jokob-sk / NetAlertX

🖧🔍 WIFI / LAN intruder detector. Scans for devices connected to your network and alerts you if new and unknown devices are found.
GNU General Public License v3.0
3.1k stars 187 forks source link

Scan not working #225

Closed tstill88 closed 1 year ago

tstill88 commented 1 year ago

Describe the issue

The only device that shows up is the docker host and my internet ip.

Network is 192.168.0.0/24

Left it running for an hour and several reboots but nothing will show up. I can access pialert from other devices on my network.

No errors in the log, its just not finding anything.

I loaded in the unifi plugin and nmap was able to scan the hosts and find ports but everything remained offline.

Presume i have an issue with network settings on my host / docker?

My setup is ubuntu 22.04 on proxmox.

[2023-05-08 20:06:00] Notifications: 0 [2023-05-08 20:06:00] Last action: internet_IP [2023-05-08 20:06:00] Process: Wait [API] Updating table_devices.json file in /front/api [2023-05-08 20:07:00] Process: Start [2023-05-08 20:07:00] Process: Wait [2023-05-08 20:07:55] START Run: ENABLE_ARPSCAN [2023-05-08 20:07:55] END Run: ENABLE_ARPSCAN [2023-05-08 20:08:00] Process: Start [2023-05-08 20:08:00] Scan Devices: arp-scan start Processing scan results Devices Detected.......: 2 arp-scan detected..: 0 Pi-hole detected...: +0 New Devices........: 1 Devices in this cycle..: 1 Down Alerts........: 0 New Down Alerts....: 0 New Connections....: 0 Disconnections.....: 0 IP Changes.........: 0 Updating DB Info Sessions Events (connect / discconnect) Creating new devices Updating Devices Info b'' Trying to resolve devices without name Pholus entries from prev scans: 0 Names Found (DiG/Pholus): 1 (1/0) Names Not Found : 0 Voiding false (ghost) disconnections Pairing session events (connection / disconnection) Creating sessions snapshot Inserting scan results into OnlineHistory Skipping repeated notifications [2023-05-08 20:08:00] Scan: Nmap for max 150s (2.5min) per device Estimated max delay: 150s (2.5min) [2023-05-08 20:08:02] Scan: Nmap SUCCESS for 192.168.0.207 (1/1) [2023-05-08 20:08:02] Scan: Ports found by NMAP: 6 [2023-05-08 20:08:02] Scan: Nmap newly discovered or changed ports: 2 Check if something to report [API] Updating notification* files in /front/api [API] Updating table_devices.json file in /front/api [API] Updating table_nmap_scan.json file in /front/api [API] Updating table_events_pending_alert.json file in /front/api Changes detected, sending reports Skip email Skip Apprise Skip webhook Skip NTFY Skip PUSHSAFER Skip MQTT [2023-05-08 20:08:02] Notifications: 0 [2023-05-08 20:08:02] Last action: network_scan [2023-05-08 20:08:02] Process: Wait [2023-05-08 20:08:07] Plugins: Number of dynamically loaded plugins: 6 [Plugins] --------------------------------------------- [Plugins] display_name: DHCP Leases [Plugins] description: This plugin is to import devices from dhcp.leases files. [Plugins] --------------------------------------------- [Plugins] display_name: SNMP discovery [Plugins] description: This plugin is used to discover devices via the arp table(s) of a RFC1213 compliant router or switch. [Plugins] --------------------------------------------- [Plugins] display_name: Rogue DHCP [Plugins] description: This plugin is to use NMAP to monitor for rogue DHCP servers. [Plugins] --------------------------------------------- [Plugins] display_name: Services (NMAP) [Plugins] description: This plugin shows all services discovered by NMAP scans. [Plugins] --------------------------------------------- [Plugins] display_name: UniFi import [Plugins] description: This plugin is used to import devices from an UNIFI controller. [Plugins] --------------------------------------------- [Plugins] display_name: Website monitor [Plugins] description: This plugin is to monitor status changes of services or websites. [API] Updating table_settings.json file in /front/api [2023-05-08 20:08:09] Config: Imported new config [API] Updating table_devices.json file in /front/api [API] Updating table_events_pending_alert.json file in /front/api [API] Updating table_language_strings.json file in /front/api

jokob-sk commented 1 year ago

Hi there!

Can you please post the pialert.conf?

This is often due to using the incorrect network adapter if you use arp scan to detect the status of the devices.

Please also double check the Subnets setting as described here: https://github.com/jokob-sk/Pi.Alert/blob/main/docs/SUBNETS.md

J

tstill88 commented 1 year ago

Nevermind, as always find the solution after posting for help. It was the adapter name. eventually found it to be "ens18" rather than eth0 or such. Thanks!

jokob-sk commented 1 year ago

😁👍 I know that feeling, good job figuring it out