UNFIMP sets devLastIP to 0.0.0.0 when UniFi controller doesn't report client IP (related to #1207, #1717)

[rhussmann]

What installation are you running?

Production (netalertx) 📦

Is there an existing issue for this?

• I have searched the existing open and closed issues and I checked the docs https://docs.netalertx.com/

The issue occurs in the following browsers. Select at least 2.

• Firefox
• Chrome
• Edge
• Safari (unsupported) - PRs welcome
• N/A - This is an issue with the backend

Current Behavior

The UNFIMP plugin (front/plugins/unifi_import/script.py) writes 0.0.0.0 to CurrentScan.scanLastIP whenever the UniFi controller returns no IP for a client. The orchestrator's IP Changed event query (server/scan/session_events.py) treats 0.0.0.0 as a real value (it's not in NULL_EQUIVALENTS), so a spurious IP Changed event with eveIp = 0.0.0.0 fires for every device the UniFi controller doesn't have IP data for, on every scan cycle.

On my live instance this generated 5,082 IP Changed events with eveIp = 0.0.0.0 for a single device (192.168.11.190) over 65 days — about 80 per day. Across the system, 96% of all IP Changed events had eveIp = 0.0.0.0 (1,277 of 1,508 sampled).

Expected Behavior

Devices without UniFi-tracked IPs should not produce IP Changed events. The CurrentScan row should either be empty or use the documented null sentinel, so the orchestrator skips it cleanly.

Steps To Reproduce

1. Deploy NetAlertX with a UniFi controller that doesn't report IP for some clients (e.g., Ethernet-attached devices on UniFi AP-managed switches that don't show in the controller's client list).
2. Configure UNFIMP with valid controller credentials (UNFIMP_HOST, UNFIMP_USERNAME, UNFIMP_PASSWORD, UNFIMP_fullimport = once).
3. Wait ~20 minutes for a UNFIMP scan cycle.
4. Open the Events page and filter by IP Changed.
5. Observe: events with eveIp = 0.0.0.0 for devices that have a real IP recorded elsewhere in the system.

Relevant app.conf settings

docker-compose.yml

Debug or Trace enabled

• I have read and followed the steps in the wiki link above and provided the required debug logs and the log section covers the time when the issue occurs.

Relevant app.log section

  PASTE LOG HERE. Using the triple backticks preserves format.

Docker Logs

  PASTE DOCKER LOG HERE. Using the triple backticks preserves format.

[rhussmann]

Root Cause

front/plugins/unifi_import/script.py, line 243:

def get_ip(*ips: str) -> str:
    for ip in ips:
        if ip and ip != 'null':
            return ip
    return '0.0.0.0'   # <-- bug

The fall-through sentinel is '0.0.0.0'. Every sibling helper in the same file — get_name (line 219), get_parent_mac (line 227), get_port (line 235), and others — correctly returns 'null'. Only get_ip is inconsistent.

server/scan/session_events.py line ~260 fires IP Changed events from a cross-join Devices × CurrentScan where:

AND scanLastIP NOT IN ({NULL_EQUIVALENTS_SQL})  -- excludes '', 'null', '(unknown)', '(Unknown)', '(name not found)'
AND scanLastIP <> COALESCE(devLastIP, '')

0.0.0.0 is not in NULL_EQUIVALENTS (see server/const.py), so the filter doesn't exclude it. The result: every UNFIMP cycle produces an IP Changed event whenever UNFIMP reports a 0.0.0.0 for any device.

Suggested Fix

One-line change in front/plugins/unifi_import/script.py:243:

-    return '0.0.0.0'
+    return 'null'

This brings get_ip into line with the documented plugin data contract (docs/PLUGINS_DEV_DATA_CONTRACT.md, "Empty/Null Values" section):

Represent empty values as the literal string null (not Python None, SQL NULL, or empty string)

…and matches the behavior of the OMDSDN plugin (omada_sdn_openapi/script.py:174) and the SYNC plugin's fixed version (commit 086cd303, PR #1244).

Verification

After applying the fix on my live patched instance:

• Running image verified to contain return 'null' (4 occurrences in script.py) and 0 occurrences of return '0.0.0.0'
• After restart, 0 new IP Changed events with eveIp = 0.0.0.0 over the next ~4 hours (multiple UNFIMP cycles)
• Real device IP changes still record correctly (e.g., 192.168.30.24, 192.168.30.23, 192.168.30.22)

Related

• Fake IP change notifications with SYNC plugin enabled on the root Internet device #1207 — Same pattern in the SYNC plugin (fixed in PR sync #1244, commit 086cd303)
• OMDSDNOPENAPI sets devLastIP to null when Omada API does not provide wired client IPs #1717 — Same pattern in the OMDSDNOPENAPI plugin (open, in discussion)

I'm happy to submit a PR with the one-line fix if helpful.

[jokob-sk]

Thanks for the detailed report and fix suggestion. This should be fixed in the next release.
It would be great if you could test the ghcr.io/netalertx/netalertx-dev-unsafe Docker image in ~15 minutes (or once the latest GitHub Action finishes).

⚠️ Please back up everything first, or ideally spin up a separate container (make sure you use a unique PORT and GRAPHQL_PORT if running instances concurrently) with its own DB and config (a copy of your current setup), as database changes may occur.

After updating:

• Click the 🔄 refresh button in the blue header at the top
• Hard refresh your browser cache (shift + reload) to force js and css files reload

Disclaimer: Running the dev container long-term may lead to data loss, as upgrade paths are not guaranteed.

Thanks in advance,
j

[rhussmann]

I've tested this on my local setup and ran it overnight. Over 10.5 hours I can confirm UNFIMP plugin no longer produces any erroneous 0.0.0.0 results, but is still regularly running and returning the other expected data.

Thank you for such a quick response. Looking forward to grabbing this in whatever release it ships with.

[jokob-sk]

Releasing soon -> Closing