Jump to content

IP from client


Go to solution Solved by michalp,

Recommended Posts

Hi, 

 

I have a question regarding IP of the clients. Will attach two screenshots that will maybe explain the problem better. 

First thing,is the IP of the workstations,(clients) resolved by the name of the server? I guess it is. 

If it it so, then why in the computer section next to the name of the client,there is an IP that is not primary interface, but rather some IP from some virtual box interface or Vmware,it there is Vmware player installed on the client. 

 

In post-6646-0-81084400-1425805114_thumb.jpg, you can see that the ip that is shown next to the name is from 196.168. network, but you can see in the 

post-6646-0-53959000-1425805120_thumb.jpg that my main IP, and the IP of the client is in 10.151. network. 

 

Just wondering what is the logic behind this? Why isn't there an IP of the client that is the IP which is talking to the ERA server.

 

Jut one thing to say, in this example, it is the first IP that is read by ERA, and written next to the name of the client. In one other case, it is some third IP address in a row, so it's not like,it reads the first IP address everytime. 

 

Thank you,

 

Uros

 

Link to comment
Share on other sites

Hi Jim, 

 

Please find screenshot of the order of network adapters

post-6646-0-40969900-1425900500_thumb.jpg

 

As you can see, virtualbox adapter is last on the list, and still it gets recognized first in ERA

That was the first thing i looked

 

Thanks,

Link to comment
Share on other sites

  • ESET Staff
  • Solution

At the moment, IP address shown next to a computer name is any IP address from Network adapters section.

 

There will be change in the future to reflect adapter binding order.

Link to comment
Share on other sites

I have this same issue. Many of my users run instances of VMWare or VirtualBox and it's super annoying that anything other than the primary IP is listed. It's rather confusing if I needed to diagnose a computer or if I was talking about it to my fellow Sys Admins.

Link to comment
Share on other sites

At the moment, IP address shown next to a computer name is any IP address from Network adapters section.

 

Ok, good to know, thank you for clarifying this issue. Just for the record, if I edit that table with computers to have the IP address listed next to the name,it shows the same IP address which is next to the hostname. 

 

And how is ERA resolving the IP address of the client? By hostname? Can that IP be shown, client IP that ERA uses to talk to clients. 

 

Hope that change will come soon, cause as bbraunstein says, it is good to see the address of the computer on the first screen. 

Edited by ucvijan
Link to comment
Share on other sites

  • Former ESET Employees

1. Ok, good to know, thank you for clarifying this issue. Just for the record, if I edit that table with computers to have the IP address listed next to the name,it shows the same IP address which is next to the hostname. 

 

2. And how is ERA resolving the IP address of the client? By hostname? Can that IP be shown, client IP that ERA uses to talk to clients. 

 

Hope that change will come soon, cause as bbraunstein says, it is good to see the address of the computer on the first screen. 

 

 

1. If you want to change values directly in database it is strongly NOT recommended, You can destroy your whole database. Besides, this will work only for some time, because Agent will send new log with actual IP addresses, and override your change.

 

2. IP addresses are resolved by Agent. Server only shows, what Agent sent him. Agent gets this information by API in operating system, that will list all addresses of client machine.

Link to comment
Share on other sites

This might be related to the same subject...

I would like to know why some workstation do not have a resolved DNS name in the list ???

post-6605-0-38082200-1426087910_thumb.jpg

 

Even if the information is available in the  details ( Win7-Lab2 )

post-6605-0-07304300-1426087910_thumb.jpg

Link to comment
Share on other sites

  • Former ESET Employees

IP address in grey box is Computer Name. Second IP is IP reported by Agent from operating system.

Computer name is created with first connection of Agent. Server then tries to resolve this IP to domain name, and if it fails (most probably happened in your case) the name is IP address from first connection.

Try nslookup 10.148.2.24 on Server machine, it should not give you domain name, and this the reason why you see only IP address.

Solution: Computer Name can be renamed in Details of computer to whatever name you need.

Link to comment
Share on other sites

Is there any way to get the ERA server to update this information ? We have enabled the reverse lookup on our DNS servers but the workstations that were registered to ERA before the reverse lookup was enabled don't display their workstation name.

 

Is there a way to ask for a refresh of this information ??

Link to comment
Share on other sites

  • ESET Staff

Unfortunately there is no such way - only complete agent reinstall. But future version (probably summer release) should have same way of automatic renaming of computers. So you would just select what information should be pulled from Device identifiers and applied to computer name.

Link to comment
Share on other sites

If ERAS6 is using proxy config, name resolution will be made trough proxy or will be by Windows DNS Client on this server? Because nslookup is ok but there is no computer name next to IP.

Link to comment
Share on other sites

If ERAS6 is using proxy config, name resolution will be made trough proxy or will be by Windows DNS Client on this server? Because nslookup is ok but there is no computer name next to IP.

 

It seems that that ERA Agent installed on the workstation needs to be able to get a reverse lookup entry from the DNS and then he will pass this information to the ERA server.  But once it is registered to the ERA server if the workstation wasnt able to get a reverse lookup from the DNS you won't see anything else than the IP on the ERA console.  it is impossible to refresh the hostname for the moment... you would need to reinstall the local ERA agent and redo the registration process to the ERA server ( Be sure to check that your workstation is able to get the reverse lookup from himself before reinstalling everything ).

Link to comment
Share on other sites

We distribute the era agent via 3rd party software. So it gets also deployed to notebooks in other networks outside our lan, where the era has no reverse info to the ips used.

Some time later the fqdn gets filled with informations but the name field wont be updated...thats bad and i hope there will be a solution in era server to run some

kind of task or job to fill the name field with the fqdn info.

 

Meanwhile, you could try using this sql-query...

 

update tbl_computers comp set computer_name = (select distinct(Value) from tbl_log_identifiers_list_status WHERE Type = '508906757892866566' AND SourceUuid_id = comp.computer_id);

 

If you only want the hostname to be filled into the name field...use Type='508906757892866565'

 

Works on our era appliance but I don't guaranty anything. Take a backup from your database first!!!

 

best regards

ingo

Link to comment
Share on other sites

  • 5 months later...
  • 9 months later...

Just wanted to chime in that i have several computers that in ERA show the wrong computer name / IP. If with in the server ERA is hosted on i do an nslookup i show the proper host name and IP for the device but ERA is showing another host name not associated to the IP.

Link to comment
Share on other sites

  • 4 months later...

It is now possible to change primary IP address of client PCs? We have deployed ERA version 6.4 but we still cannot see any options.

 

Same here. We have the latest version. Some of our clients have primary and secondary IP on one interface and ERA shows secondary (sic!). Why? And how to change this?

Link to comment
Share on other sites

  • 3 months later...
  • 3 months later...

Here it is 2017 (June) and this IP thing is still a problem (i.e. showing VPN IP instead of LAN IP)  so i am assuming there are no plans to fix this in a timely manner?

Running:
ESET Remote Administrator (Server), Version 6.5 (6.5.522.0)
ESET Remote Administrator (Web Console), Version 6.5 (6.5.388.0)

ESET Endpoint Security (Client) Version 6.5 (6.5.2094.0)

Edited by ESET Driving me crazy!
Update with version
Link to comment
Share on other sites

Hi, following on from the recent comments, we're running ERA 6.4, and wondered if there any plans to resolve this?

Edited by CRE
Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...