CB Defense: How Does the Mac Sensor Determine the Internal IP Address Reported in the PSC Console

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

How does the Mac Sensor determine which network interface is reported as the internal IP address in the Console?

Environment

• CB Defense PSC Sensor: All Supported Versions
• CB Defense PSC Console: All Supported Versions
• Apple macOS: 10.8.x and Higher

Resolution

The Sensor reports the internal IP address as the IP address assigned to the primary network interface as designated by the operating system

Additional Information

• The Mac Sensor may sometimes report a logical network interface IP address in place of the primary IP address
• To confirm which interface is designated as primary by the operating system:

1. Launch Terminal (Applications/Utilities/Terminal.app)
2. Type in the following sequence of commands and press Enter after each command

   scutil
   get State:/Network/Global/IPv4
   d.show

3. The following information will be printed to Terminal

PrimaryInterface :
PrimaryService :
Router :

• The ifconfig command can also be run to show all configured network interfaces