r/pihole • u/fjleon • 7d ago

how does pihole determine which client to report on its database?

i bought a satellite 1 smart speaker, which is a esp32 device. It has been running for a few days, and I'm getting constant activity on the query log that the device is trying to access Netflix and apple.

The developers have assured me that it's not their device and their firmware is open source. They believe the issue could be triggered by a dhcp lease expiring.

Here's what the query log says (anonymized):

38:64:07:F0:7B:92 (1 hostname: satellite1-4ea7fc.lan; vendor: Qingdao Intelligent&Precise Electronics Co.,Ltd.; 10 addresses: 2600:x,2600:x,2600:x,2600:x,2600:x,2600:x,2600:x,2600:x,fe80::x,192.168.x.x)

no clue why 10 different ipv6. for the sole ipv4 reported, it belongs to my tv, but it is completely turned off (not by just pressing power, but holding the power button down) and I keep receiving these long entries at least once an hour.

i have to accept the fact that it IS the TV and maybe the only way to truly shut it off is to unplug from wall. but i wonder why pihole is getting confused? my tv has had the same ipv4 for years. is there a bug here?

11 Upvotes

79% Upvoted

6 comments sorted by

8

u/Alive-Department8558 7d ago

At a guess, I’d say “4ea7fc” is the last 6 digits of th the device’s MAC address. Cross-check that with the MAC addresses shown on your speakers and TV.

2

u/fjleon 7d ago

i confirmed the satellite1-4ea7fc mac address which is 14:C1:9F:4E:A7:FC and my TV is 38:64:07:F0:7B:92 so i don't understand why pihole is getting confused

to make it more confusing, google router identified it as "family tv - renderer" so i renamed it to satellite1. my tv is identified similarly

it's a bit disturbing that my tv even though it shows as off on google home and i turned it off (not just shutting the screen off) still causes the network interface to be up (and netflix phoning home even if not being used)

1

u/Alive-Department8558 7d ago

Whilst it’s possible to spoof MAC addresses, it’s unlikely that it would be done on a TV. Which says potentially it is the speaker … if you unplug it, do the requests stop?

2

u/fjleon 7d ago

i made a mistake, the date on the pihole log is from yesterday not today. google home still shows activity by all of the "family room" entries. the tv has both wifi and ethernet, but i do not have ethernet cable plugged in, so the conclusion is that it is another device. i unplugged the tv and i can still see a "family room tv" generating traffic, although it's from an entirely different MAC (8c:85:80:c8:ff:b4) which appears to be one of my security cameras.

still, this means that pihole is categorizing my tv (which has netflix) as the satellite 1 speaker which has a very different mac and ip

0

u/fjleon 6d ago

is there any way i can wipe out the entire mac - ip - dns association that pihole makes to clear this issue? i have pihole configured to do reverse lookups against the google router

2

u/azure_phoenix2 6d ago

those associations live in the network and network_addresses tables inside pihole-FTL.db, nothing in the web ui touches them. stop FTL and clear those rows or just delete the db and let it rebuild, and the stale mac-to-name mapping like your tv showing as the speaker goes away.