arp-scan fails

[WillScott73]

Scanning devices fails

`Scan Devices
ScanCycle: 1
Timestamp: 2022-10-05 06:30:00

Scanning...
arp-scan Method...
arp-scan: One interface
Traceback (most recent call last):
File "/home/pi/pialert/back/pialert.py", line 1817, in
sys.exit(main())
File "/home/pi/pialert/back/pialert.py", line 96, in main
res = scan_network()
File "/home/pi/pialert/back/pialert.py", line 405, in scan_network
arpscan_devices = execute_arpscan ()
File "/home/pi/pialert/back/pialert.py", line 504, in execute_arpscan
arpscan_output += execute_arpscan_on_interface (SCAN_SUBNETS)
File "/home/pi/pialert/back/pialert.py", line 545, in execute_arpscan_on_interface
return subprocess.check_output (arpscan_args, universal_newlines=True)
File "/usr/lib/python3.9/subprocess.py", line 424, in check_output
return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,
File "/usr/lib/python3.9/subprocess.py", line 528, in run
raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['sudo', 'arp-scan', '--ignoredups', '--retry=6', '192.168.25.0/24', '--interface=eth0']' returned non-zero exit status 1.`

If I run the command manually in the console I see this

root@pihole:/# sudo arp-scan --localnet sudo: error in event loop: Operation not permitted sudo: unexpected child termination condition: 0 root@pihole:/# Interface: eth0, type: EN10MB, MAC: b8:27:eb:7a:ca:f1, IPv4: 192.168.25.5 Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.25.137 54:af:97:b0:5a:90 TP-Link Corporation Limited 192.168.25.137 54:af:97:b0:5a:90 TP-Link Corporation Limited (DUP: 2)

If I run without sudo no error is reported.

root@pihole:/# arp-scan --localnet Interface: eth0, type: EN10MB, MAC: b8:27:eb:7a:ca:f1, IPv4: 192.168.25.5 Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.25.4 d8:5e:d3:de:69:e2 GIGA-BYTE TECHNOLOGY CO.,LTD.

Presumably the pialert code is bombing out because it sees that initial error, even though the scan then completes?

[jokob-sk]

Hi there!

Can you show me how your SCAN_SUBNETS variable in pialert.conf looks like? It should look something like:

SCAN_SUBNETS = '192.168.1.0/24 --interface=eth1'

Also, are you using the docker container? I'm not supporting any other installation method if that's the case. You can check this for if you need a stand-alone install:

https://github.com/leiweibau/Pi.Alert

Thanks in advance!
j

[WillScott73]

Yes I'm using the docker container.

This is my config

SCAN_SUBNETS = '192.168.25.0/24 --interface=eth0'

I presume that the message in the error log

subprocess.CalledProcessError: Command '['sudo', 'arp-scan', '--ignoredups', '--retry=6', '192.168.25.0/24', '--interface=eth0']'

is the command sudo arp-scan --ignoredups --retry=6 '192.168.25.0/24' --interface=eth0 ?

If I run that in a bash shell in the container if gives the same output as in my first post.

sudo arp-scan --localnet sudo: error in event loop: Operation not permitted sudo:

If I remove the sudo it runs without returning an error message.

Thanks

[jokob-sk]

Hey @WillScott73 !

That's strange, I have almost the same configuration and I'm not facing any issues. Is it possible to share your docker-compose (anonymised)?

I've rebuilt the image 3-4 times today and ran a dozen tests without issues...

What architecture are you using this container on? I don't think that should matter, but I can double check on my raspberry PI (I mostly only test on my Synology which is x86).

Cheers!

[WillScott73]

Here you go

`version: '3.4'
services:
pialert:
container_name: pialert
image: jokobsk/pi.alert:latest
network_mode: host
volumes:
- ./config:/home/pi/pialert/config
# - pialert_db:/home/pi/pialert/db
- ./db/pialert.db:/home/pi/pialert/db/pialert.db
- ./log:/home/pi/pialert/log
- /etc/pihole/pihole-FTL.db:/etc/pihole/pihole-FTL.db:ro
- /etc/pihole/dhcp.leases:/etc/pihole/dhcp.leases:ro
# ports:
# - 20211:20211
restart: always
environment:
- TZ=Europe/London
- PORT=20211
# - HOST_USER_ID=1000
# - HOST_USER_GID=1000

volumes:

pialert_db:`

[jokob-sk]

Hi!

Thanks for the details. Nothing out of the ordinary as far as I can tell.

What architecture are you using this container on? I don't think that should matter, but I can double check on my raspberry PI (I mostly only test on my Synology which is x86).

Cheers for the help getting to the bottom of this!

[jokob-sk]

Closing as no reply for 10+ days, will re-open/debug further when/if commenter gets back

[WillScott73]

❯ cat /etc/os-release PRETTY_NAME="Raspbian GNU/Linux 10 (buster)" NAME="Raspbian GNU/Linux" VERSION_ID="10" VERSION="10 (buster)" VERSION_CODENAME=buster ID=raspbian ID_LIKE=debian HOME_URL="http://www.raspbian.org/" SUPPORT_URL="http://www.raspbian.org/RaspbianForums" BUG_REPORT_URL="http://www.raspbian.org/RaspbianBugs"

`❯ cat /proc/cpuinfo
processor : 0
model name : ARMv7 Processor rev 5 (v7l)
BogoMIPS : 57.60
Features : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x0
CPU part : 0xc07
CPU revision : 5

Hardware : BCM2835
Revision : a01041
Serial : 00000000347acaf1
Model : Raspberry Pi 2 Model B Rev 1.1
`

[jokob-sk]

Hi @WillScott73 !

Thanks for the details. I tried running the latest image on my raspberry Pi 4:

Linux raspberrypi 5.10.103-v7l+ #1529 SMP Tue Mar 8 12:24:00 GMT 2022 armv7l GNU/Linux

cat /proc/cpuinfo
processor       : 0
model name      : ARMv7 Processor rev 3 (v7l)
BogoMIPS        : 126.00
Features        : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm crc32
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x0
CPU part        : 0xd08
CPU revision    : 3


....


Hardware        : BCM2711
Revision        : c03112
Serial          : xxxxxxxxxxxxxxxxx
Model           : Raspberry Pi 4 Model B Rev 1.2

....

 cat /etc/os-release
PRETTY_NAME="Raspbian GNU/Linux 10 (buster)"
NAME="Raspbian GNU/Linux"
VERSION_ID="10"
VERSION="10 (buster)"
VERSION_CODENAME=buster
ID=raspbian
ID_LIKE=debian
HOME_URL="http://www.raspbian.org/"
SUPPORT_URL="http://www.raspbian.org/RaspbianForums"
BUG_REPORT_URL="http://www.raspbian.org/RaspbianBugs"

... and again, it worked even with the sudo command in place :/

However, before that I had to:

1. execute the following commands on the Raspberry PI host: [BUG] Fatal Python Error: pyinit_main: can't initialize time linuxserver-archive/docker-papermerge#4 (comment)
2. I also did run sudo apt update && sudo apt upgrade -y and rebooted the Pi.

Can you please give number 1 and number 2 above a go?

Cheers!
j

[WillScott73]

Step 1 fixed it.

Only issue I have now is that it's picked up 256 devices. I have 58. I guess I need to go read the documentation to see how to stop it picking up what I assume are my docker containers.

[jokob-sk]

Great, thanks for the update! Good luck troubleshooting the rest. I'll close this issue for now :)