IP addresses on the dashboard are not replaced by names from the network table if they cannot be associated with a MAC address *immediately*

Help
10

Each client seen for the first time will trigger a name lookup. This is true for both IPv4 and IPv6 clients but can be altered using the config options RESOLVE_IPv4 and RESOLVE_IPv6 (both defaulting to true). Another condition for whether we should resolve a hostname is that said client has to have made at least one query within the last two hours. This to avoid making reverse lookups for clients that are already gone when restarting FTL and reloading the last 24 hours of queries from the database.

The REFRESH_HOSTNAMES option has nothing to do with this first lookup. It only controls said refreshing of the host names which happens on every full hour (compile-time option RERESOLVE_INTERVAL).

Note that you can set DEBUG_RESOLVER=true in pihole-FTL.conf to get detailed explanations in your FTL log about how/where a host name was found.

The procedure of resolving a host name is now the following (function resolveAndAddHostname()):

  1. We query the nameserver at 127.0.0.1 (this will typically be your Pi-hole) for the name using a PTR query. A successful lookup will be logged with the debug message ---> "abc.de" (found internally).

  2. If this returned no result, we try the nameserver(s) configured in resolv.conf. This is necessary to get hotnames associated with docker containers and can be the correct choice if conditional forwarding is not configured and the Pi-hole still using the DNS server installed before Pi-hole (typically the router in at-home installations).

  3. If both above returned NXDOMAIN, we check the option NAMES_FROM_NETDB (defaulting to true) and ask the network table using:

    SELECT name FROM network_addresses
       WHERE name IS NOT NULL AND
             ip = 'ip-addr';

  4. If nothing was found here, there is another fallback checking for a hostname associated with the same device but another IP address (if ambiguous, we choose the most recent one):

    SELECT name FROM network_addresses 
       WHERE name IS NOT NULL AND
             network_id = (SELECT network_id FROM network_addresses
                                  WHERE ip = 'ip-addr')
       ORDER BY lastSeen DESC LIMIT 1;

  5. If all these lookups fail, we return with "hostname not known".

Point 4 above answers

A restart of FTL should pick the address up, too. But, yes, in the present scenario the issue comes from that IPv6 hostnames once found (or not) stay there forever. This default was chosen as more and more operating systems (I think Apple started the discussion, Windows entered and some Linux flavors followed) started to make IPv6 privacy extensions the default and quickly filled each small home network with several dozens of new addresses every few hours, resulting in a lot of lookups that have to be done on the full hour.

The option REFRESH_HOSTNAMES was added here:

It is open for discussion if we should add maybe a fourth option REFRESH_HOSTNAMES=IPV6-RECENT reducing the activity requirement to maybe 30 minutes for IPv6 addresses. The related previous discussion is here:

1 Like