Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

CB Defense: Why Do Mac Sensors Sometimes Show an Incorrect IP Address in the PSC Console?

CB Defense: Why Do Mac Sensors Sometimes Show an Incorrect IP Address in the PSC Console?

Environment

  • CB Defense PSC Console: All supported versions
  • CB Defense PSC Sensor: 3.2.2.6 and lower
  • Apple macOS: All supported versions

Question

Why does the Mac Sensor entry in the PSC Console show the IP address of the VPN or Proxy used by the Mac client?

Answer

The Sensor is functioning as expected in that it will report the IP address of the network interface currently used for network communications.

Additional Notes

  • When a VPN or Proxy is in use, the OS designates a logical interface, such as utun0 or utun1 for VPN/proxy use
  • Since the logical interface is used for network communicationis, the Sensor will report the IP address of this interface rather than the IP address of the primary network interface
  • The engineering team is working on improvements to the Mac Sensor so that the pimary network interface IP address is reported
  • Please review upcoming Sensor Release Notes for DSEN-4878
  • This article will be updated when DSEN-4878 is complete

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎03-18-2019
Views:
230
Contributors