Security Center - 2 different IP addresses in source for same event

[EmilyQuinn]

We are investigating a large number of blocked events.  When I mouse over the source in Security Center > MX Events, it shows me the IP address, MAC address and OS info, with a link for View Client Details and a filter for Show this client only.  The IP address shown is 10.20.28.21 port 47839, with mac address ending in 1c:7b.   When I click on  View client details, the client IP address is different - 10.20.18.47.  Both these IPs are statically set, with the .21 address being a multifunction printer and the .47 addressing being a vulnerability management scanner appliance from our MSP.  The mac address shown as associated with .21 is the correct mac for the device using the .47 address.  Any idea why this might be showing up this way?

[michalc]

Hi There!

Vulnerability scanners often simulate traffic, including spoofing source IPs, to test network responses. It’s conceivable that your scanner at 10.20.18.47 is generating traffic with a spoofed source IP of 10.20.28.21 (the printer’s address) as part of its testing. The MX would log the spoofed IP in the event, but "View Client Details" would still point to the scanner’s real IP based on its MAC. You might want to review the scanner’s configuration or logs to see if it’s intentionally sending traffic from 10.20.28.21. Perhaps disconnect the scanner for a while and see if the logs are still there.

[RaphaelL · Accepted solution]

That issue has always been present. I can find about a million of these logs per week : 

Our scanner is 2.2.2.2 and the remote target is a Meraki MS switch 1.1.1.1.  The source and destination are inverted so SecurityCenter reports the wrong IP to the wrong client description. It shows that 2.2.2.2 is the MS switch , which is false. 

I opened a couple tickets about Security Center issues in the past and I don't think I have seen any updates / improvements about this page in years. Nothing was ever fixed so I stopped bothering about it.

Your issue might be slightly different, but I just wanted to say that issues with reporting are frequent with SecurityCenter in my experience.