A coupe of questions about device discovery and usage

[dominickp]

Hey guys, I finally got scans working and I have a few questions.

1. My DHCP server (not pihole) gives out IPs between 10.246.1.10 and 10.246.1.254, so I ended up landing on the following scan:

SCAN_SUBNETS            = '10.246.1.1/24 --interface=eth0'

My question is: what happens if an attacker were to join my network outside of that range? In fact, I have some devices on my network (some surveillance cameras) that have static IPs outside of the DHCP range (e.g. 10.246.5.x) which don't seem to be picked up due to my more limited CIDR range. But really a bad-actor's IP could be anything as long as they used the gateway and had the same subnet mask, right? Is there recommendations for changing my SCAN_SUBNETS to pick up all devices that could appear regardless of their IP? I know if you widen the CIDR range then scans will take a lot longer. Not sure if there is another strategy for handling those cases.

2. How do I add new entries to the following dropdowns?:

• Owner
• Type
• Group
• Location

Thanks in advance!

[dominickp]

After thinking about #1 a little more, I think I will probably need to expand my SCAN_SUBNETS to encompass everything possible with my subnet mask, which is a shame because its so much bigger than the range used for DHCP. But that would be 10.246.1.1 /16 I think with my current mask.

[jokob-sk]

Hey!

1. Yeah, you would have to extend the mask and use a much lo ger scan cycle delay (maybe once an hour? I didn't test how long it would take to scan 65000 IPs). Not sure if the other scan methods (PiHole) would be better in that case.

2. it's on my todo list, currently only possible via DB modifications.

Thanks,
J

[dominickp]

That huge subnet was a misconfiguration on my part. I changed it to a smaller one and I'm all good now. Unfortunately though, my Linksys router can't tell the difference between 255.255.254.0 and 255.255.255.0, so either way I only get 254 devices. That's probably fine though for my household.

…

On Mon, Dec 19, 2022 at 3:39 PM jokob-sk ***@***.***> wrote: Hey! 1. Yeah, you would have to extend the mask and use a much lo ger scan cycle delay (maybe once an hour? I didn't test how long it would take to scan 65000 IPs). Not sure if the other scan methods (PiHole) would be better in that case. 2. it's on my todo list, currently only possible via DB mobile deification. Thanks, J — Reply to this email directly, view it on GitHub <https://github.com/jokob-sk/Pi.Alert/discussions/127#discussioncomment-4452206>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABCYI2DW4P4WKSFUFHQES5LWODBXHANCNFSM6AAAAAATDRZQF4> . You are receiving this because you authored the thread.Message ID: ***@***.***>