CB Defense: Why Do Mac Sensors Sometimes Show an Incorrect IP Address in the PSC Console?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Why does the Mac Sensor entry in the PSC Console show the IP address of the VPN or Proxy used by the Mac client?

Environment

• CB Defense PSC Console: All supported versions
• CB Defense PSC Sensor: 3.2.2.6 and lower
• Apple macOS: All supported versions

Resolution

The Sensor is functioning as expected in that it will report the IP address of the network interface currently used for network communications.

Additional Information

• When a VPN or Proxy is in use, the OS designates a logical interface, such as utun0 or utun1 for VPN/proxy use
• Since the logical interface is used for network communicationis, the Sensor will report the IP address of this interface rather than the IP address of the primary network interface
• The engineering team is working on improvements to the Mac Sensor so that the pimary network interface IP address is reported
• Please review upcoming Sensor Release Notes for DSEN-4878
• This article will be updated when DSEN-4878 is complete