Device IP address flip-flopping

[derekoharrow]

I have a device, an Amazon Fire TV Cube, that has a DHCP assigned IP address of 192.168.1.71

For some reason, on pretty much every scan, I get events showing saying that the IP Address has changed.

It shows it flipping between 192.168.1.205 and 192.168.1.234

However, in the device details it always shows the last device IP as 192.168.1.71

Any ideas where it's getting this from? I can't find any reference to this mac address elsewhere, nor to the 192.168.1.205/234 IP addresses. They don't even appear on my router as an attached device?

ta

[derekoharrow]

I think I've figured it out.

This FireTV Cube is paired with 2x Amazon Alexas for Home Cinema sound.

It appears that these Alexa's have, occassionally, IP addresses of .205 and .234. Amazon must be doing something funny to link between the FireTV Cube and the Alexas over Wifi and the Cube seems to have 3 IP addresses linked to it.

Weird!

[jokob-sk]

You can disable notifications from that one device if it's being too noisy: https://github.com/jokob-sk/NetAlertX/blob/main/docs/NOTIFICATIONS.md

[tlamik]

I have a multiple devices that are connected more than one NIC, so that devices have multiple NICs with multiple MACs and multiple IPs and I am still getting annoying notifications about IP chnaged. How can I avoid that? I don't want to disable notification for whole device. I would love to check all devices in all networks.

[jokob-sk]

You can filter out the devices/ip or mac ranges you don't want to get notified on. Please check this guide for details: https://github.com/jokob-sk/NetAlertX/blob/main/docs/NOTIFICATIONS.md

An alternative is to play around what columns you want to watch. Check the detailed watched values for individual plugins:

I haven't tested this but you can try unselecting IP - in this case Watched1

[tlamik]

But I have let's say VM connected to two (V)LANs with two different NICs, with two different mac and two different IPs, mac1 - 10.0.0.5 and mac2 - 192.168.5.5. And I want to be notified about both IP addresses, but now it seems that mac1 have 10.0.0.5 and then switch to 192.168.5.5, which is wrong. I am pretty sure, that mac1 have always the same IP address, but NetAlertX (or arp-scan) says it does not.

[jokob-sk]

You can check the history in Integrations > Plugins > History for the given plugin or In Devices > Plugins > Plugin. NetalertX can only report on what arp-scan or other scanners supply to it.