Client doesnt show up in the network overview

Help
1

I have a Raspberry Pi DHCP client named arcade02 rigged for running MAME in demo mode 24/7.
It doesnt appear in the Pi-hole "Network overview" somehow.

Below on the arcade02 client:

$ uptime
 20:59:06 up 70 days, 18:02,  2 users,  load average: 2.26, 2.74, 2.93

$ sudo dhcpcd --test
[..]
wlan0: leased 10.0.0.219 for 3600 seconds
[..]
new_dhcp_server_identifier='10.0.0.2'
[..]
new_host_name='arcade02'
new_ip_address='10.0.0.219'

$ ip -br link show wlan0
wlan0            UP             e8:94:f6:xx:xx:xx <BROADCAST,MULTICAST,UP,LOWER_UP>

Renewing the lease on the client:

$ sudo dhcpcd --rebind
sending signal HUP to pid 457

Below on the Pi-hole host thats doing DHCP for my LAN (another RPi):

$ uptime
 20:51:09 up 29 days, 16:46,  3 users,  load average: 0.20, 0.12, 0.10

$ sudo tail -F /var/log/pihole/pihole.log | grep DHCPACK
[..]
Jul 31 19:56:50 dnsmasq-dhcp[4960]: DHCPACK(eth0) 10.0.0.219 e8:94:f6:xx:xx:xx arcade02

$ sudo grep e8:94:f6:xx:xx:xx /etc/pihole/dhcp.leases
1753988739 e8:94:f6:xx:xx:xx 10.0.0.219 arcade02 01:e8:94:f6:xx:xx:xx

$ ip neighbor show 10.0.0.219
10.0.0.219 dev eth0 lladdr e8:94:f6:xx:xx:xx STALE

$ dig +short @localhost arcade02
10.0.0.219

But no records:

$ sudo pihole-FTL sqlite3 --column --header /etc/pihole/pihole-FTL.db "SELECT * FROM network WHERE hwaddr = 'e8:94:f6:xx:xx:xx'"
$

Any clues?

https://tricorder.pi-hole.net/D9Tp2UwC/

2

Do you see the client on the query log?

3

Yes if I manually query:

2025-07-31 23:29:26 		A	pi-hole.net	arcade02.home.dehakkelaar.nl	101.6 ms`

Strange thing is, now all of a sudden it appeared on the network overview:

$ sudo pihole-FTL sqlite3 --column --header /etc/pihole/pihole-FTL.db "SELECT * FROM network WHERE hwaddr = 'e8:94:f6:xx:xx:xx'"
id  hwaddr             interface  firstSeen   lastQuery   numQueries  macVendor                      aliasclient_id
--  -----------------  ---------  ----------  ----------  ----------  -----------------------------  --------------
20  e8:94:f6:xx:xx:xx  eth0       1753997366  1753997447  6           Tp-Link Technologies Co.,Ltd.

First seen today exactly at the time of the manual query I performed:

$ date -d @1753997366
Thu 31 Jul 23:29:26 CEST 2025

While the client was active way longer before that (at least 70 days from the uptime):

$ sudo zgrep arcade02 /var/log/pihole/pihole.log.5.gz
Jul 26 00:22:04 dnsmasq-dhcp[4960]: DHCPACK(eth0) 10.0.0.219 e8:94:f6:xx:xx:xx arcade02
Jul 26 00:48:28 dnsmasq-dhcp[4960]: DHCPACK(eth0) 10.0.0.219 e8:94:f6:xx:xx:xx arcade02
[..]

And only the queries I manually initiated today are in the DB:

$ sudo pihole-FTL sqlite3 --column --header /etc/pihole/pihole-FTL.db "SELECT * FROM queries WHERE client = '10.0.0.219' ORDER BY id ASC LIMIT 10"
id      timestamp         type  status  domain       client      forward         additional_info  reply_type  reply_time            dnssec  list_id  ede
------  ----------------  ----  ------  -----------  ----------  --------------  ---------------  ----------  --------------------  ------  -------  ---
697773  1753997366.36058  9     2       pi-hole.net  10.0.0.219  127.0.0.1#5335                   13          0.0171234607696533    0                -1
697774  1753997366.334    2     2       pi-hole.net  10.0.0.219  127.0.0.1#5335                   1           0.0191690921783447    0                -1
697776  1753997366.22224  1     2       pi-hole.net  10.0.0.219  127.0.0.1#5335                   4           0.101611852645874     0                -1
697788  1753997447.54899  9     3       pi-hole.net  10.0.0.219                                   13          0.000238895416259766  0                -1
697789  1753997447.54136  2     3       pi-hole.net  10.0.0.219                                   1           0.000199794769287109  0                -1
697790  1753997447.53242  1     3       pi-hole.net  10.0.0.219                                   4           0.000204086303710938  0                -1

Am baffled.
I can imagine this client not having made any queries for a long time as its just looping over arcade roms in demo mode and thats it.
And this Pi-hole instance is only alive for a couple of weeks.
Does the client have to make a query first to show up on the network overview?
Bc I believed Pi-hole pulled clients from the ARP/neighbor table or not?

4

Your debug log shows your network has link-local IPv6 connectivity.

What's the IPv6 LLA of your arcade02?
What OS is that client running?

5 
$ ip -br -6 address show wlan0 scope link
wlan0            UP             fe80::59fe:796d:61e5:XXXX/64

$ hostnamectl
  Operating System: Raspbian GNU/Linux 10 (buster)

Both are Pi-hole nodes:

$ grep nameserver /etc/resolv.conf
nameserver 10.0.0.2
nameserver 10.0.0.4

The other 10.0.0.4 node didnt recieve any queries yet:

$ sudo pihole-FTL sqlite3 --column --header /etc/pihole/pihole-FTL.db "SELECT * FROM queries WHERE client = '10.0.0.219' ORDER BY id ASC LIMIT 10"
$

And the other also doesnt know of its existence yet:

$ sudo pihole-FTL sqlite3 --column --header /etc/pihole/pihole-FTL.db "SELECT * FROM network WHERE hwaddr = 'e8:94:f6:xx:xx:xx'"
$

And on the other node no ARP entries yet:

$ ip neighbor show 10.0.0.219
$
6

ip neighbour showing 10.0.0.219 as STALE (instead of REACHABLE) would suggest that it hasn't used Pi-hole for DNS recently.
Your Pi-hole's logs being void of any DNS queries sent by 10.0.0.219 would even suggest it has never done so.

Does arcade02's LLA register in Pi-hole?
Is arcade02 aware of any IPv6 DNS server addresses?

7

Not that I know of:

And if I run a query with the host command (it doesnt have dig or nslookup), it registers in the logs:

@arcade02:~ $ host pi-hole.net.
pi-hole.net has address 162.244.93.14
pi-hole.net mail is handled by 10 sunfire.mxrouting.net.
pi-hole.net mail is handled by 20 sunfire-relay.mxrouting.net.

@ph6a:~ $ sudo pihole tail
[..]
Aug  1 00:42:50: query[A] pi-hole.net from 10.0.0.219
Aug  1 00:42:50: cached-stale pi-hole.net is 162.244.93.14
Aug  1 00:42:50: forwarded pi-hole.net to 127.0.0.1#5335
Aug  1 00:42:50: query[AAAA] pi-hole.net from 10.0.0.219
Aug  1 00:42:50: cached-stale pi-hole.net is NODATA-IPv6
Aug  1 00:42:50: forwarded pi-hole.net to 127.0.0.1#5335
Aug  1 00:42:50: query[MX] pi-hole.net from 10.0.0.219
Aug  1 00:42:50: cached-stale pi-hole.net is <MX>
Aug  1 00:42:50: cached-stale pi-hole.net is <MX>
Aug  1 00:42:50: forwarded pi-hole.net to 127.0.0.1#5335
Aug  1 00:42:50: reply pi-hole.net is NODATA-IPv6
Aug  1 00:42:50: reply pi-hole.net is 162.244.93.14
Aug  1 00:42:50: reply pi-hole.net is <MX>
Aug  1 00:42:50: reply pi-hole.net is <MX>
8

The second node is still maiden:

@ph6b:~ $ ip neighbor show 10.0.0.219
@ph6b:~ $

I can ping it from arcade02 without making a DNS query to create an ARP entry to see if it shows up in the overview?

EDIT: Oh and below is most likely true as this client only runs MAME roms in demo:

And this first Pi-hole node was setup fresh only two or three weeks ago.
And the second node a week after ... ish.

9

If arcade02 never made a DNS request to Pi-hole, nor contacted it otherwise, then perhaps your observation may be expected.

A ping wouldn't necessarily trigger a change from STALE to REACHABLE, it may just turn to DELAY. I am not sure if that would be sufficient for Pi-hole to list the device in its network overview.

10

I alway believed below was true or not?

11

On the second node before a ping from arcade02:

$ ip neighbor show 10.0.0.219
$

And after:

$ ip neighbor show 10.0.0.219
10.0.0.219 dev eth0 lladdr e8:94:f6:xx:xx:xx REACHABLE

EDIT:

Oh doesnt a DHCP request count as making contact?

12

Now after a day or so, that arcade02 is still present in the ARP cache on the second Pi-hole node (from the ping yesterday):

$ ip neighbor show 10.0.0.219
10.0.0.219 dev eth0 lladdr e8:94:f6:xx:xx:xx STALE

But still no records for the network overview:

$ sudo pihole-FTL sqlite3 --column --header /etc/pihole/pihole-FTL.db "SELECT * FROM network WHERE hwaddr = 'e8:94:f6:xx:xx:xx'"
$

As soon as I run below query on arcade02 addressing the second node 10.0.0.4:

$ date; host pi-hole.net 10.0.0.4
Fri  1 Aug 16:11:41 CEST 2025
Using domain server:
Name: 10.0.0.4
Address: 10.0.0.4#53
Aliases:

pi-hole.net has address 162.244.93.14
pi-hole.net mail is handled by 10 sunfire.mxrouting.net.
pi-hole.net mail is handled by 20 sunfire-relay.mxrouting.net.

The queries appear in the DB after a minute or so on the second node:

$ sudo pihole-FTL sqlite3 --column --header /etc/pihole/pihole-FTL.db "SELECT * FROM queries WHERE client =                                              '10.0.0.219' ORDER BY id ASC LIMIT 10"
id    timestamp         type  status  domain       client      forward         additional_info  reply_type  reply_time                                                       dnssec  list_id  ede
----  ----------------  ----  ------  -----------  ----------  --------------  ---------------  ----------  ------------------                                               ------  -------  ---
2906  1754057502.47804  9     2       pi-hole.net  10.0.0.219  127.0.0.1#5335                   13          0.0216865539550781                                               0                -1
2907  1754057502.44797  2     2       pi-hole.net  10.0.0.219  127.0.0.1#5335                   1           0.0226945877075195                                               0                -1
2908  1754057502.32739  1     2       pi-hole.net  10.0.0.219  127.0.0.1#5335                   4           0.103296041488647                                                0                -1

$ date -d @1754057502
Fri  1 Aug 16:11:42 CEST 2025

And a record for the network overview appeared:

$ sudo pihole-FTL sqlite3 --column --header /etc/pihole/pihole-FTL.db "SELECT * FROM network WHERE hwaddr = 'e8:94:f6:xx:xx:xx'"
id  hwaddr             interface  firstSeen   lastQuery   numQueries  macVendor                      aliasclient_id
--  -----------------  ---------  ----------  ----------  ----------  -----------------------------  --------------
6   e8:94:f6:xx:xx:xx  eth0       1754057502  1754057502  3           Tp-Link Technologies Co.,Ltd.

So to me it looks like only devices that query Pi-hole via DNS appear in the network overview.
But shouldnt the network overview list all devices known in the ARP cache regardless if its querying Pi-hole or not?

13

I am not familiar enough with the code to definitely answer this, but it seems that parse_neighbor_cache() from network-table.c only uses ip, mac and interface from ip neigh show results, i.e. it wouldn't look at STALE, REACHABLE or other states.

To get a better picture of what is happening, you could try to enable ARP processing debug messages:

sudo pihole-FTL --config debug.arp true
1 Like
14

I'll have a go at it later.

15

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.