NetalertX reporting additional devices

[Deepblue-diver]

I'm running a Draytek Router assigning DHCP addresses that are bound via MAC.
I've added a TPlink RE450 Repeater with DHCP disabled. Whats happening is i'm now getting new devices being discovered that are already present in the main NetalertX my devices screen which are infact duplicates of existing devices. Is there a setting whereby if thwe MAC address is already assigned in my router and present in NetalertX then it will be ignored?

[Deepblue-diver]

These are the scans that i use

[jokob-sk]

Hi, can you give me an example (maybe screenshots) of devices with the same mac reported twice? From memory only one unique mac entry is allowed in the DB. If I misunderstood your request can you clarify with a couple of examples?

[Deepblue-diver]

So my TP Link RE450 is setup on my router with a static IP address bound to MAC of D8-0D-17-0C-84-02 on 192.168.1.111.
I have a device called Gary Acuter setup the same way with a MAC of B8-2D-28-8B-99-46 and an IP of 192.168.1.47.

NetAlertX is reporting the RE450 as both its correct address

but now also the same address as the Gary Acuter Device?

The RE450 has 2 MAC bound IP addresses for 2.4 and 5G on the Router, hence why you are seeing both. However, i hadnt added the 5G address to NetAlertX as a device which i'll do now and se what happens.

[jokob-sk]

great, lmk how that goes. I can see those are different macs, so no duplication at least on those screenshots. The app doesnt check for IP uniqueness, but you can create a workflow to handle same IPs how you see fit: https://docs.netalertx.com/WORKFLOW_EXAMPLES/?h=workflo#example-4-on-new-device-discovery-archive-the-old-device-with-the-same-ip

[Deepblue-diver]

Sorry i'm still confused.
This my IP Binding list on my Router showing 2 entries for my RE450 based on both 2.4 and 5G elements.

This a copy of the ARP Cache table which shows whats connected.

As you can see that match as they should.

This is how NetAlertX is reporting:

So firstly the "unknown" entry is showing a MAC address which is not only incorrect but also picking up an incorrect IP address.
Second, where it says "TP Link RE450" Its reporting the incorrect Mac Address for the device but the correct IP address if that makes sense. In short the 2 devices MAC addresses are being switched and the unknown device is picking up the incorrect IP address.

[jokob-sk]

Thanks for the additional screenshots.

At this point I'd need more detailed logs (Maintenance → Logs) to determine exactly what's happening. The screenshots show the symptom, but not which plugin or scan is updating the device records.

The next release will also include a per-device change log that records which plugin updated which fields and when, which should make issues like this much easier to diagnose. If you'd like, you can test it now by running the ghcr.io/netalertx/netalertx-dev image, or simply wait for the next production release.

In the meantime, I'd suggest checking a few things:

• Open the affected device's Events tab and see if there are any previous IP address changes recorded.
• Run arp-scan from inside the NetAlertX container and compare its output with what your router reports.

You can also follow the plugin troubleshooting guide to collect the relevant logs: https://docs.netalertx.com/DEBUG_PLUGINS/?h=plugin

This should also help uncover a bug more quickly, if there is one.

That information should help narrow down whether this is a discovery issue, or something specific to the RE450.