PierreGode / MMM-PhoneDetect

Detect if phones or devices are in network and turns on and off mirror display.
MIT License
6 stars 3 forks source link

ARP Poisoning due to massive :80/:443/ICMP requests on 192.168.1.0/24 #8

Open citadella opened 2 months ago

citadella commented 2 months ago

Hello there! I recently installed MMM-PhoneDetect and was enjoying it but it seems there's something hokey about the code. When I have this module turned on I see MASSIVE numbers of requests to, explicitly, 192.168.1.0/24 in the form of :80, :443 and ICMP requests. In my case, my LAN is 172.18.x.x and lives behind a bridged ISP router, so on a public IP and so NMAP requests headed for 192.168.1.0/24 go straight out the WAN. However, it seems then that causes issues with my ISP causing 50-80% packet loss for my router and anything else connected to my ISP router. In looking at your code, it seems you are explicitly specifying 192.168.1.0/24 in your performNmapScan() function, which, I presume, is where the issue is arising:

performNmapScan () { return new Promise((resolve, reject) => { const networkRange = "192.168.1.0/24"; exec(sudo nmap -sn ${networkRange}, (error, stdout) => { if (error) { console.error(MMM-PhoneDetect: Error performing nmap scan: ${error.message}); reject(error); } else { resolve(stdout); } }); }); },

Perhaps you need to dynamically assign that via a query of the local interface IP versus hard-coding it, as obviously everyone will have different local LANs and, at least in my specific case, it's causing loads of issues. Took me a week of troubleshooting my router to identify it was actually an ARP issue from the inside and then going through each and every module to determine it was yours. Learned a lot, I guess, but, yeah, hopefully you can fix this. As a stopgap I've both disabled your modele and created an explicity deny to 192.168.1.0/24 from my LAN.