How to See the Internal IP Addresses of Users Who Have Failed a USB Drive Test

If you use an outbound firewall or proxy server, the IP addresses associated with each USB drive test failure may be missing or incorrect. To identify which device the file was opened on, you’ll need to find the internal IP addresses for these failures.

Follow the steps below to find internal IP addresses associated with USB drive test failures.

1. Connect to your firewall or proxy server log.
2. Search your log for the KnowBe4 USB server domain. This is the KnowBe4 instance where your console is hosted, followed by the subdirectory /usb_campaigns/report/
   • For example, the US USB server is https://training.knowbe4.com/usb_campaigns/report/. See our KnowBe4's Training Instances article for more information. 
3. If an attempt to connect to this server is listed on your log, that means a USB drive test file was opened using a device on your network.
4. In your firewall or proxy server log, you should be able to view the internal IP address used for this connection.
5. Use the internal IP address to trace which device on your network opened the USB drive test file.

See our USB Drive Test article for more information about this feature. 

Back to top