After latest update Pi.Alert detected tons of devices

[mfedatto]

After I updated my container instance of Pi.Alert it detected more than 1k new devices, all with random MAC and massively IPv6. The few IPv4 is consistent with Docker virtual network. Is it a know issue? How should I deal with this?

Image: jokobsk/pi.alert:latest@sha256:af2ccdffef2576bba7a70b58d06623a32d57cd6bdcc2dcd887d3ed28a611e8cb

[jokob-sk]

Hi,

Can you let me know what scanners you are using and the settings for enabled scanners?

Thanks,
j

[mfedatto]

Like this?

[jokob-sk]

I can see you have 3 scanners enabled discovering devices. Can you send me screenshots from where the devices come from (you can check that in the Plugins > section)?

[mfedatto]

I thing we found the offender.

How to deal with this?

[jokob-sk]

Thanks for that! What would your preferred behavior be? I'm thinking of having a setting to exclude an IP range from devices to be added as new entries, similar to these two settings (these 2 settings are only to influence notification processing right now):

Another option would be to be able to customize and select different SQL queries used to retrieve PIHOLE devices.

Maybe this is my preferred option. Let me think about this a bit. 🤔

[mfedatto]

Shouldn't the SCAN_SUBNETS be enough? I had it as 192.168.0.0/24 and 192.168.1.0/24 on my first setup; since it is not defined on the current setup, I must have forgotten.

[jokob-sk]

Oh, that might be the issue. Give it a try and report back 👍

[mfedatto]

Didn't work out. The already detected devices still there and new devices where discovered by PiHole (device sync) plugin.

[jokob-sk]

I've added a MAC filter for devices you would like to filter out:

Please test it in the pi.alert_dev image after this build finishes: https://github.com/jokob-sk/Pi.Alert/actions/runs/7763138597

[pax0707]

Same issue.
After enabling Pi-hole it imports 17xx new devices.

Tried pi.alert_dev and pi.alert.

[jokob-sk]

You can try to set Ignored MACs:
NEWDEV_ignored_MACs : List of MACs to ignore. Use % as a wildcard. Ignored devices will not be shown anywhere in the UI or notifications.

For example 02:42:ac:% to filter out docker containers.

[pax0707]

Tried adding both MAC and IP ignore and both get populated again.

Is there a way to specify to only add from certain IP ranges?

[jokob-sk]

Hi @pax0707 ,

There is a setting for that too:

NEWDEV_ignored_IPs:

Please let me know if you are facing issues,
j

[pax0707]

That's an exclude option, was wondering about "include only".

Gonna run a separate instance to play with pihole integration when I get time and report.

[jokob-sk]

Hi @pax0707 ,

Thanks in advance for checking.

In theory you could adjust the SQL query for pihole. Please note, {s-quote} is being replaced by ' during execution and the query might be overwritten during updates. I'm still trying to figure out a SQL query that fits most peoples use-cases and how to handle overriding default settings:

SELECT n.hwaddr AS Object_PrimaryID, {s-quote}null{s-quote} AS Object_SecondaryID, datetime() AS DateTime, na.ip  AS Watched_Value1, n.lastQuery AS Watched_Value2, na.name AS Watched_Value3, n.macVendor AS Watched_Value4, {s-quote}null{s-quote} AS Extra, n.hwaddr AS ForeignKey FROM EXTERNAL_PIHOLE.Network AS n LEFT JOIN EXTERNAL_PIHOLE.Network_Addresses AS na ON na.network_id = n.id WHERE n.hwaddr NOT LIKE {s-quote}ip-%{s-quote} AND n.hwaddr is not {s-quote}00:00:00:00:00:00{s-quote}  AND na.ip is not null

Any help is appreciated,

Thanks,
j