10.0.0.1 Top remote host

[binaryanomaly]

Why does sensei think 10.0.0.1 is the top remote host?

It's the OPNsense LAN interface IP, gateway, local DNS resolver and very obviously not a remote host?

[mb]

Hi @binaryanomaly

For local connections where both the originator and the destination is in your local networks, destination will be like regarded as a remote host, since in Sensei terminology one end needs to be "remote".

You can filter out these though. Just enable "Hide local connections" under Report Settings (right top corner).

[binaryanomaly]

For local connections where both the originator and the destination is in your local networks, destination will be like regarded as a remote host, since in Sensei terminology one end needs to be "remote".

Hmm I do understand that this is the way your tool internally works. But would ague that the common understanding is the opposite and that these are NOT remote hosts by the very definition: https://datatracker.ietf.org/doc/html/rfc1918#section-3

You can filter out these though. Just enable "Hide local connections" under Report Settings (right top corner).

Thanks, I was looking for a setting like that and couldn't find one.

(I would naturally rather have it expected in Settings -> Reportig & Data though as almost anything else reporting related is there.)

[mb]

Thanks, I was looking for a setting like that and couldn't find one.

(I would naturally rather have it expected in Settings -> Reportig & Data though as almost anything else reporting related is there.)

You're all welcome. Got it. I guess this also makes sense. This would behave like a "default" setting?

[binaryanomaly]

This would behave like a "default" setting?

I'd assume so.

For the majority of the users the (snippet of) "local" traffic is likely not of significant interest in the reports. So it can probably be disabled by default.

[mb]

Got it, thanks.