How do you get the top IP address to appear in Top Hosts report if IP is hitting each unique URL once?

Avatar
Matthew Huth
  • updated
  • Answered
We have a security scanner that scans URLs on our site for vulnerabilities. It is the most frequent IP address in our Apache log however I do not see that IP address on the Top Hosts report. I'm guessing that is because the scanner is hitting each unique URL once instead of multiple times. Is that the reason it's not showing up on the report? Is there a report or setting where I could see this IP appear at top of report? i.e. the heaviest hitter.
sorting columns
Replies 1
Avatar
0
Michael
The Top Hosts table is sorted by number of visitors by default. If your scanner make requests from the same IP, it will be counted as one or few visitors (the program uses the timeout of 30 minutes to separate visitors from the same IP).

You can also sort the table by number of hits. You can do it in Options > Report > Contents (so it will affect all the profiles by default) or Profile Properties > Report > Custom report contents. You need to select the table, click the Properties button or double-click the table name, and change the base column for the table.

If you use dynamic HTML reports in the Enterprise edition, you can also click the column title in the table to sort by it without need to change the profile.