Hide domains / host from stats

I run pivpn on the same pi as pi-hole, so have a cron job running to ensure my public IP is tied to the static domain name.
This is showing in the stats even though it's added to the exclude list in settings?
And is there a way to have it display pi-hole, rateher thanlocalhost
It actually does say pi-hole in the states? What is that?

IMG_20180919_190737



There you can. Here is how you would do it:

The option removes it (as it states) from :

image

It does not remove it from the Recent queries (unless you put the source of the request - client - in the top client field, but this will remove ALL queries from that client).

Thanks, I had added localhost and it's now hidden :call_me_hand:

What are your thoughts on why client localhost is querying pi-hole so frequently?

Maybe you are running some stats locally that query pi-hole ? Or you left a web browser open on http://pi-hole ?

My Pi-Hole is headless running stretch lite.
With only Pi-Hole and openvpn (PiVPN) installed?
It seems to be querying a ntp domain?

Correct, that's is a standard behavior.

It's basically the system that queries the NTP servers for, well, time synchronization.

Ah ok, so I can add that and duckdns to the exclude list along with the now renamed pi-hole client and it'll not shown in top lists?
Although I'm still unclear why client Pi-Hole is querying domain pi-hole

Yes. However if you add pi-hole to the top-client it will remove all queries originating from pi-hole.

The logic behind it is that something on pi-hole is looking/querying for pi-hole (as a domain).

Pi-hole does what it's designed to do, it resolves the query to the IP.

AAAA is an IPV6 request (so that means that something is trying to resolve the IPV6 address of pi-hole).

Hmm ok,. Not using ipv6 so I'm more confused now!
How can i see / debug what is looking for domain pi-hole from the client?
I think the only queries coming from the Pi-Hole itself should be duckdns and the NTP servers so I'm ok with that.

You can use the Tail option from the menu:

image

This will tell you in real-time what queries what :slight_smile:

Your best option may be to put a packet sniffer on the Pi, and see what traffic is coming and going. If you can tie a DNS request to related traffic, you can typically figure out which process on the Pi is making the request. Wireshark works well.

Never used a packet sniffer, is that a program to install on the Pi-Hole itself or on a Windows machine and monitor?

You can install Wireshark on the Pi directly. The same software will also run on Windows and Mac, just download the correct version for your OS.

https://www.wireshark.org/download.html

Nice one thanks
How easy would it be for me to bork my Pi-Hole, given I've no idea how to use it!?

It would be difficult. Wireshark does not interfere with or change any process, it just monitors and reports network traffic per your configuration, and only when it's running.

Great, I'll give it a bash then!
Thanks for the tip.

Just noticed this is the log....

Sep 19 20:50:30 dnsmasq[864]: 3034 127.0.0.1/41568 query[AAAA] pi-hole from 127.0.0.1 
Sep 19 20:50:30 dnsmasq[864]: 3034 127.0.0.1/41568 /etc/pihole/local.list pi-hole is fddf:e477:fc89:0:249c:4709:200a:33f8

Significant?

And these....?

Sep 19 20:54:09 dnsmasq-dhcp[864]: DHCPREQUEST(eth0) 192.168.0.100 04:d6:aa:60:92:da Sep 19 20:54:09 dnsmasq-dhcp[864]: DHCPACK(eth0) 192.168.0.100 04:d6:aa:60:92:da rich-phone
Sep 19 20:54:12 dnsmasq-dhcp[864]: DHCPREQUEST(eth0) 192.168.0.100 04:d6:aa:60:92:da 
Sep 19 20:54:12 dnsmasq-dhcp[864]: DHCPACK(eth0) 192.168.0.100 04:d6:aa:60:92:da rich-phone

I don't think so. Something on your Pi has requested the domain pi-hole, which was provided from your local list.

What else do you have running on the Pi other than the standard Pi-Hole install? I see pivpn in your first post, and there is a cron job. How often does that job run?

Just PiVPN and Pi-Hole.
Here is the cron

## DuckDns Updater
*/5 * * * * sudo /etc/duckdns/duck.sh >/dev/null 2>&1

Little bump for tips on how to diagnose pi-hole domain queries...

another short update...

I added IGNORE_LOCALHOST=yes to /etc/pihole/pihole-FTL.conf in the hope it might help.

My install now seems to ignore the pi-hole domain and client, but some other clients now only show IP, rather than the client name?

I think this is something to do with IPV6 as a lot of the requests for the domain pi-hole are IPV6 (AAAA if I understand correct?)
I do not use IPV6...I did, but I disabled it...
I think a pihole -r and reconfigure may be needed?