MAC address case sensitivity causes the same device to be reported separately

[Alf-Tupper]

What installation are you running?

Production (netalertx) 📦

Is there an existing issue for this?

• I have searched the existing open and closed issues and I checked the docs https://docs.netalertx.com/

The issue occurs in the following browsers. Select at least 2.

• Firefox
• Chrome
• Edge
• Safari (unsupported) - PRs welcome
• N/A - This is an issue with the backend

Current Behavior

NetAlertX sometimes appears to treat the same device as different when the MAC address is reported using different capitalisation.

The behaviour is somewhat intermittent — it does not happen every time — but I have noticed reports where the same device appears to be connected or disconnected, with the only apparent difference being the capitalisation of the MAC address.

For example, the same device may be reported as:

Device: Example-Device
MAC: AA:BB:CC:DD:EE:FF
IP: 192.168.1.100

and:

Device: Example-Device
MAC: aa:bb:cc:dd:ee:ff
IP: 192.168.1.100

These are the same MAC address, differing only in case.

The Events view can then show what appears to be the same device generating separate connection/disconnection events.

---

The issue was first noticed while running v26.8.5, although I do not know when it was introduced.

I have since upgraded to v26.9.0 to see whether this was a known issue that had been identified and resolved, but the behaviour is still occurring.

The behaviour appears to be hit and miss rather than occurring with every detection.

The main symptom is that reports can sometimes show what appears to be the same device being connected or disconnected, where the only apparent difference between the records is the case used for the MAC address.

Could you confirm whether MAC addresses are expected to be normalised for case before device matching and event processing?

Expected Behavior

The same MAC address should be treated as the same device regardless of whether the hexadecimal characters are reported in upper or lower case.

For example:

AA:BB:CC:DD:EE:FF

and:

aa:bb:cc:dd:ee:ff

should identify the same device and should not result in separate device/event records or contradictory connection/disconnection reports.

Steps To Reproduce

1.Run NetAlertX in Docker using a Portainer Docker Compose Stack.
2.Have a device detected with its MAC address reported using different capitalisation.
3.Allow NetAlertX to process the detections/events.
4.Observe the resulting device/event records.
5.The same physical device may appear with the same MAC address represented in different cases.

Relevant app.conf settings

#-----------------AUTOGENERATED FILE-----------------#
#                                                    #
#         Generated:  2022-12-30_22-19-40            #
#                                                    #
#   Config file for the LAN intruder detection app:  #
#      https://github.com/netalertx/NetAlertX         # 
#                                                    # 
#-----------------AUTOGENERATED FILE-----------------# 
 
# 🔺 Use the Settings UI - only edit when necessary 🔺 
 
# General 
#--------------------------- 
# Scan using interface eth0 
# SCAN_SUBNETS    = ['192.168.1.0/24 --interface=eth0'] 
# 
# Scan multiple interfaces (eth1 and eth0): 
# SCAN_SUBNETS    = [ '192.168.1.0/24 --interface=eth1', '192.168.1.0/24 --interface=eth0' ] 
BACKEND_API_URL='/server' 
DISCOVER_PLUGINS=True 
SCAN_SUBNETS=['--localnet'] 
TIMEZONE='Europe/Berlin' 
LOADED_PLUGINS=['ARPSCAN', 'AVAHISCAN', 'CSVBCKP','DBCLNP', 'DIGSCAN', 'INTRNT', 'MAINT', 'NEWDEV', 'NBTSCAN', 'NSLOOKUP','NTFPRCS', 'SETPWD', 'SMTP', 'SYNC', 'VNDRPDT', 'WORKFLOWS', 'UI'] 
 
DAYS_TO_KEEP_EVENTS=90 
DEV_HIST_DAYS=1 
DEV_HIST_TRACKED=['devMac','devName','devOwner','devType','devVendor','devFavorite','devGroup','devComments','devLastIP','devFQDN','devPrimaryIPv4','devPrimaryIPv6','devVlan','devForceStatus','devStaticIP','devScan','devAlertDown','devCanSleep','devSkipRepeated','devLocation','devIsArchived','devParentMAC','devParentPort','devParentRelType','devReqNicsOnline','devIcon','devSite','devSSID','devSyncHubNode'] 
# Used for generating links in emails. Make sure not to add a trailing slash! 
REPORT_DASHBOARD_URL='update_REPORT_DASHBOARD_URL_setting' 
 
# Make sure at least these scanners are enabled for new installs, other defaults are taken from the config.json 
INTRNT_RUN='schedule' 
ARPSCAN_RUN='schedule' 
NSLOOKUP_RUN='before_name_updates' 
DIGSCAN_RUN='before_name_updates' 
AVAHISCAN_RUN='before_name_updates' 
NBTSCAN_RUN='before_name_updates'

docker-compose.yml

version: "3.8"

services:
  netalertx:
    image: ghcr.io/netalertx/netalertx:26.9.0
    container_name: netalertx
    restart: unless-stopped
    network_mode: "host"
    read_only: true

    cap_drop:
      - ALL

    cap_add:
      - NET_RAW
      - NET_ADMIN
      - NET_BIND_SERVICE
      - CHOWN
      - SETUID
      - SETGID

    volumes:
      - netalertx_data:/data
      - /etc/localtime:/etc/localtime:ro

    environment:
      - PORT=20211
      - TZ=Europe/London

    tmpfs:
      - "/tmp:uid=20211,gid=20211,mode=1700,rw,noexec,nosuid,nodev,async,noatime,nodiratime"

Debug or Trace enabled

• I have read and followed the steps in the wiki link above and provided the required debug logs and the log section covers the time when the issue occurs.

Relevant app.log section

The following log entries show the same device being reported by two scanners using different MAC address capitalisation. The IP address is also identical:

18:15:58 [OMDSDNOPENAPI] [V] Making entry for: AA:BB:CC:DD:EE:FF
18:15:59 [SNMPDSC] IP: 192.168.1.100  MAC: aa:bb:cc:dd:ee:ff

18:20:47 [OMDSDNOPENAPI] [V] Making entry for: AA:BB:CC:DD:EE:FF
18:20:48 [SNMPDSC] IP: 192.168.1.100  MAC: aa:bb:cc:dd:ee:ff

18:25:47 [OMDSDNOPENAPI] [V] Making entry for: AA:BB:CC:DD:EE:FF
18:25:47 [SNMPDSC] IP: 192.168.1.100  MAC: aa:bb:cc:dd:ee:ff

18:30:41 [OMDSDNOPENAPI] [V] Making entry for: AA:BB:CC:DD:EE:FF
18:30:42 [SNMPDSC] IP: 192.168.1.100  MAC: aa:bb:cc:dd:ee:ff

This appears to show the same device being supplied with differently capitalised representations of the same MAC address by different scanners.

Docker Logs

The Docker container logs show the same MAC address case discrepancy as the NetAlertX application logs: OMDSDNOPENAPI reports the MAC in lowercase while SNMPDSC reports the same MAC in uppercase, with the same IP address.

No additional errors relevant to this issue are present in the Docker logs.

[jokob-sk]

Thanks for the report. This should be available/fixed in the next release.
It would be great if you could test the ghcr.io/netalertx/netalertx-dev-unsafe Docker image in ~15 minutes (or once the latest GitHub Action finishes).

⚠️ Please back up everything first, or ideally spin up a separate container (make sure you use a unique PORT and GRAPHQL_PORT if running instances concurrently) with its own DB and config (a copy of your current setup), as database changes may occur.

After updating:

• Click the 🔄 refresh button in the blue header at the top
• Hard refresh your browser cache (shift + reload) to force js and css files reload

👉 If I don’t receive confirmation that this works, I may revert the changes to avoid introducing bugs.

Disclaimer: Running the dev container long-term may lead to data loss, as upgrade paths are not guaranteed.

Thanks in advance,
j

[Alf-Tupper]

Thanks for getting the test image put together so quickly. I've deployed the netalertx-dev-unsafe image successfully, and it's running now.

I'll keep an eye on it and see if the MAC address case-sensitivity issue occurs again.