Hi Lyle, My guess (and perhaps other will have better guesses) is that your routers are doing NAT. My second guess is that you are using routers in situations where switches or hubs may be more appropriate.
I have several Linksys wireless routers providing wifi connectivity in my office building. I have them set to do DHCP forwarding, and have turned their DHCP service. The result is that any clients get IP addresses from the standard pool of addresses. I'm running the DD-WRT firmware if you're in a similar situation. You would have to find similar settings on your routers. Good luck! LNick On Dec 12, 6:18 am, Lyle Lasheimok <[EMAIL PROTECTED]> wrote: > Hi Peter, > > you're right, the real issue is what's in the logs. Currently they show only > the IP address of the router, not of the desktop. > > So it's not actually an Ossec issue, but I thought it's maybe a common > problem for Ossec users. I don't see how to avoid routers in a network that's > spread all over the building, especially if Wifi is used at different > locations. > > Is there any way to show the correct IPs in the log files so that Ossec can > parse them correctly? > > Gratefully, > Lyle
