Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hi fleet team, may i know where does fleet fetch the private ip?
i found we have a lot of hosts with same private ip, i doubt fleet does take loopback ip as private ip, could u confirm?

hi! <https://github.com/fleetdm/fleet/blob/d0cfa7bbb362a620ec13e30b2d6803ae06c10059/server/service/osquery_utils/queries.go#L64|this is the code> we use to fetch/parse network information about the host. As a summary, we send this query:

```select ia.address, id.mac, id.interface
                        from interface_details id join interface_addresses ia
                               on ia.interface = id.interface where length(mac) &gt; 0
                               order by (ibytes + obytes) desc```
and then we do some programmatic filtering to discard link-local and loopback interfaces

are you able to provide more details about the format that the problematic IPs have? Are the hosts VMs or containers by any chance?

we have a lot hosts whose private ip is 172.18.0.1 which means it pick ip of carma_br0 as private ip, this is not right.

apparently, it supposed to pick eth0 as source of truth to present private ip.

<@U042N4N1F8S> thanks for the details! Coincidentally, I have just learned that we have a <https://github.com/fleetdm/fleet/pull/8407|pull request> that refactors this exact same code and I think it will solve your issue, let me get confirmation on that.

hi again <@U042N4N1F8S>, so to confirm if the current refactor of the query will fix your problem, could you run this query in any of your hosts with problems?

```select
    ia.address,
    id.mac
from
    interface_addresses ia
    join interface_details id on id.interface = ia.interface
    join routes r on r.interface = ia.interface
where
    r.destination = '0.0.0.0'
    and r.type = 'gateway'
order by
    instr(ia.address, '.') desc```

:wave: hey <@U042N4N1F8S> just following up on this, were you able to run the query?

Hi roberto, i am struggling with sth else, but i will let you know after i confirm it. thx.