Zenarmor report bug?

[fabianodelg]

Hi there,

I'm on ZenArmor 1.11 + OPNsense 22.1.4_1; since the update to ZenArmor 1.11, if I browse the report section look to a 'session detail' the SRC IP and SRC HOSTNAME seems to be a like a random Class A IP address while the Mac Address is of a valid (at least one that I recognise!) device in my network.

When I first saw this I nearly had an heart attack as I thought that my network has been compromised; looking more in detail, the behaviour is consistent in all the reporting section (so SRC IP is always a random Class A IP address but the Mac address are valid and belonging to my devices).

I've also double checked on my firewall with arp -a and the arp cache is consistent.

Is this something anyone else is experiencing?

Thanks
F

[sy]

Hi,

The IP anonymizer should be on. Please set them off on Configuration - Reporting & Data - Anonymize Local / Remote IP.

[fabianodelg]

Hi Sy

unfortunately not, it's not on. What else should I look at?

Thanks for your help!