Skip to content

Discovery on Windows: ask table-only neighbours again before listing them - #535

Merged
fstubner merged 2 commits into
mainfrom
feat/arp-sweep
Oct 6, 2026
Merged

fstubner merged 2 commits into
mainfrom
feat/arp-sweep

Conversation

@fstubner

@fstubner fstubner commented Oct 5, 2026

Copy link
Copy Markdown
Owner

What I found

"Devices that ignore ping" turned out not to be a gap: discover already lists neighbour-table entries that didn't answer ping, and the ping sweep itself makes Windows ARP every address, so a silent device ends up in the table. Against an ARP ground truth (SendARP to every address in the /24) discover missed none of 22 devices, 5 of which only answer ARP.

The real problem was the opposite: devices that had left were listed as present. On 2026-10-06 discover returned 26 hosts; 4 of them (two Tuya plugs and two others) were stale table entries (Stale/Delay/Probe), failed three SendARP lookups in a row afterwards, and Windows then marked them Unreachable.

Fix

On Windows each table-only candidate is asked again with SendARP, in the background while names resolve, and kept only if it answers within 2.5 s. Answers from present devices took 0 to 2,163 ms (one device answered Windows' third ARP retry); a lookup with nothing behind it takes about 4.2 s. Linux and macOS are unchanged, since nothing there has been measured.

Measured (6 interleaved runs each, scored against ARP ground truth taken afterwards)

main this branch
Devices found / missed / extra 23 / 0 / 0 23 / 0 / 0
Median time 1.77 s 1.76 s
Slowest run 2.19 s 3.91 s (a candidate had to time out)

The stale entries had aged out before the A/B ran, so both builds were clean on it; the 4-of-26 case is the earlier observation. The A/B shows the change costs nothing when there is nothing to drop and loses no real device.

Test

a_neighbour_that_does_not_answer_arp_is_dropped asks an unassigned TEST-NET address and requires it to be dropped. With the filter replaced by "keep every candidate", it fails.

…them

Discovery lists neighbour-table entries that did not answer ping, so that
devices ignoring ICMP are still found. On Windows the table also keeps
entries for devices that have left (Stale, Delay, Probe), and those were
reported as present: 4 of 26 hosts on one LAN on 2026-10-06, each failing
three SendARP lookups afterwards.

Each table-only candidate is now asked with SendARP, in the background
while names resolve, and kept only if it answers within 2.5 s. The slowest
real answer measured was 2.2 s (a device answering Windows' third ARP
retry). Linux and macOS are unchanged; not measured there.

A/B against main, 6 interleaved runs each, scored against an ARP ground
truth: both found all 23 devices with no extras; median 1.76 s versus
1.77 s, with one run at 3.9 s when a candidate had to time out. The ghost
entries had aged out by the time of the A/B, so the 4-of-26 case is the
earlier observation, not this run. A test asks an unassigned TEST-NET
address and requires it to be dropped; it fails if candidates are kept.
@github-actions

github-actions Bot commented Oct 5, 2026 •

Copy link
Copy Markdown
Contributor

Site preview: https://pr-535.netscli-site-preview.pages.dev

Built from fda75d0 with NETSCLI_PREVIEW=1 — noindex, and analytics disabled so it does not report into netscli.com's numbers.

Production is unaffected: netscli.com is served from GitHub Pages via pages.yml, which is manual-only.

@fstubner
fstubner merged commit 56205dd into main Oct 6, 2026
16 checks passed
@fstubner
fstubner deleted the feat/arp-sweep branch October 6, 2026 01:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant