IP address in the Console?

Answer

The Sensor reports the internal IP address as the IP address assigned to the primary network interface as designated by the operating system

Additional Notes

• The Mac Sensor may sometimes report a logical network interface IP address in place of the primary IP address
• To confirm which interface is designated as primary by the operating system:

1. Launch Terminal (Applications/Utilities/Terminal.app)
2. Type in the following sequence of commands and press Enter after each command

   scutil
   get State:/Network/Global/IPv4
   d.show

3. The following information will be printed to Terminal

PrimaryInterface :
PrimaryService :
Router :

• The ifconfig command can also be run to show all configured network interfaces

Related Content

CB Defense: Why Do Mac Sensors Sometimes Show an Incorrect IP Address in the PSC Console?