CB Defense: Why Do Mac Sensors Sometimes Show an Incorrect IP Address in the PSC Console?
book
Article ID: 287054
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Issue/Introduction
Why does the Mac Sensor entry in the PSC Console show the IP address of the VPN or Proxy used by the Mac client?
Environment
CB Defense PSC Console: All supported versions
CB Defense PSC Sensor: 3.2.2.6 and lower
Apple macOS: All supported versions
Resolution
The Sensor is functioning as expected in that it will report the IP address of the network interface currently used for network communications.
Additional Information
When a VPN or Proxy is in use, the OS designates a logical interface, such as utun0 or utun1 for VPN/proxy use
Since the logical interface is used for network communicationis, the Sensor will report the IP address of this interface rather than the IP address of the primary network interface
The engineering team is working on improvements to the Mac Sensor so that the pimary network interface IP address is reported
Please review upcoming Sensor Release Notes for DSEN-4878
This article will be updated when DSEN-4878 is complete