Hi,
IPv6 and IPv4 clients are showing up separatly, despite entered ips in /etc/hosts.
Before 5.0 clients entered in hosts with ipv4 and ipv6 showed up in top clients summed up for 4+6 (as single entry), now there are 2 entries for same hosts, one for v4 and one for v6
e.g.
laptop-dad 192.168.178....
laptop-dad fe80: ......
BR,
Michael.
Client identification in query logs hasn't changed in Pi-hole 5.0.
Pi-hole is inheriting its client concept from the DNS protocol, where the only piece of information identifying a client is a DNS request's source IP address.
If anything, it has only started with Pi-hole 5.0 to improve on that, but that enhancement currently is somehow limited to the network overview.
The Query Log will likely stay as it is now for a while longer, as it is a direct representation of a DNS query.
Aggregation in Top Clients may be possible by name, but could be misleading, as the association of an IP address to a name may not be static over time.
hm, I have entered the relevant IPv4 and IPv6 of the device in /etc/hosts.
Therefore an aggregation should be possible and reliable.
The addresses are static one ipv4 and ipv6, so there should be no issues in showing up the friendly name of the device only once. I havent seen the current behaviour before 5.0. I dont know why it should be required to distinguish between v4 and v6
A query does not carry a hostname to identify its source, just an IP address, making that IP address the only reliable data.
You may have managed to control hostname to IP association in your network, but that cannot be safely assumed for any network environment.
IPv6 is particularly susceptible here, as it completely lacks the very option to associate a hostname with an IPv6 address upon network address negotiation on the one hand, and it potentially defines a multitude of such addresses that may only be valid for a limited time as controlled by the client on the other.
Manually setting up IPv6 addresses in /etc/hosts may become very tedious if your client works with IPv6 privacy extensions - common validity for those addresses is a day, but some OSs may specify an even lower value (e.g. Ubuntu was on 2 hours when I last checked).
There may be different reasons for you having observed this:
Reverse lookups and Conditional Fowarding have been improved to better consider IPv6, so you may have seen plain IPv6 addresses instead of hostnames in the past, or your clients may have preferred IPv4 over IPv6, or your clients may have by-passed Pi-hole using a different IPv6 server altogether, or any combination of those.
In any case, client association for queries has not been changed - it is based on IP addresses (search the forums, I have explained this behaviour numerous times in the past, be it for Pi-hole 5 or 4).
I have a router provided by a Dutch ISP. When it runs as DHCP server (I switched to Pi-hole's DHCP server now, but that's a different story), it gives correct host names for all devices that have a host name. However, a lot of my IoT devices do not have a host name. When you ask the ISP router for their name, the router tells they are all called broadband.<isp-here>.nl.
When
does that mean that all IoT devices are the same client? This would be wrong. I know that this is telling a story from a (somehow) broken network environment. I just don't think this is okay.
This is probably why Pi-hole is not fusing clients. And never has (I'm using it for about 3 years). And never should!
So then I always habe to sum up ipv4 and ipv6 counts to get a full picrure of my devices ......
A DHCP server doesn't care if multiple IPs belong to the same device as long as there are good reasons to hand out multiple addresses to the same device. DNS servers care even less (they just reply). Binning two (or twenty in the world of IPv6) IPs into the same "device" is fragile. How do you decide? Same host name? I already explained above why this is bad.
Same MAC address? What is with devices intentionally having multiple IPs at once? What is with devices without a visible MAC address (connected through VPN or through some intermediate router)? How to deal with outdated IP-to-MAC information?
The only reliable bit for the DNS server is the IP address. Everything else is a bad compromise.