search

jokob-sk / NetAlertX

🖧🔍 WIFI / LAN intruder detector. Scans for devices connected to your network and alerts you if new and unknown devices are found.
GNU General Public License v3.0
2.84k stars 163 forks source link

Ambiguous devices #252

Closed Sadiqus closed 1 year ago

Sadiqus commented 1 year ago

Describe the issue Hi Sometimes when I restart the router, devices like those in the printscreen appear, sometimes only one position, sometimes 2, 3, 4 positions, and I can't get rid of them in any way. I can't delete them, I can't modify them, they're very annoying, I don't know if it's a bug or a problem on my part. I specify the fact that I have 4 networks that I monitor, 1 lan and 3 vlan.

Paste last few lines from pialert.log

You can use tail -20 /home/pi/pialert/front/log/pialert.log

[2023-06-14 09:04:38] Notifications: 0
[2023-06-14 09:04:38] Last action: network_scan
[2023-06-14 09:04:38] Process: Wait
[2023-06-14 09:04:54] Process: Start
[2023-06-14 09:04:54] Process: Wait
[2023-06-14 09:05:55] Process: Start
[2023-06-14 09:05:55] Process: Wait
[2023-06-14 09:06:56] Process: Start
[2023-06-14 09:06:56] Check Internet IP:
    Retrieving Internet IP:
      xx.xx.xxx.xxx
    Retrieving previous IP:
      xx.xx.xxx.xxx
    No changes to perform
    Skipping Dynamic DNS update
[2023-06-14 09:06:56] Scan Devices:
    arp-scan start
  Processing scan results
    Devices Detected.......: 42
        arp-scan detected..: 40
        Pi-hole detected...: +0
        New Devices........: 0
    Devices in this cycle..: 42
        Down Alerts........: 12
        New Down Alerts....: 0
        New Connections....: 0
        Disconnections.....: 0
        IP Changes.........: 0
  Updating DB Info
    Sessions Events (connect / discconnect)
    Creating new devices
    Updating Devices Info
b''
        Trying to resolve devices without name
          Pholus entries from prev scans: 102
        Names Found (DiG/Pholus): 0 (0/0)
        Names Not Found         : 1
    Voiding false (ghost) disconnections
    Pairing session events (connection / disconnection) 
    Creating sessions snapshot
    Inserting scan results into Online_History
    Skipping repeated notifications
  Check if something to report
    No changes to report
[2023-06-14 09:07:44] Notifications: 0
[2023-06-14 09:07:44] Last action: network_scan
[2023-06-14 09:07:44] Process: Wait
[2023-06-14 09:08:00] Process: Start
[2023-06-14 09:08:00] Process: Wait
[2023-06-14 09:09:01] Process: Start
[2023-06-14 09:09:01] Process: Wait
[2023-06-14 09:10:02] Process: Start
[2023-06-14 09:10:02] Check Internet IP:
    Retrieving Internet IP:
      xx.xx.xxx.xxx
    Retrieving previous IP:
      xx.xx.xxx.xxx
    No changes to perform
    Skipping Dynamic DNS update
[2023-06-14 09:10:02] Scan Devices:
    arp-scan start
  Processing scan results
    Devices Detected.......: 42
        arp-scan detected..: 40
        Pi-hole detected...: +0
        New Devices........: 0
    Devices in this cycle..: 42
        Down Alerts........: 12
        New Down Alerts....: 0
        New Connections....: 0
        Disconnections.....: 0
        IP Changes.........: 0
  Updating DB Info
    Sessions Events (connect / discconnect)
    Creating new devices
    Updating Devices Info
b''
        Trying to resolve devices without name
          Pholus entries from prev scans: 102
        Names Found (DiG/Pholus): 0 (0/0)
        Names Not Found         : 1
    Voiding false (ghost) disconnections
    Pairing session events (connection / disconnection) 
    Creating sessions snapshot
    Inserting scan results into Online_History
    Skipping repeated notifications
  Check if something to report
    No changes to report
[2023-06-14 09:10:51] Notifications: 0
[2023-06-14 09:10:51] Last action: network_scan
[2023-06-14 09:10:51] Process: Wait
[2023-06-14 09:11:06] Process: Start
[2023-06-14 09:11:06] Process: Wait
[2023-06-14 09:12:07] Process: Start
[2023-06-14 09:12:07] Process: Wait
[2023-06-14 09:13:09] Process: Start
[2023-06-14 09:13:09] Check Internet IP:
    Retrieving Internet IP:
      xx.xx.xxx.xxx
    Retrieving previous IP:
      xx.xx.xxx.xxx
    No changes to perform
    Skipping Dynamic DNS update
[2023-06-14 09:13:09] Scan Devices:
    arp-scan start
  Processing scan results
    Devices Detected.......: 42
        arp-scan detected..: 40
        Pi-hole detected...: +0
        New Devices........: 0
    Devices in this cycle..: 42
        Down Alerts........: 12
        New Down Alerts....: 0
        New Connections....: 0
        Disconnections.....: 0
        IP Changes.........: 0
  Updating DB Info
    Sessions Events (connect / discconnect)
    Creating new devices
    Updating Devices Info
b''
        Trying to resolve devices without name
          Pholus entries from prev scans: 102
        Names Found (DiG/Pholus): 0 (0/0)
        Names Not Found         : 1
    Voiding false (ghost) disconnections
    Pairing session events (connection / disconnection) 
    Creating sessions snapshot
    Inserting scan results into Online_History
    Skipping repeated notifications
  Check if something to report
    No changes to report
[2023-06-14 09:13:57] Notifications: 0
[2023-06-14 09:13:57] Last action: network_scan
[2023-06-14 09:13:57] Process: Wait
[2023-06-14 09:14:12] Process: Start
[2023-06-14 09:14:12] Process: Wait
[2023-06-14 09:15:14] Process: Start
[2023-06-14 09:15:14] Process: Wait
[2023-06-14 09:16:16] Process: Start
[2023-06-14 09:16:16] Check Internet IP:
    Retrieving Internet IP:
      xx.xx.xxx.xxx
    Retrieving previous IP:
      xx.xx.xxx.xxx
    No changes to perform
    Skipping Dynamic DNS update
[2023-06-14 09:16:16] Scan Devices:
    arp-scan start
  Processing scan results
    Devices Detected.......: 41
        arp-scan detected..: 39
        Pi-hole detected...: +0
        New Devices........: 0
    Devices in this cycle..: 41
        Down Alerts........: 12
        New Down Alerts....: 0
        New Connections....: 0
        Disconnections.....: 1
        IP Changes.........: 0
  Updating DB Info
    Sessions Events (connect / discconnect)
    Creating new devices
    Updating Devices Info
b''
        Trying to resolve devices without name
          Pholus entries from prev scans: 102
        Names Found (DiG/Pholus): 0 (0/0)
        Names Not Found         : 1
    Voiding false (ghost) disconnections
    Pairing session events (connection / disconnection) 
    Creating sessions snapshot
    Inserting scan results into Online_History
    Skipping repeated notifications
  Check if something to report
     [API] Updating notification_* files in /front/api
     [API] Updating table_devices.json file in /front/api
     [API] Updating table_events_pending_alert.json file in /front/api
     [API] Updating table_custom_endpoint.json file in /front/api
    Changes detected, sending reports
      Skip email
      Skip Apprise
      Skip webhook
      Skip NTFY
      Skip PUSHSAFER
      Skip MQTT
[2023-06-14 09:17:04] Notifications: 0
[2023-06-14 09:17:04] Last action: network_scan
[2023-06-14 09:17:04] Process: Wait
     [API] Updating table_devices.json file in /front/api
     [API] Updating table_events_pending_alert.json file in /front/api
     [API] Updating table_custom_endpoint.json file in /front/api
[2023-06-14 09:17:20] Process: Start
[2023-06-14 09:17:20] Process: Wait
[2023-06-14 09:18:21] Process: Start
[2023-06-14 09:18:21] Process: Wait
[2023-06-14 09:19:22] Process: Start
[2023-06-14 09:19:22] Check Internet IP:
    Retrieving Internet IP:
      xx.xx.xxx.xxx
    Retrieving previous IP:
      xx.xx.xxx.xxx
    No changes to perform
    Skipping Dynamic DNS update
[2023-06-14 09:19:22] Scan Devices:
    arp-scan start
  Processing scan results
    Devices Detected.......: 42
        arp-scan detected..: 40
        Pi-hole detected...: +0
        New Devices........: 0
    Devices in this cycle..: 42
        Down Alerts........: 11
        New Down Alerts....: 0
        New Connections....: 1
        Disconnections.....: 0
        IP Changes.........: 0
  Updating DB Info
    Sessions Events (connect / discconnect)
    Creating new devices
    Updating Devices Info
b''
        Trying to resolve devices without name
          Pholus entries from prev scans: 102
        Names Found (DiG/Pholus): 0 (0/0)
        Names Not Found         : 1
    Voiding false (ghost) disconnections
    Pairing session events (connection / disconnection) 
    Creating sessions snapshot
    Inserting scan results into Online_History
    Skipping repeated notifications
  Check if something to report
     [API] Updating notification_* files in /front/api
     [API] Updating table_devices.json file in /front/api
     [API] Updating table_events_pending_alert.json file in /front/api
     [API] Updating table_custom_endpoint.json file in /front/api
    Changes detected, sending reports
      Skip email
      Skip Apprise
      Skip webhook
      Skip NTFY
      Skip PUSHSAFER
      Skip MQTT
[2023-06-14 09:20:11] Notifications: 0
[2023-06-14 09:20:11] Last action: network_scan
[2023-06-14 09:20:11] Process: Wait
     [API] Updating table_devices.json file in /front/api
     [API] Updating table_events_pending_alert.json file in /front/api
[2023-06-14 09:20:26] Process: Start
[2023-06-14 09:20:26] Process: Wait
[2023-06-14 09:21:28] Process: Start
[2023-06-14 09:21:28] Process: Wait
[2023-06-14 09:22:30] Process: Start
[2023-06-14 09:22:30] Check Internet IP:
    Retrieving Internet IP:
      xx.xx.xxx.xxx
    Retrieving previous IP:
      xx.xx.xxx.xxx
    No changes to perform
    Skipping Dynamic DNS update
[2023-06-14 09:22:30] Scan Devices:
    arp-scan start
  Processing scan results
    Devices Detected.......: 42
        arp-scan detected..: 40
        Pi-hole detected...: +0
        New Devices........: 0
    Devices in this cycle..: 42
        Down Alerts........: 11
        New Down Alerts....: 0
        New Connections....: 0
        Disconnections.....: 0
        IP Changes.........: 0
  Updating DB Info
    Sessions Events (connect / discconnect)
    Creating new devices
    Updating Devices Info
b''
        Trying to resolve devices without name
          Pholus entries from prev scans: 102
        Names Found (DiG/Pholus): 0 (0/0)
        Names Not Found         : 1
    Voiding false (ghost) disconnections
    Pairing session events (connection / disconnection) 
    Creating sessions snapshot
    Inserting scan results into Online_History
    Skipping repeated notifications
  Check if something to report
    No changes to report
[2023-06-14 09:23:18] Notifications: 0
[2023-06-14 09:23:18] Last action: network_scan
[2023-06-14 09:23:18] Process: Wait
[2023-06-14 09:23:33] Process: Start
[2023-06-14 09:23:33] Process: Wait
[2023-06-14 09:24:35] Process: Start
[2023-06-14 09:24:35] Process: Wait
     [API] Updating table_devices.json file in /front/api
[2023-06-14 09:25:36] Process: Start
[2023-06-14 09:25:36] Check Internet IP:
    Retrieving Internet IP:
      xx.xx.xxx.xxx
    Retrieving previous IP:
      xx.xx.xxx.xxx
    No changes to perform
    Skipping Dynamic DNS update
[2023-06-14 09:25:36] Scan Devices:
    arp-scan start
  Processing scan results
    Devices Detected.......: 42
        arp-scan detected..: 40
        Pi-hole detected...: +0
        New Devices........: 0
    Devices in this cycle..: 42
        Down Alerts........: 11
        New Down Alerts....: 0
        New Connections....: 0
        Disconnections.....: 0
        IP Changes.........: 0
  Updating DB Info
    Sessions Events (connect / discconnect)
    Creating new devices
    Updating Devices Info
b''
        Trying to resolve devices without name
          Pholus entries from prev scans: 102
        Names Found (DiG/Pholus): 0 (0/0)
        Names Not Found         : 1
    Voiding false (ghost) disconnections
    Pairing session events (connection / disconnection) 
    Creating sessions snapshot
    Inserting scan results into Online_History
    Skipping repeated notifications
  Check if something to report
    No changes to report
![issue1](https://github.com/jokob-sk/Pi.Alert/assets/136574123/74d5b0bd-d0be-4007-a2f1-88944c3096d9)
![issue1](https://github.com/jokob-sk/Pi.Alert/assets/136574123/103313ee-dbd8-4233-abcb-a19a7a5db245)

Paste your pialert.conf (remove personal info)


# General
#---------------------------
ENABLE_ARPSCAN=True
SCAN_SUBNETS=['10.xxx.xxx.0/24 --interface=eth0','10.xxx.xxx.0/27 --interface=eth0.100','10.xxx.xxx.216/29 --interface=eth0.200','10.xxx.xxx.240/28 --interface=eth0.300']
LOG_LEVEL='verbose'
TIMEZONE='Europe/Bucharest'
ENABLE_PLUGINS=False
PIALERT_WEB_PROTECTION=True
PIALERT_WEB_PASSWORD='confidential'
INCLUDED_SECTIONS=['internet','new_devices','down_devices','events']
SCAN_CYCLE_MINUTES=3
DAYS_TO_KEEP_EVENTS=90
REPORT_DASHBOARD_URL='http://pi.alert'
DIG_GET_IP_ARG='-4 myip.opendns.com @resolver1.opendns.com'
UI_LANG='English'

# Email
#---------------------------
REPORT_MAIL=False
SMTP_SERVER='smtp.gmail.com'
SMTP_PORT=587
REPORT_TO='user@gmail.com'
REPORT_FROM='Pi.Alert <user@gmail.com>'
SMTP_SKIP_LOGIN=False
SMTP_USER='user@gmail.com'
SMTP_PASS='password'
SMTP_SKIP_TLS=False
SMTP_FORCE_SSL=False

# Webhooks
#---------------------------
REPORT_WEBHOOK=False
WEBHOOK_URL='http://n8n.local:5555/webhook-test/aaaaaaaa-aaaa-aaaa-aaaaa-aaaaaaaaaaaa'
WEBHOOK_PAYLOAD='json'
WEBHOOK_REQUEST_METHOD='GET'

# Apprise
#---------------------------
REPORT_APPRISE=False
APPRISE_HOST='http://localhost:8000/notify'
APPRISE_URL='mailto://smtp-relay.sendinblue.com:587?from=user@gmail.com&name=apprise&user=user@gmail.com&pass=password&to=user@gmail.com'
APPRISE_PAYLOAD='html'

# NTFY
#---------------------------
REPORT_NTFY=False
NTFY_HOST='https://ntfy.sh'
NTFY_TOPIC='replace_my_secure_topicname_91h889f28'
NTFY_USER='user'
NTFY_PASSWORD='passw0rd'

# PUSHSAFER
#---------------------------
REPORT_PUSHSAFER=False
PUSHSAFER_TOKEN='ApiKey'

# MQTT
#---------------------------
REPORT_MQTT=False
MQTT_BROKER='192.168.1.2'
MQTT_PORT=1883
MQTT_USER='mqtt'
MQTT_PASSWORD='passw0rd'
MQTT_QOS=0
MQTT_DELAY_SEC=2

# DynDNS
#---------------------------
DDNS_ACTIVE=False
DDNS_DOMAIN='your_domain.freeddns.org'
DDNS_USER='dynu_user'
DDNS_PASSWORD='A0000000B0000000C0000000D0000000'
DDNS_UPDATE_URL='https://api.dynu.com/nic/update?'

# PiHole
#---------------------------
PIHOLE_ACTIVE=False
DHCP_ACTIVE=False

# Pholus
#---------------------------
PHOLUS_ACTIVE=False
PHOLUS_TIMEOUT=120
PHOLUS_FORCE=False
PHOLUS_RUN='once'
PHOLUS_RUN_TIMEOUT=600
PHOLUS_RUN_SCHD='0 4 * * *'
PHOLUS_DAYS_DATA=7

# Nmap
#---------------------------
NMAP_ACTIVE=True
NMAP_TIMEOUT=150
NMAP_RUN='none'
NMAP_RUN_SCHD='0 2 * * *'
NMAP_ARGS='-p -10000'

# API
#---------------------------
API_CUSTOM_SQL='SELECT * FROM Devices WHERE dev_PresentLastScan = 0'

Paste your docker-compose.yml and .env (remove personal info)

docker-compose.yml 

paste_here

.env 

paste_here

Screenshots If applicable, add screenshots to help explain your problem. issue

jokob-sk commented 1 year ago

Hi there!

Thanks for using the app and the detailed description!

Yes, this is an issue in the current build. More details can be found here:

https://github.com/jokob-sk/Pi.Alert/issues/228

If you'd like to test the fix, try deploying the dev container.

https://registry.hub.docker.com/r/jokobsk/pi.alert_dev

Thanks in advance! J

Sadiqus commented 1 year ago

Hi, unfortunately I can't test the dev version, unfortunately I'm not very good at docker, I'm at the beginning, but I tried the version from here:

Hummm, I'll have a look at where to prevent this value to be inserted in the code. In the meantime, try this as a workaround: (make sure you have a backup of the DB/config/original CSV etc.)

  1. Export your devices via Maintenance > Backup / Restore > CSV Export
  2. Remove the incorrect entry.
  3. Import the modified CSV file via Maintenance > Backup / Restore > CSV Import

Hope this helps, j

and it worked for me. Thank you for the wonderful work you do. With appreciation, Sergiu

jokob-sk commented 1 year ago

Sure thing, glad it's resolved 👍 > closing