Getting the Real Source IP

Collectors receive syslog (514/udp) and SNMP traps (162/udp). The packet’s source IP identifies the sending device, and a collector runs directly on its host’s network stack — so it always sees the real sending-device IP, with nothing to configure.

Source masked? Attribution still works.

GridNMS extracts the sender’s host from the log itself — the syslog HOSTNAME field, CEF dvchost, or a JSON hostname — and stores it as Sender Host. Events are attributed to a device by that host (which survives relays, unlike the packet IP), are searchable on the Events page even before the device is onboarded, and unmanaged senders surface under Reports → Unmanaged Senders for one-click onboarding.

The network permission boundary

A collector may only initiate outbound connections to:

1. IPs/CIDRs within its explicitly assigned networks (assigned in Configure → Sites & Networks),
2. your GridNMS instance — always allowed, and
3. configured external storage endpoints (metric/log sinks).

The network assignment — not device assignment — is the permission boundary. Assigning a device to a collector is a routing convenience; the assigned networks decide what a collector is allowed to reach.