10.0.0.1 Top remote host

Started by binaryanomaly, June 01, 2021, 10:35:54 PM

Previous topic - Next topic
Why does sensei think 10.0.0.1 is the top remote host?

It's the OPNsense LAN interface IP, gateway, local DNS resolver and very obviously not a remote host?

Hi @binaryanomaly

For local connections where both the originator and the destination is in your local networks, destination will be like regarded as a remote host, since in Sensei terminology one end needs to be "remote".

You can filter out these though. Just enable "Hide local connections" under Report Settings (right top corner).

Quote from: mb on June 02, 2021, 01:26:23 AM
For local connections where both the originator and the destination is in your local networks, destination will be like regarded as a remote host, since in Sensei terminology one end needs to be "remote".

Hmm I do understand that this is the way your tool internally works. But would ague that the common understanding is the opposite and that these are NOT remote hosts by the very definition: https://datatracker.ietf.org/doc/html/rfc1918#section-3

Quote from: mb on June 02, 2021, 01:26:23 AM
You can filter out these though. Just enable "Hide local connections" under Report Settings (right top corner).

Thanks, I was looking for a setting like that and couldn't find one.

(I would naturally rather have it expected in Settings -> Reportig & Data though as almost anything else reporting related is there.)

Quote from: binaryanomaly on June 02, 2021, 06:15:04 AM
Thanks, I was looking for a setting like that and couldn't find one.

(I would naturally rather have it expected in Settings -> Reportig & Data though as almost anything else reporting related is there.)

You're all welcome. Got it. I guess this also makes sense. This would behave like a "default" setting?

Quote from: mb on June 02, 2021, 05:22:46 PM
This would behave like a "default" setting?

I'd assume so.

For the majority of the users the (snippet of) "local" traffic is likely not of significant interest in the reports. So it can probably be disabled by default.