Devices show offline when they are online #1095
-
|
Hi, |
Beta Was this translation helpful? Give feedback.
Replies: 3 comments 16 replies
-
|
You can increase the time out on your scanners (e.g ARPSCAN_TIMEOUT from memory) or supplement your scans with additional scan methods (e.g ICMP scan) to make it more robust. |
Beta Was this translation helpful? Give feedback.
-
|
This is most likely. ARP alone is not entirely perfect. A mix of DNS/ARP/ICMP/etc. can significantly improve the accuracy of the presence reporting. Some devices, like iPhones, do not like being ARP scanned more than once per 15 minutes, and will sometimes still reject it if another device has done an ARP scan recently that "pinged" it. This is a security feature on Apple devices, just as an example. So I recommend taking the time to fine tune your ARP scans, but to also add other scanning functionalities to increase the reliability and accuracy of these reports and for down-detections and alerts. |
Beta Was this translation helpful? Give feedback.
-
|
@slammingprogramming , thanks for the feedback |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the follow-up and glad it's resolved 🙂 |
Beta Was this translation helpful? Give feedback.
-
|
Added this guide to the docs: https://jokob-sk.github.io/NetAlertX/FIX_OFFLINE_DETECTION/ |
Beta Was this translation helpful? Give feedback.
-
Great picture! Glad I could help... :-) |
Beta Was this translation helpful? Give feedback.
-
|
The same issue reappeared after the v26.1.17 update. I've already increased the ARPSCAN_TIMEOUT to 600s, keeping ICNM scan for the home range IP's, but it didn't fix the issue. What else can I do? Thanks.
|
Beta Was this translation helpful? Give feedback.
-
|
There should be a message in docker logs that the container is running as root |
Beta Was this translation helpful? Give feedback.
-
|
I'm using Synology Container Manager. Here is today's project log after restarting the container, but I can't find the "root" mention anywhere. Is it not properly configured? <style> </style>
|
Beta Was this translation helpful? Give feedback.
-
|
Doesn't look like it's running as root. Here is y output: my docker-compose.yml services:
netalertx_fresh:
container_name: netalertx_fresh
image: jokobsk/netalertx:latest
network_mode: "host"
privileged: true
restart: always
volumes:
- ${APP_DATA_LOCATION}/netalertx_fresh/db:/data/db
- ${APP_DATA_LOCATION}/netalertx_fresh/config:/data/config
environment:
- PUID=0
- GUID=100
- PORT=22222
- APP_CONF_OVERRIDE={"SCAN_SUBNETS":"['192.168.1.0/24 --interface=eth1']","GRAPHQL_PORT":"20223","UI_theme":"Light"}
- LOADED_PLUGINS=['ARPSCAN','CSVBCKP','DBCLNP', 'INTRNT','MAINT','NEWDEV','NSLOOKUP','NTFPRCS', 'AVAHISCAN', 'SETPWD','SMTP', 'SYNC', 'VNDRPDT', 'WORKFLOWS', 'UI', 'PIHOLE', 'NMAP', 'DHCPLSS']
tmpfs:
# /tmp is required by php for session save this should be reworked to /services/run/tmp
- "/tmp:uid=20211,gid=20211,mode=1700,rw,noexec,nosuid,nodev,async,noatime,nodiratime" |
Beta Was this translation helpful? Give feedback.
-
|
@jokob-sk , thanks for the feedback. I got it running as root but the issue persists, even with ARPSCAN_TIMEOUT set to 600s. Should these 600s be sufficient? Container log is now as shown below. I also post my docker-compose.yml as I'm not sure if something is missing (I struggle to set the docker-compose.yml as I find the documentation confusing in that regard, finding different versions supposedly for the same purpose). Again, thank you 2026/01/20 23:13:29 stdout Successfully updated IEEE OUI database (112702 entries) My docker-compose.yml |
Beta Was this translation helpful? Give feedback.
-
|
Feel free to open a PR to improve the docs to make it clearer. Please post the LOG_LEVEL='trace' debug of your plugin runs (ARPSCAN and ICMP): https://docs.netalertx.com/DEBUG_PLUGINS/?h=debugging+plugins |
Beta Was this translation helpful? Give feedback.
-
|
Log sent by e-mail. Thanks, @jokob-sk |
Beta Was this translation helpful? Give feedback.
-
|
Finally got to this - your log shows taht no results are returned from ping: try to ssh into the container and run the |
Beta Was this translation helpful? Give feedback.
-
|
@jokob-sk , thanks for the feedback. The issue seams to be related to AdGuard, it's blocking the ping. I disabled it, and the issues I reported disappeared. I waited a few days and enabled AdGuard again yesterday. Until now, 24 hours later, no issues with NetAlert reporting. Weird... I'll make more tests to try to figure out what is happening. Thanks for all the help. Sorry for the trouble. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for reporting back - this might help solve similar issues faster in the future. |
Beta Was this translation helpful? Give feedback.
You can increase the time out on your scanners (e.g ARPSCAN_TIMEOUT from memory) or supplement your scans with additional scan methods (e.g ICMP scan) to make it more robust.