Skynet Skynet Statistics Results All mixed Up

[custmblt]

Is ideapad-laptop the last entry in the list from nvram get custom_clientlist

If so, I think it’s a problem when the IP isn’t present in ip neigh output, but Skynet doesn’t check for an empty MAC result before searching the custom_clientlist. Then you always get the last entry from custom_clientlist.

Just a theory.

no, its the 192.168.50.167. Looking at the nvram get custom_clientlist lots of STALE entries all with this name 192.168.50.117 dev br0 lladdr but different IPs but same name. After restoring router again and replacing USB freshly formatted with EXT4 and SkyNet installed no Im only getting just a few results shown, as seen below but the sys log shows a lot more blocking. Any way to flush the these Stale entries? I kind thought by restoring and wiping the USB (SWAP) would do this ? I had a simular problem with Skynet Statistics not showing up and ending being a bad USB but I was able to rule that out by buying new ones and testing them.

 

[custmblt]

I haven't had any outbound traffic blocked by skynet from any of my devices yet to compare, but I'm noticing similar errors in pi-hole (on an internal Linux server). All my devices have manual IPs and some domains defined in LAN>DHCP, but these are getting mixed up somewhere along the line. I'm seeing MAC addresses for IoT devices on a VLAN used for devices like my server on the main (wired) network.
I don't think this is directly caused by skynet. What you're seeing @custmblt is likely just a symptom of something else - something serious but not yet identified.

I really don't know if its Skynet or not but its easy to start there for me because the problem started within hours of the 7.6.4

I haven't had any outbound traffic blocked by skynet from any of my devices yet to compare, but I'm noticing similar errors in pi-hole (on an internal Linux server). All my devices have manual IPs and some domains defined in LAN>DHCP, but these are getting mixed up somewhere along the line. I'm seeing MAC addresses for IoT devices on a VLAN used for devices like my server on the main (wired) network.
I don't think this is directly caused by skynet. What you're seeing @custmblt is likely just a symptom of something else - something serious but not yet identified.

 

[custmblt]

The only way I know to flush 'STALE' entries is to delete '/var/lib/misc/dnsmasq.leases' and restart dnsmasq.

[You can edit the entries out of the 'dnsmasq.lease' files as it is just a text list THEN do the restart of dnsmasq BUT this does not always work ]

rm /var/lib/misc/dnsmasq.leases

service restart_dnsmasq

OK, just tried it no results yet just completely wiped out all the results, will report back after they start to show again in the Skynet Statistics page.

 

[dave14305]

@custmblt please post the output of this command run over SSH:

nvram get custom_clientlist | grep -ioE "<.*>" | sed -E 's/.*<([^>]+)>[^<]*$/\1/; s/[^a-zA-Z0-9.-]//g'

 

[custmblt]

I replaced login name with Asterisk's

this came back:
Promptly_***********-@RT-AX86U_Pro-AC78:/tmp/home/root# nvram get custom_clientlist | grep -ioE "<.*>" | sed -E 's/.*<([^>]+)>[^<]*$/\1/; s/[^a-zA-Z0-9.-]//g'


then hit enter and this came back:
OOMA-PHONE
Promptly_***********-@RT-AX86U_Pro-AC78:/tmp/home/root#

 

[dave14305]

then hit enter and this came back:
OOMA-PHONE

OK, that disproves my theory for your stats results. I don't know if you've changed the Client List or not since your original stats screenshot, but you can probably stop focusing on the USB. The problem is likely in your custom_clientlist or DHCP lease file. You can erase the custom_clientlist by running nvram set custom_clientlist=""; nvram commit (but that will remove any customizations you've done).

See if the problem eventually comes back.

 

[custmblt]

Well, I gave that a shot but cant see that its changed anything but just freeze the router up using the following

`nvram set custom_clientlist=""; nvram commit"

also tried

nvram set custom_clientlist=; nvram commit

in either case no change that I can see. Ill reboot and check back.

 

[dave14305]

Well, I gave that a shot but cant see that its changed anything but just freeze the router up using the following

Sorry, that was my typo in formatting the commands in the post. I corrected it now.

 

[custmblt]

I gave that a try, indeed it cleared all customization's that I did but then locked up the router and i could no longer customize any of the device names any more, that's no good. Anyway I already did a factory restore with no customization to the host names and or device names. Still had the same problem and just made it even harder to understand because I didn't have a network cheat sheet. Just went back to my original restore point has its working with the same messed up entries but at least I can halfway understand whats what Maybe I'm asking too much out of a prosumer router? Maybe pfsense or opnsense on some good hardware would be more reliable and robust. Any other ideas?

 

[dave14305]

Any other ideas?

I sent a pull request to fix the one issue I saw in Skynet. If you want to test it, you can download it with this command:

curl -o /jffs/scripts/firewall https://raw.githubusercontent.com/Adamm00/IPSet_ASUS/02fe5db125f2eab90d69d521d3413de999b1b1ae/firewall.sh
service firewall_restart
# wait a few minutes for skynet to initialize
firewall debug genstats

Then check the WebUI page again to see if anything changed with the confused names.

 

[custmblt]

I'll let the router run on the network for 12 or so hours, then once everything gets messed up again I'll try the command and post results. I sure appreciate the interest you have shown in helping, thank you.

 

[Ripshod]

@dave14305 I've finally had some traffic blocked from my server and, whilst the ip is correct, the device is being identified incorrectly.

10.0.0.15 is "server" not "PlayArea". PlayArea is actually on a guest network (VLAN52) and totally isolated - or so I thought.
Following your advice above:

Gilly@ripshod:/tmp/home/root# firewall debug genstats
/jffs/scripts/firewall: line 7: syntax error: unexpected newline

I'm back to my original thought - this is just a symptom of something else.
@custmblt are you running YazDHCP?

 

[dave14305]

Following your advice above:

I fixed the URL in the curl command. But none of this is meant to help your PiHole issue.

 

[Ripshod]

I fixed the URL in the curl command. But none of this is meant to help your PiHole issue.

When I posted I stated clearly that the wrong identifier was linked to the correct IP in skynet stats.
I've gone through one final rebuild, but without importing the old YazDHCP configs (built manually this time) because I believe the error I saw in skynet, and those in pi-hole, were all related to bad entries in those configs. These errors have been present for years, but are only now showing up all over.

 

[dave14305]

When I posted I stated clearly that the wrong identifier was linked to the correct IP in skynet stats.

I’ve only now finished my first cup of coffee. Apologies.

Try the updated URL, or confirm what the last name in custom_clientlist is in your case. Skynet doesn’t know how to search additional dnsmasq leases created under 3006.102 for SDN networks (and neither does PiHole), so that will be another complication eventually.

 

[Ripshod]

I've installed the script, and I will force some blocks from my server again. Having a freshly reinstalled router is not helping

 

[Ripshod]

Good news. I know it's a bit soon but things seem to have been fixed. Both Skynet and the remote Pi-Hole are correctly identifying my internal IPs to device names.
Seems likely, in my case, the errors were caused by multiple ancient entries stored for years in YazDHCP's exported CSVs. The clue was the IoT devices that haven't been on the main LAN/WLAN for at least two years listed in custom_clientlist. Rebuilding the DHCP server from scratch was loooooong overdue
As it should be:

 

[custmblt]

I sent a pull request to fix the one issue I saw in Skynet. If you want to test it, you can download it with this command:

curl -o /jffs/scripts/firewall https://raw.githubusercontent.com/Adamm00/IPSet_ASUS/02fe5db125f2eab90d69d521d3413de999b1b1ae/firewall.sh
service firewall_restart
# wait a few minutes for skynet to initialize
firewall debug genstats

Then check the WebUI page again to see if anything changed with the confused names.

Well, good news to report and so far no more confused names. The network will get loaded down with devices tomorrow so that will be the true test!. That said normally it would have already got all mixed up by now so there's hope. Thanks so much for the help, Ill keep the post updated if anything changes.

 

[custmblt]

Dave, checked the statistics page this morning and its empty now but the sys log shows a few blocks and a mess of what look like errors but I will admit I have no clue what I'm looking at. Normally the log look fairly clean just not this time. I'm hesitant to post the log here could I directly send it you? Would that be helpful

Thanks

 

[dave14305]

I'm hesitant to post the log here could I directly send it you?

That’s fine with me. Upload it to pastebin.com with an expiration date and PM me the link.