double entries for some devices

[cybermcm]

Hi there,
I'm new to NetAlertX but so far I really like it, great work!
I'm currently using it in my homelab (4 VLAN).
With standard settings I can discover the VLAN where NetAlertX is installed. I do not get any results from the other VLANs, something I would expect with an ARP scan.
So I enabled NMAPDEV plugin and now I'm getting results from the other VLANs as well, with fake MACs
Problem: I get many double entries for the VLAN where NetAlertX is installed, one with real MAC and one with a fake MAC although most devices have a fixed IP.
How to avoid that?

[jokob-sk]

Hi @cybermcm ,

You could try other plugins which don't require fake MACs, e.g if your router supports SNMP you could use that plugin: https://github.com/netalertx/NetAlertX/tree/main/front/plugins/snmp_discovery

I could also implement:

1. per-plugin SCAN_SUBNETS overrides
2. a regex to exclude IPs/MACs or similar.
3. An option to globally ignore new devices if an existing IP in the DB already exists

Let me know what you are thinking.

Ping @adamoutler if you have thoughts on this.

[adamoutler]

seems like there must be some logic not linking devices together properly. Where might the fake MACs be coming from?

[jokob-sk]

Hey @adamoutler - the behavior is purposeful.

As you know we currently need a mac and it's used to uniquely identify devices. Just thinking ahead how to solve @cybermcm 's and similar setup issues in future.

[adamoutler]

Find last online by- Mac, IP, uuid and associate the record. That's my suggestion

[cybermcm]

Thanks both of you for the fast answer!
@adamoutler: Associate records with same IP seems logical. Same MAC is not possible as nmap isn't able to get it. I know nothing about an UUID, where would this ID come from?
@jokob-sk from your suggestions, excluding a subnet per plugin seems fine in my case. I would ARP scan my main VLAN and use nmap for the rest.