problem with wifi extender - refer to issue #852

[tradexsrl]

What installation are you running?

Production (netalertx) 📦

Did I research?

• I have searched the docs https://docs.netalertx.com/
• I have searched the existing open and closed issues
• I confirm my SCAN_SUBNETS is configured and tested as per https://docs.netalertx.com/SUBNETS

The issue occurs in the following browsers. Select at least 2.

• Firefox
• Chrome
• Other (unsupported) - PRs welcome
• N/A - This is an issue with the backend

What I want to do

hi , thank's for the reply , i readed that doc which say:
Wi-Fi Extenders
Wi-Fi extenders typically create a separate network or subnet, which can prevent network scanning tools like arp-scan from detecting devices behind the extender.
Possible workaround: Scan the specific subnet that the extender uses, if it is separate from the main network.

my wifi extender do not create a separate network and a separate subnet , i have have the same ssid across AP and extender and the ip is 192.168.10.0/24 for my entire network
strange is if inside the container i issue a ping command to 192.168.10.155 and 192.168.10.152 , these ip camera reply to ping
plugin icmp is enabled and configured to use ping but it doesn't discover the two
if i choose the way to create a dummy ip camera i suppose it will work on 127.0.0.1 but my goal with netalertx is to be alerted if a new device will connect also on extender and gets from my dhcp ip in the range of 192.168.10.0/24 (which will be a possible intruder)

Relevant settings you changed

No response

docker-compose.yml

app.log

No response

Debug enabled

• I have read and followed the steps in the wiki link above and provided the required debug logs and the log section covers the time when the issue occurs.

[jokob-sk]

This is expected behavior and comes down to network layers:

• arp-scan works at Layer 2 (ARP broadcast).
  Many Wi-Fi extenders block or proxy ARP broadcasts, even if they use the same SSID and same subnet (192.168.10.0/24). As a result, devices behind the extender are invisible to arp-scan.

• ICMP (ping) works at Layer 3 (routed traffic).
  That’s why you can ping those IP cameras from inside the container, but arp-scan cannot discover them.

• NetAlertX ICMP plugin is not a discovery mechanism.
  ICMP is used to check existing devices (online/offline), not to discover new ones. It has no MAC/vendor info, so it cannot safely create new devices.

Conclusion:
Your extender is effectively breaking Layer-2 visibility. To detect new devices (including potential intruders) behind the extender, you need DHCP-based discovery or router/DHCP integration, not ARP or ICMP alone.

You can of course create dummy devices with the real IPs of the cameras so it will ping them as expected.

[tradexsrl]

many many thank's for clear explanation , now i understand how the netalertx works , one last question , do you have or do you know plugin for dhcp microsoft AD server based and for fritzbox router?

[jokob-sk]

Glad to hear that. See the available plugins here https://docs.netalertx.com/PLUGINS/?h=plugins

Closing as resolved