Looking at the Top Clients and Top Blocked Clients, its resolving local client names to old devices on my network that are no longer connected, but I can see DNS lookups are still happening.
I would have expected the names to resolve to the correct devices, if they cannot be resolved, then show the IP, not the last name associated with the IP.
My firewall is running my DHCP server, so I can see from that what the names and IPs should be.
Could you provide some examples?
Also, could you clarify what you mean by 'client names resolving to old devices'?
The top clients lists would show either client IPs or client names. It has no concept of devices.
Sure,
so for example I used to have a device called aaa.domain.com on my network with an IP of 192.168.1.100
That device has now gone, but I have a new device called xyz.domain.com with the same IP of 192.168.1.100
When it shows in the dashboad and stats, everything is still showing with the name of aaa.domain.com
Those seem to be generic invented names.
Real examples would be most helpful, together with a screenshot perhaps.
I am sorry I did not know you was looking at my logs files etc.
RokuSrick01 for example, an old device, its been off the network for a good few months,
The last lookup was 2024-11-16 22:36:00 a few seconds ago
Your debug log shows that your Pi-hole could either source local DNS records from its own local DNS records (stored in /etc/pihole/custom.list), or it may ask your router for local names (via Conditional Forwarding to 192.168.200.1).
By chance, there is also a line demonstrating that Pi-hole would correctly resolve local names
Nov 17 02:40:17 dnsmasq[251]: query[A] QHillgrove.<domain> from 192.168.200.209
Nov 17 02:40:17 dnsmasq[251]: /etc/pihole/custom.list QHillgrove.<domain> is 192.168.200.61
As your debug log shows RokuSrick01 is not defined in your custom.list, this could indicate that your router may provide that name.
Let's try to verify that by running an nslookup via your router.
Please share the output of:
nslookup RokuSrick01 192.168.200.1
nslookup <IP.of.RokuSrick01> 192.168.200.1
where you substitute <IP.of.RokuSrick01> with the IP as observed in your Pi-hole's UI.
Would that be the source of your observation?
If so, you'd have to look into your router's name definitions.
If not, there would be a chance that Pi-hole may stick to the name it first saw for that client IP, though that would usually only affect your Pi-hole's Network overview.
You could try to Flush network table via Pi-hole's Settings UI, but it would be better to stop the Pi-hole service before, e.g. by running
sudo systemctl stop pihole-FTL
pihole arpflush
sudo systemctl start pihole-FTL
Hi,
Nslookup returns nothing with regards any of the dead names in my list.
My pfSense FW is only a DNS forwarder, if its used.
Obviously the DHCP server has machine names and Ips, but when I look at the leases, they are all correct and names, IPs and MAC addresses all tally.
I have tried flushing the network table, things, still exist with the old names.
Maybe I let it run for a while now and see what happens.
Please share the results of the following commands:
nslookup RokuSrick01 192.168.200.1
nslookup RokuSrick01 192.168.200.20
sudo grep -ci RokuSrick01 /var/log/pihole/pihole.log
sudo grep -i RokuSrick01 /var/log/pihole/pihole.log | tail -8
Cleaning the local cache has certainly removed all the machine names
The couple of DNS entries I have in my firewall have now started to resolve correctly.
All very odd.
What local cache?
Sorry, maybe cache was the wrong word.
I was meaning Flush Network Table, which I guess its cached.