OPNsense Forum

English Forums => Sensei => Topic started by: binaryanomaly on June 01, 2021, 10:35:54 pm

Title: 10.0.0.1 Top remote host
Post by: binaryanomaly on June 01, 2021, 10:35:54 pm
Why does sensei think 10.0.0.1 is the top remote host?

It's the OPNsense LAN interface IP, gateway, local DNS resolver and very obviously not a remote host?
Title: Re: 10.0.0.1 Top remote host
Post by: mb on June 02, 2021, 01:26:23 am
Hi @binaryanomaly

For local connections where both the originator and the destination is in your local networks, destination will be like regarded as a remote host, since in Sensei terminology one end needs to be "remote".

You can filter out these though. Just enable "Hide local connections" under Report Settings (right top corner).
Title: Re: 10.0.0.1 Top remote host
Post by: binaryanomaly on June 02, 2021, 06:15:04 am
For local connections where both the originator and the destination is in your local networks, destination will be like regarded as a remote host, since in Sensei terminology one end needs to be "remote".

Hmm I do understand that this is the way your tool internally works. But would ague that the common understanding is the opposite and that these are NOT remote hosts by the very definition: https://datatracker.ietf.org/doc/html/rfc1918#section-3

You can filter out these though. Just enable "Hide local connections" under Report Settings (right top corner).

Thanks, I was looking for a setting like that and couldn't find one.

(I would naturally rather have it expected in Settings -> Reportig & Data though as almost anything else reporting related is there.)
Title: Re: 10.0.0.1 Top remote host
Post by: mb on June 02, 2021, 05:22:46 pm
Thanks, I was looking for a setting like that and couldn't find one.

(I would naturally rather have it expected in Settings -> Reportig & Data though as almost anything else reporting related is there.)

You're all welcome. Got it. I guess this also makes sense. This would behave like a "default" setting?
Title: Re: 10.0.0.1 Top remote host
Post by: binaryanomaly on June 02, 2021, 08:34:21 pm
This would behave like a "default" setting?

I'd assume so.

For the majority of the users the (snippet of) "local" traffic is likely not of significant interest in the reports. So it can probably be disabled by default.
Title: Re: 10.0.0.1 Top remote host
Post by: mb on June 02, 2021, 08:43:38 pm
Got it, thanks.