IMPORTANT: In order for this feature to work properly, devices must connect to Fleet via the public internet. If the agent connects to Fleet via a private network then the "Public IP address" for such device will not be set.
Fleet attempts to deduce the public IP of devices from well-known HTTP headers received on requests made by the osquery agent.
The HTTP request headers are checked in the following order:
True-Client-IP header is set, then Fleet will extract its value.
X-Real-IP header is set, then Fleet will extract its value.
X-Forwarded-For header is set, then Fleet will extract the first comma-separated value.
If the IP retrieved using the above heuristic belongs to a private range, then Fleet will ignore it and will not set the "Public IP address" field for the device.
If you notice something we've missed or could be improved on, please follow this link and submit a pull request to the Fleet repo.
Back to top