Network table - seeing clients as hostname of router rather than devices

Pi-hole Version vDev (release/v5.0, v4.3.5-500-gdf13b9c) Web Interface Version vDev (release/v5.0, v4.3.2-498-ge620211) FTL Version vDev (release/v5.0, vDev-a4b26c3)

Problem with Beta 5.0:
When looking at my network table - lots of the device that rely on the router for their wifi get identified as such (i.e. broadband.bt.com rather than say home-pc). this occurs with a few other devices as well that pass through the home router in some way (ethernet). I've tried flushing the network table through the gui and manually clearing the network table via the sudo command but the results are still the same.

Its almost like the system sees its coming from the router as the last hop so identifies the traffic via that hostname rather than delving deeper.

Not a big thing - but would be nice to be able to view the network table to reliably see what addresses are assign to what on my network.

Debug Token:
https://tricorder.pi-hole.net/5tctepubnj

1 Like

You can correct this by mapping the IP's to the host names you want to see in either the /etc/hosts file on the Pi, or using the Local DNS records feature in the web GUI. If you assign the host names you want, then the network page will display them.

I'll give that a go - but I think this is an issue that was introduced when I bumped up to the v5 beta. Anychance its something that's on the radar to resolve?

What did you see before for the host names for this subset of clients?

The separate hostname of the devices rather than a multitude being seen as broadband.bt.com

I'm pretty sure this is caused by the addition of support for IPv6 addresses on the network table. The network table uses the most recent (= the last used) IP address a client used to make a query to your Pi-hole when determining the host name. This might have been a GUA address such as 2a00:23c5:... for the three devices you pointed out.

I assume you're using conditional forwarding and/or specified your routers as upstream destination and it may be users your ISP's DNS server itself for IPv6 name resolution resulting in broadband.bt.com as reply.

How could we improve on this? We shouldn't prefer IPv4 addresses.
Should we allow multiple host names per device such as we allow multiple IP addresses per device?

I'm open for ideas.

No conditional forwarding setup as I'm using Pi-hole as my DHCP server. I see the dilemma though and I suppose there is no easy answer.

Top of my head ideas:-

  • Allow multiple hostname per device but allow the ability to define a "preferred" hostname per device where there is multiple
  • Implement some mechanism that identifies if multiple device are coming from the same "hostname" and this tags them to chose the next hostname on the list for them
  • Ability to chose to enable/disable IPv6 on the network table. Or is the the same as enabling on the DHCP settings page?

I second that. Pihole should be agnostic to the IP version as we don't know which the user prefers.

I think this would be a first step, but what what immediately will follow is "multiple/wrong names on dashboard/stats".
This could be addressed by

even when only valid as an alias for the device's IPs in the Web GUI (the order of /etc/hosts, custom.list, alias has to be discussed).

Even if it sounds strange, it might be on purpose that someone gives the same hostname to two different devices in the same network. I would not implement any automatism but rather give the user the choice (as you suggested).

I also wouldn't do that. The network overview is meant as a tool to detect devices on the network that doesn't use pihole. If a device uses IPv6 is a valuable information and I see no need to 'hide' it. If users don't want to see IPv6 on the table the can disable IPv6 in their network.

P.S. Did you

for your pihole?

Nope - as my Pi-hole acts as DHCP so I didn't think that would be required?

I was referring to upstream DNS (not DHCP). What did you put here:

Note this page was not designed to be a network management tool (and is not intended to be such a tool). It is just a quick overview of the clients on your network to show if they are or are not using Pi-hole for DNS. In your case, they are all using Pi-hole for DNS, and Pi-hole should be showing you the client activity for each of these clients by IP.

You can get a simple table of most of this information using the ip neigh command on the Pi.

Ah - in that case no. I'm using Cloudflare and google. I suppose I could use the router as a secondary IPv4 source

Strange... no conditional forwarding and not the router as pihole's upstream DNS. But might be related to IPv6 anyway..

Well, this sort of exists. Try

RESOLVE_IPV6=no

into /etc/pihole/pihole-FTL.conf (create if it does not exist) and restarting with pihole restartdns.

Pi-hole will now stop to resolve IPv6 addresses. It may take some minutes (up to an hour) until you see the update on the network table.

Does broadband.bt.com show up in reverse lookups for those IP addresses at all?

dig -x 192.168.1.144 +short 

Is there a difference to lookups forced through Pi-hole or your router?

dig @192.168.1.252 -x 192.168.1.144 +short 
dig @192.168.1.254 -x 192.168.1.144 +short 

There wasn't much going on in here, nonetheless, I will give a quick update. Pi-hole v5.1 will bring the new config option NAMES_FROM_NETDB to address picking up borked IPv6 host names also for IPv4 devices. Furthermore, we're working on supporting multiple host names per device. As this is a more involved change, this is scheduled for v5.2, however.

See the PR for the rationale of the new config flag:

Excellent! will look forwarding to testing