Warning of invalid hostnames due to colon in MAC addresses?

Help
1

Expected Behaviour:

Pi-Hole should recognize MAC address hostnames as valid, including the colons that are part of those hostnames.

Actual Behaviour:

Pi-Hole DHCP is issuing warnings that hostnames have invalid characters when (to my limited understanding) the invalid characters are colons that are part of the hostnames:

image
image991×243 5.26 KB

I'm getting multiple of these. Once I see the warning, I can't find the corresponding IP address or hostname in the DHCP leases.

I'm not sure if this is of great concern or not.

Debug Token:

https://tricorder.pi-hole.net/YIVz3fdz/

2

This is correct.

Valid hostnames contain only letters (a to z), digits (0 to 9), and hyphens (- except as the first character).

You are trying to enter an invalid hostname.
96:e2:f0:a9:e8:69 is a MAC address, but not a valid hostname.

EDIT:

3

Isnt it the IP 192.168.2.89 from the screenshot above?

If its a MAC for a hostname:

It's also be a randomized MAC. Media Access Control (MAC) address randomization is a privacy technique whereby mobile devices rotate through random hardware addresses in order to prevent observers from singling out their traffic or physical location from other nearby devices.

Most likely candidate is a phone or maybe even a pad thats advertising its MAC address as a hostname when it negotiates a DHCP lease from Pi-hole.
Very weird if that would be normal behaviour for such a device.
Depending phone/pad, you can most of the times change this name.
In Android for example:
Settings-->About phone

4

So (apologies if I'm pulling this too far off topic), is there a way to figure out what the device is from the Pi-Hole end? I'm not very experienced with these things, but if it's connected to my wifi, is there a way to see what it's sending to and getting back from the network?

Here's a recent invalid hostname (which I now understand != the MAC address, thank you!):

image
image976×177 4.28 KB

I can see it in the DHCP table as "unknown":

image

...is there a way to see what it's doing on the network so I can deduce what device it is?

5

The device is 192.168.2.184 (that's the device IP).
As you already said, Pi-hole is not receiving a hostname (showed as "unknown").

I'm not sure where this hostname comes from. Probably from the device itself.

Please generate and upload a debug log, then post just the token URL that is generated after the log is uploaded by running the following command from the Pi-hole host terminal:

pihole -d

or do it through the Web interface: Tools > Generate Debug Log

6

I've cleared the warning, so I'm not sure if the log will be of much use at this point, but here it is and I can upload a new log when the error recurs:

https://tricorder.pi-hole.net/vyubfT45/

7

Tail/follow the logs live while greping for the IP with below:

sudo tail -F /var/log/pihole/pihole.log | grep 192.168.2.184

Grab a suspect and browse to below dummy.domain to see if it generates a corresponding log entry:

https://dummy.domain

EDIT: Or the other way around, grep for the dummy.domain and see if it returns that IP:

sudo tail -F /var/log/pihole/pihole.log | grep dummy.domain

8

Both your logs show warnings like:

[2025-01-04 20:46:06.073 49387/T49424] HOSTNAME WARNING: Host name of client "192.168.2.184" => "12:27:f5:a9:e8:69" contains (at least) one invalid character at position 2
[2025-01-04 20:46:06.093 49387/T49424] INFO: FTL replaced 2 invalid characters with ~ in the query "[invalid~host~name]"

Note that this is just a warning saying Pi-hole received a hostname containing invalid characters. This is not a Pi-hole error and nothing is broken.

I guess the phones are using the fake MAC addresses as names. Check your phone settings and see if you can change the names avoiding invalid character (spaces, accented characters, etc).

Note:

As deHakkelaar already explained, these are fake and randomly generated MAC addresses.

There are no vendors using MAC addresses starting with 96:E2:F0, or 0E:F2:35or 12:27:f5, but your log shows you used these MAC addresses to configure static DHCP leases for your phones.

If you want to use static leases for these devices, I suggest you to disable the MAC randomization inside your local network and use the real MAC addresses.

9

Gotcha -- thanks, both.

I wasn't really assigning static leases to the phones for any good reason, just curiosity/mild obsession with list-making. So I think there's no action required here, since there's probably a decent reason that the MAC addresses are being randomized for security, even if I don't fully understand it.

My takeaways:

  • MAC addresses are not hostnames;
  • Random MAC addresses may be assigned on devices by those devices, and if that's fine, okay then, but don't assign static leases to them because the leases are 'attached' to the MAC addresses and those might change again;
  • A "Warning" is just a warning, at least in this case!
10

All network devices have a unique MAC address hard coded into their firmware.
But can also be supplied/configured with a user/software defined MAC address.
Thats what MAC randomization does on some devices so it becomes harder to track these device when roaming outdoors.

11

Just one more note:

Usually there is no need to use MAC randomization inside your own local network (after all, there will be no privacy gain, since you already know your devices). Also, most operating systems allows to enable/disable MAC randomization per network.

As a result, If you want it is possible to use MAC randomization outside your home and disable it inside your network.

2 Likes
12

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.