Laptop Flapping

[Com177]

What installation are you running?

Production (netalertx) 📦

Is there an existing issue for this?

• I have searched the existing open and closed issues and I checked the docs https://docs.netalertx.com/

The issue occurs in the following browsers. Select at least 2.

• Firefox
• Chrome
• Edge
• Safari (unsupported) - PRs welcome
• N/A - This is an issue with the backend

Current Behavior

I have several laptops on my network and none of them, except for the one running Debian OS will have a "Flapping" status. Even when streaming from the internet it will show as flapping.

Expected Behavior

I expect that the Debian laptop should have either an "Online" or "Offline" status. It should not be flapping. My other latops never flap.

Steps To Reproduce

1. Two instances of NetAlertX are running as a containers in Docker/Portainer.
2. Docker/Portainer is running as an LXC container on Proxmox.
3. I have 2 instances running the same way except one is connected to the network using a macvlan with IP/Port: 192.168.1.2:10211. The other is connected to the network from the Portainer IP at Port 20211 (192.168.1.10:20211).

On the latter instance where NetAlertX is connect to the network through the Portainer IP (Port 20211) I can see Portainer listed as a "Device."

and the Debian laptop in the same list is "flapping."

On the instance where NetAlertX is connected to the network (Port 10211) through a macvlan, Portainer does not show up in the device list.

and the Debian laptop is also "flapping."

Why is this the only laptop that is "Flapping" in the device list? All other laptops show up as "online."

Relevant app.conf settings

docker-compose.yml

Debug or Trace enabled

• I have read and followed the steps in the wiki link above and provided the required debug logs and the log section covers the time when the issue occurs.

Relevant app.log section

  PASTE LOG HERE. Using the triple backticks preserves format.

Docker Logs

  PASTE DOCKER LOG HERE. Using the triple backticks preserves format.

[jokob-sk]

Hi there,

Please check the [status definitions in the documentation](https://docs.netalertx.com/DEVICE_DISPLAY_SETTINGS/?h=flappin#status-colors and review the past events for the Debian laptop.

This should help identify why NetAlertX is marking the device as Flapping. The status is based on the device's observed presence history, rather than the operating system or whether it is currently being used for streaming.

If the event history shows unexpected online/offline transitions, please share those events (and the relevant scan/debug logs) so I can investigate further.

[Com177]

Hi!!
OK, I looked through the logs again ( /tmp/log/app.log) and didn't find anything unusual. The nginx log (/tmp/log/nginx-error.log) references the Debian computer (10.2.250.227) about 100 times repeatedly but the log does not seem to be relevant:

Then I read through the documentation again using by Debian laptop. After I was done reading I checked the device status. To my surprise this is what I saw:

As you can see the Debian laptop I am using to read the "online" documentation is "offline." According to the OS "Networks" popup it is connected at 10.2.250.227. How can that be? The below "Device Settings" look fine to me except for the fact that it says "flapping" instead of "offline" like the main page (above) says:

So, this device is "offine" while "flapping" while really being "online" and able to connect to the internet. If you think this is a settings problem here are the settings:

Keep in mind that while I wrote this reply the device was "offline" in the device list and "flapping" in the device description. If there is something I'm missing please let me know. Many thanks!!!

[Com177]

Here are the Arp-Scan (Network Scan) Logs for the Debian laptop and it's flapping:

Here is the AVAHISCAN

So far none of my other laptops (Windows, MAC, Linux Mint) suffers from this problem.

[jokob-sk]

Thanks for the detailed report! "Flapping" (a device toggling online/offline repeatedly) is almost always a presence-detection problem rather than a NetAlertX bug as some devices just don't answer ARP scans reliably even while they're actively online.

A few likely causes and things to try, roughly in order:

1. Enable the ICMP (Status check) plugin as a secondary presence check, in addition to your ARP scan. It pings devices directly instead of relying on the ARP/neighbor cache. See this article for details https://docs.netalertx.com/FIX_OFFLINE_DETECTION/?h=icmp
2. Check power-saving / Wi-Fi settings on the Debian laptop. Many laptops drop out of ARP tables during Wi-Fi power-save or NIC power-management sleep cycles, even while still "connected" and streaming - the OS can go quiet on ARP while keeping the TCP stream alive. Disabling Wi-Fi power management on that laptop (iwconfig power off or the equivalent NetworkManager setting) is a common fix.
3. arp-scan reliability: arp-scan (and ARP generally) is broadcast-based and can miss replies under load, on some Wi-Fi drivers/APs, or when a device is in a low-power state — that inconsistency is normal and is exactly why the ICMP plugin exists as a complementary check rather than a replacement.
4. Check if this article applies: https://docs.netalertx.com/docker-troubleshooting/arp-flux-sysctls

Plugin docs for reference: https://docs.netalertx.com/PLUGINS_OVERVIEW

[Com177]

Thank you for the reply. After a little time figuring out where you were hiding ICMP I installed it and it looks like it is working:

Should ICMP be allowed to update API? If 'yes' how do I make that change?

These are all the changes I made so far. Can you please review my "Device Scanner" settings and my ICMP settings?

ARPSCAN_RUN_TIMEOUT changed from 300 to 360
ARPSCAN_DURATION changed from 0 to 30

The ICMP settings are below is ping or fping better to use?

Also, I noticed that a device not previously discoverable, but added by me into Devices as a "Dummy" device was discovered! It connected and quickly disconnected within seconds. That was great but it didn't show up in the device table as "New" device, why not?

I have a few more questions. There are a few other devices that are not discovered by NetAlertX (so far) after running for a few days. My instance is running in Docker/Portainer and Docker/Portainer is running as an LXC on Proxmox. If I open a terminal window in the NetAlertX container and ping a device and get a response, will that mean that ICMP should find it? Also, if I create a dummy device of a known device (so far not discovered) will that make ICMP to look for it? (Assuming you can ping it.)

Sorry for all the questions, this app really is great!

Thanks!!

[jokob-sk]

Yes, ICMP can update the device presence/status, - the API/update log is only related to front end API endpoints if something has changed - not related to ICMP. ICMP is intended as an additional presence check rather than a replacement for the other discovery methods.

For your settings:

• ARPSCAN_RUN_TIMEOUT=360 - reasonable if your network needs more time to complete the scan.
• `ARPSCAN_DURATION=30- also reasonable, although I would only increase this if you are seeing incomplete/slow ARP scans.
• For ICMP, I would use fping if it is available in your installation. It is designed for checking multiple hosts efficiently. ping is the simpler fallback or if fping isn't reliable enough. See the docs for details.

Regarding the dummy device: adding a device manually does not make ICMP discover it. ICMP checks devices that NetAlertX already knows about; it does not perform network discovery by itself. So creating a dummy device can allow ICMP to check that specific IP, and teh device status, but it will not cause an otherwise unknown device to be discovered and added automatically. See the Remote networks docs for adding multiple network segments and possible downsides and workarounds: https://docs.netalertx.com/REMOTE_NETWORKS/?h=remote

Similarly, if you can successfully ping a device from inside the NetAlertX container, that confirms that the container has network-level ICMP connectivity to that IP. It does not necessarily mean NetAlertX will discover it, because discovery and presence checking are separate processes. As noted in teh above docs:

If a device responds to ping but does not appear in NetAlertX, the most common cause is that the device is located on a different Layer-2 segment, behind a Wi-Fi extender, VPN, VLAN, or router. In these cases, arp-scan may not be able to discover it even though IP connectivity exists.

For the devices that remain undiscovered, I would first check whether the relevant scanner can actually see them.

[jokob-sk]

Also if you find NetAlertX useful, consider sharing the app on forums or socials, at your work, or share a quick review on Reddit or elsewhere to help support the project. See more ideas and how-to in the growth playbook.

[Com177]

I will definitely help get out the word. Your software should be showcased as much a PiHole is. You've added some powerful improvements. I reviewed the power settings on the Debian.

There isn't any information online about "Server Connect" "Timeout Values". I need to go to a Debian forum to see if someone there knows. I suspect it's got to do with http/https and not local network connection timeouts.

As of now nothing flaps anymore and I know my managed switches usually flap. So I'm experimenting with how often I do ARPSCAN and ICMP. I let ARPSCAN run three times for every one time that ICMP runs. I want to see if running ICMP less often makes it less influential to the "Status" in the Device table. I'm probably misunderstanding how it all works but I thought I'd give it a try. I would say that as of now it's running a lot better than before.

Regarding ARPSCAN detection and VLANs I found that keeping the app on a trunk line connected device will allow it to successfully detect devices only one hop away. Anything beyond that ARPSCAN can't find from the VLAN it is on unless you intentionally input the subnet search parameters.

A while ago I promised you to deliver a procedure to install NetAlertX on Proxmox using Docker LXC. I was about to do it but you did some major file system changes and I didn't get around to using the updated version until recently. Now that I'm up to date I will organize it into one procedure and post it.

I have an improvement suggestion, add your NetAlertX icon to your list of default icons. If the app can grab an IP it will be found. Here is the svg I'm using. I converted a .png file to .svg.

<svg
   version="1.1"
   id="svg1"
   width="59"
   height="57"
   viewBox="0 0 59 57"
   sodipodi:docname="NAXSmall.png"
   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
   xmlns:xlink="http://www.w3.org/1999/xlink"
   xmlns="http://www.w3.org/2000/svg"
   xmlns:svg="http://www.w3.org/2000/svg">
  <defs
     id="defs1" />
  <sodipodi:namedview
     id="namedview1"
     pagecolor="#ffffff"
     bordercolor="#000000"
     borderopacity="0.25"
     inkscape:showpageshadow="2"
     inkscape:pageopacity="0.0"
     inkscape:pagecheckerboard="0"
     inkscape:deskcolor="#d1d1d1" />
  <g
     inkscape:groupmode="layer"
     inkscape:label="Image"
     id="g1">
    <image
       width="59"
       height="57"
       preserveAspectRatio="none"
       xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADsAAAA5CAYAAACI7VO4AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAK&#10;pUlEQVRoge2ae1BU9xXHv3cfvC6P8FqBQBQTQEJEIVKVhBBMIgmJGTPYJGSS2hltbTslsTXpGIc0&#10;iKNkRKoRYmZipjrKaFKkmtFkwEyCCIpLAQOLIiCoUBYh8t733r2nfyxLEHaXXbjQTtvvzJlh9t7f&#10;OefDPff3vAwR4X9Fon93AvOp/8P+t0oipDOtVuuuGh316lMqQ25dvpyovnJllbtCsZTt6FgcNDLi&#10;PfFejUjEDwUF3R2NimoxxcVdDXzyyaqH4+Kuevn4DHt6eY1KJBJOyNwAgJltB0VETHdXV1h7Xd3j&#10;fZWVSZKLF58KuXYtxlOnc3PKD4D+gIB7A6tWXZEmJ1eErFp1JXL58h88PT1Vs0pwgmYF23v3btCl&#10;oqI3mXPnXvJXKJb6Dg76ioiY2SZlkEi4/oce6hxJSPhH4FtvHU945pnv3NzcdLP1O2PYb8+eXTf0&#10;3nt5j9y6FS41GqWMAJCTxYtEvMbdXXsjLe2b1IMH3w4KCro7G39OwXIcJ2lvbY2syM19P76o6E33&#10;2UR2Unf8/Ab0ubnvJ6enl/j5+/fPxIfDsBzHSb4/c2b9j3v3/unR+vp4F5NJPJOAs9GAh4em9bXX&#10;vnzi3Xf3RUVHNzMM41RZOgRLREzR/v1/8M/P3/ZgT0+wZA5K1hERAJWLi6F2xYraNZ999utHY2Ku&#10;OdN+Wlie50UFO3d+uDon58/sbDIVUASgKCDg3saLF5+Kjo5udrSd3UmFWq1m8/Pzt+05cGDreQDO&#10;docEQA9gAEAPgK4xUwLoB6Adu8cZ8QDaAZTeuxeQnp5eIpfLV/I879DkyOaT5ThO8sUXX7y+ffv2&#10;j7q7ux/0BPA7ABsAeNhxSAAGATQBaAXQDTOsCoBh7LrLmA8/ACEAHgEQCyAQgL33gwA0A/gLgBoA&#10;jFhsSk5OrigsLPy9Q0+YiKxac3PzkvDw8A6GYfixOPQAQO8DVA9Q0yRTAFQB0DsALQHIDyCXsXb2&#10;TDrmdyFArwNUAlCjFf9NAH0DUDxA4ontpVLD5s2bD6tUKtYWi8Ws/qjVat0SExMvWUvOHaCPAGqY&#10;AFkDUD5AIQ7ATWcsQL8A6MIEaAVA3wMUZaONWCzmjh8//qbTsBzHiXfv3r3DXkIeAGUDJAfoS4Be&#10;FABysi0GaC9AlwE6AVD0NPcHBQX1tLS0RDoFW1NTkxAeHt4xXTJeAG0A6FGARHMAa3ltXhyLwThw&#10;f0ZGxgm9Xu/iEKxer3fJzMw8KJFIjI4kM1eQE41xEBQAyWSy3tLS0lRbsPd12QqFYmlFRUUyx3EO&#10;Lf14R26apSwkjqi/v9+/uLj451qt1upMdhzKZDKJq6urV7e0tEQJkaRFbgBCAYQBeADmoUUF4C6A&#10;2wBGBIxlMpnEcrl85bVr12JWrFhRO/n6OKxKpfI8f/78Wr1e7ypEYBGAFADPA3gYQADMYysD8+Rk&#10;COYx+DKArwH8KERQADdv3nykvr4+Pj4+vl4kEt1XfONlPDw87FNRUZEsRMAQAH+FefB/HkAEzBMI&#10;NwCuAHwALASwGsAfARQB+JkQgQHo9XrXS5cuPaFWq6fMbsdhKysrk0YmbZ3MVCkAogCIYX6StmZF&#10;zFgC/gBehjAbYkTEyOXylXZhy8vLUwSIBQD4EsB+APccuFcN4G8A9kC4Du/WrVvhPT09wZN/H4et&#10;qakRqpLAASiBuYztAWthBv0MgEao4AAMBoOLQqFYOvn38Q5K6F7YBOAcACmArQB8rVw/DaAA5gWC&#10;0BocHJwc8idYg8HgInRAHsAZmMvnbfwEPAqgGEAh5gbUlgTdN7YmE4C/wzyevgdzb3wEwHEAxrkO&#10;PklzDguYgc/DPLYGASjD/IMC83j8IZFKsXTzZqzcswesv/98hb0/h/kIwrIstmzZguzsbEgkEnh4&#10;eCA7OxtDQ0PzEf4nWVYEE3ckhDRPT0/auXMnqdVqskin09GJEycoICBgzlZLBw4ceMfmEm/BggV3&#10;hQ7o5uZGWVlZNDo6SpNlMpno9OnT5O/vPyewBw8ezLQJm5qaWio06LZt22hkZGQKqEUGg4GOHj1K&#10;oaGhgoIyDMNbW9eO/5GTk/OBUMFYlqWsrCy7oBNL+tixY7RgwQLBYP38/Po7OjrCbcJWV1evEovF&#10;nBCgeXl5pNFopgWd+ITLysooKChIENiUlJTv+/v7/WzC9vX1BcbExDTNJoi7uzvt2rWLtFrtFCCe&#10;50mr1dLw8DDxPG8V+sKFCxQcHDzrEs7Kytql0+lcbcJqNBr3rVu37p9pr+zh4UE7duywWbp9fX20&#10;ZcsWevrpp6mmpsYqsNFopFOnTlFERMSMYWUyWe/Zs2dfmgx6HywR4auvvnpZJpP1zqR0c3NzbYLe&#10;vn2bXn31VRKLxcQwDK1evZpqa2ttlvSZM2do4cKFM3qqzz333PnOzs6waWGVSmVwWlra1848XZZl&#10;qaCggHQ6nU3QdevW0djx4rgtWrSIqqurrbbhOI7kcjmFhYU5W13qvLy8d00mk2haWCLC559/vsnb&#10;23vYEefe3t6Ul5dn8x29c+cObdiwYQqoxSIjI6mqqoo4jrMKLZfLKSIiwmb7yRYVFXWju7s7xBqo&#10;VdiBgQHfZ5999tvpHHt5edHu3butThiIiDo7OykjI4NEIpFdPwkJCVReXm71HeY4jsrKyig2NnZa&#10;YIlEYjx8+PBmW6BWYWlsGPLx8RmyV7qffPIJqVQqq6BtbW2Umpo6LajFYmNjqbKy0qovo9FI5eXl&#10;FBUVZddHenr6KY1G424P1uqRJRExn3766W8zMzMLJp99siyLQ4cO4Y033oBEYn0d0dTUhLa2Nljz&#10;bUsBAQFISkoCw0zdnuN5Hu3t7XjhhRfQ3t4+5XpERERbaWnp84sXL+6wG8TWf0GlUrEbN248KpVK&#10;LceqFBgYSIWFhTY7o7mWQqGg+Pj48YphGIYPDAzsO3ny5Ou2OiWarowtdv369ei1a9eWSSQSo6+v&#10;L3388cc2S3c+ZDKZqKqqihITE4lhGPL09BzNycn5YGRkxMseBzkCy/M8U19fH5eUlFR77Ngxp6aA&#10;cyWO46iuro7i4uL47du35w4MDPiSA6A0HazFlErlgzdu3GiZZy6b0ul0puLi4g8dKd2J5vB3UL29&#10;vcE3b94sWLZsWSrLsiwAZnh4GAbD3O4PisVieHt7QyqVgud5vrOzs7ulpSV/zZo1h6RSqVNbWU59&#10;4dbb2xt8/fr1Xz322GO/6evrC963bx9GRoQ8h5sqV1dXvPLKK1i/fj2uXr1axXFcflxcXJm7u7vW&#10;aWfOlAERQa1WezQ2Nj65adOm78ZOyZyewzprkZGRQ8XFxTldXV0LnS3diTajRkTmby+OHDnyy4iI&#10;iFYXFxe90HtYIpHIxLKsKi0t7euGhobYmeY5o3fWlpRKZUhJSUn6uXPnXmptbY1UKpUhRqNRSjP4&#10;5I9hGPLy8hpdtGjR7eXLl/+QkZFxMiUlpdzV1VU/qyQt/mcLa9Hg4KBvQ0PDssbGxti6urrHGxoa&#10;lnV0dCxWqVSe9sDFYrFJJpP1LVmy5EZcXNzV+Pj4+tjY2Mbo6Ohmob8mFwzWIpPJJNZoNB5qtZod&#10;HR316urqCuvv7/e3BiyVSo2hoaH/lMlkfSzLqlmWVbu5uemc/drUUQkO+5+sfwHT7rxD92eFCQAA&#10;AABJRU5ErkJggg==&#10;"
       id="image1" />
  </g>
</svg>

[jokob-sk]

Glad to hear this is resolved. I'll close this issue then for now. Also thank for the logo and for sharing the app - I'll consider it for a future release :)