Hide domains / host from stats

General
21

Is anyone able to help please?

I've ran pihole -r and reset all stats by deleting /etc/pihole/pihole-FTL.db

I'm still seeing client pi-hole querying domain pi-hole?

Sep 21 21:30:02 dnsmasq[19016]: 276 127.0.0.1/52499 query[AAAA] pi-hole from 127.0.0.1
Sep 21 21:30:02 dnsmasq[19016]: 276 127.0.0.1/52499 config pi-hole is NODATA-IPv6
Sep 21 21:30:03 dnsmasq[19016]: 277 127.0.0.1/45144 query[AAAA] pi-hole from 127.0.0.1
Sep 21 21:30:03 dnsmasq[19016]: 277 127.0.0.1/45144 config pi-hole is NODATA-IPv6

Could it be related to my /etc/hosts file?
I feel like I've done something wrong here?

127.0.0.1       pi-hole
::1             localhost ip6-localhost ip6-loopback
ff02::1         ip6-allnodes
ff02::2         ip6-allrouters

127.0.1.1       pi-hole
192.168.0.236   media-pi
192.168.0.169   smart-home-pi

Debug token
i354x135by

24

Looking at your latest debug log, Pi-Hole is working properly and resolving/blocking domains as requested. I don't think this is a Pi-Hole problem, but a behavior of your Pi. Pi-Hole is showing the traffic, but not causing it.

I see you have speedtest added on. From your setup variables:

SPEEDTESTSCHEDULE=1
SPEEDTEST_SERVER=
SPEEDTEST_CHART_DAYS=1

I don't use Speedtest with Pi-Hole, but I wonder if this could be the source of the queries.

This is not quite the case. There are a number of queries that happen from the Pi OS. Gravity updates require loading blocklists, any dig commands done from the Pi terminal, reverse DNS lookups, etc.

25

I don't believe that is correct. 127.0.1.1 is an alternate loopback address and is valid.

26

Yeah I suspected this and removed it. Saw no difference

Thanks for taking a look, I added the speed test just now to see if I'd keep it, the 'problems' were present before I installed it.

Not in the volume I'm seeing though surely?

I am pretty sure I did this in error....should I keep it out?

Something has definitely changed in my install as I never saw queries to domain pi-hole previously?

I've had a play with tcpdump, but in honesty I'm not sure what I'm looking at or how to interpret the results?

27

I guess another question is why am I seeing [AAAA] queries when IPV6 is disabled?

Sep 21 22:25:02 dnsmasq[837]: 4490 127.0.0.1/55082 query[AAAA] pi-hole from 127.0.0.1
Sep 21 22:25:03 dnsmasq[837]: 4491 127.0.0.1/34711 query[AAAA] pi-hole from 127.0.0.1
Sep 21 22:30:02 dnsmasq[837]: 4554 127.0.0.1/52514 query[AAAA] www.duckdns.org from 127.0.0.1
Sep 21 22:30:02 dnsmasq[837]: 4555 127.0.0.1/51649 query[AAAA] pi-hole from 127.0.0.1
Sep 21 22:30:03 dnsmasq[837]: 4557 127.0.0.1/33303 query[AAAA] pi-hole from 127.0.0.1
Sep 21 22:31:56 dnsmasq[837]: 4566 192.168.0.164/45344 query[AAAA] 427093b025427479d2b6990a25454c54.ssm1.internet.sony.tv from 192.168.0.164
Sep 21 22:31:56 dnsmasq[837]: 4568 192.168.0.164/34341 query[AAAA] update.biv.sony.tv from 192.168.0.164
Sep 21 22:35:01 dnsmasq[837]: 4794 127.0.0.1/38860 query[AAAA] www.duckdns.org from 127.0.0.1
Sep 21 22:35:01 dnsmasq[837]: 4795 127.0.0.1/48850 query[AAAA] pi-hole from 127.0.0.1
Sep 21 22:35:02 dnsmasq[837]: 4796 127.0.0.1/52068 query[AAAA] pi-hole from 127.0.0.1
28

Even though you have not enabled IPV6 on your router or in the Pi-Hole install, Pi devices get an IPV6 address when you install the OS. If you don't want to see the AAAA requests (and you probably don't), put this line in your /etc/pihole/pihole-FTL.conf file and restart FTL (sudo service pihole-FTL restart)

AAAA_QUERY_ANALYSIS=no

Reference: Configuration - Pi-hole documentation

29

I would put it back the way it was. That's how it came from the factory...

30

Great thanks. I've added this an no longer see the pi-hole domain queries....I'm still very intrigued as to what / why the domain was being queried!?

So to confirm, my hosts file should look like this

127.0.0.1       pi-hole
::1             localhost ip6-localhost ip6-loopback
ff02::1         ip6-allnodes
ff02::2         ip6-allrouters

127.0.1.1       pi-hole
192.168.0.236   media-pi
192.168.0.169   smart-home-pi

Note the added 127.0.1.1 entry....is this present by default?

31

I believe it was. I've added lines to my hosts files, but they all have this. From memory only, I think this is the name you assigned to the Pi when it was set up. One of mine says Pi-3B, another says PiZeroWH, etc. None match the 127.0.0.1 mapping, which is localhost on all of them.

32

Maybe this is where I've gone wrong, as in mine 127.0.0.1 is the hostname, in my case pi-hole

33

I don't think that has any bearing on your problem. It just changes the name that shows up when you get a request from the loopback IP. If you change this to localhost, the queries will have the new name.

The default for the Pi-Hole install is localhost, which is what you started with in your original post.

34

Hmm ok.
Not really sure where to go from here no to be honest.

35

I don't think you have any Pi-Hole problems. Your Pi-Hole is showing you some network traffic that you didn't expect.

36

Yeah I get that. What I'm not understanding (apologies if I'm just missing something obvious) is why a domain called pi-hole is being queried. Or indeed, what the domain pi-hole actually is?

37

It's your Pi device that you renamed.

127.0.0.1       pi-hole
::1             localhost ip6-localhost ip6-loopback
ff02::1         ip6-allnodes
ff02::2         ip6-allrouters

127.0.1.1       pi-hole
192.168.0.236   media-pi
192.168.0.169   smart-home-pi
38

Sorry but I'm not following.
I'm now seeing pi-hole in my top clients, as opposed to localhost. So thats good.
But I'm also seeing pi-hole in the top domains.
Perhaps it's throwing me off, but I'm seeing, in my logs, a query from client pi-hole to domain pi-hole

39

This is sometimes the case, as has been explained.

Your Pi-Hole is working properly. You will have to do some troubleshooting to see what's making the requests. If I were having this problem, I would do the following:

  1. Clean install of a fresh OS.
  2. Install Pi-Hole and get it running.
  3. Add services to the Pi one by one and see if they are working properly. PiVPN, cron scripts, speedtest, etc.

I don't think we can help you any more in resolving this problem.

41

Sorry, maybe I missed where domain pi-hole was touched on.
I'm absolutely certain my Pi-Hole is working as it should. Flawless infact.
It is more an intrigue now as to what the domain pi-hole actually is.

42

This was already explained above:

44

It is defined in your local.list as well.

-rw-r--r-- 1 root root 42 Sep 21 21:11 /etc/pihole/local.list
   192.168.0.45 pi-hole
   192.168.0.45 pi.hole