CB Defense: Why Do Mac Sensors Sometimes Show an Incorrect IP Address in the PSC Console?
search cancel

CB Defense: Why Do Mac Sensors Sometimes Show an Incorrect IP Address in the PSC Console?

book

Article ID: 287054

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Why does the Mac Sensor entry in the PSC Console show the IP address of the VPN or Proxy used by the Mac client?

Environment

  • CB Defense PSC Console: All supported versions
  • CB Defense PSC Sensor: 3.2.2.6 and lower
  • Apple macOS: All supported versions

Resolution

The Sensor is functioning as expected in that it will report the IP address of the network interface currently used for network communications.

Additional Information

  • When a VPN or Proxy is in use, the OS designates a logical interface, such as utun0 or utun1 for VPN/proxy use
  • Since the logical interface is used for network communicationis, the Sensor will report the IP address of this interface rather than the IP address of the primary network interface
  • The engineering team is working on improvements to the Mac Sensor so that the pimary network interface IP address is reported
  • Please review upcoming Sensor Release Notes for DSEN-4878
  • This article will be updated when DSEN-4878 is complete