{"action":"created","issue":{"url":"https://api.github.com/repos/bettercap/bettercap/issues/82","repository_url":"https://api.github.com/repos/bettercap/bettercap","labels_url":"https://api.github.com/repos/bettercap/bettercap/issues/82/labels{/name}","comments_url":"https://api.github.com/repos/bettercap/bettercap/issues/82/comments","events_url":"https://api.github.com/repos/bettercap/bettercap/issues/82/events","html_url":"https://github.com/bettercap/bettercap/issues/82","id":299995893,"number":82,"title":"Seeing duplicate gateway with a random IP and hostname that keeps changing and also random devices","user":{"login":"Neal","id":1039128,"avatar_url":"https://avatars3.githubusercontent.com/u/1039128?v=4","gravatar_id":"","url":"https://api.github.com/users/Neal","html_url":"https://github.com/Neal","followers_url":"https://api.github.com/users/Neal/followers","following_url":"https://api.github.com/users/Neal/following{/other_user}","gists_url":"https://api.github.com/users/Neal/gists{/gist_id}","starred_url":"https://api.github.com/users/Neal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Neal/subscriptions","organizations_url":"https://api.github.com/users/Neal/orgs","repos_url":"https://api.github.com/users/Neal/repos","events_url":"https://api.github.com/users/Neal/events{/privacy}","received_events_url":"https://api.github.com/users/Neal/received_events","type":"User","site_admin":false},"labels":[{"id":797464999,"url":"https://api.github.com/repos/bettercap/bettercap/labels/bug","name":"bug","color":"ee0701","default":true}],"state":"open","locked":false,"assignee":{"login":"evilsocket","id":86922,"avatar_url":"https://avatars1.githubusercontent.com/u/86922?v=4","gravatar_id":"","url":"https://api.github.com/users/evilsocket","html_url":"https://github.com/evilsocket","followers_url":"https://api.github.com/users/evilsocket/followers","following_url":"https://api.github.com/users/evilsocket/following{/other_user}","gists_url":"https://api.github.com/users/evilsocket/gists{/gist_id}","starred_url":"https://api.github.com/users/evilsocket/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/evilsocket/subscriptions","organizations_url":"https://api.github.com/users/evilsocket/orgs","repos_url":"https://api.github.com/users/evilsocket/repos","events_url":"https://api.github.com/users/evilsocket/events{/privacy}","received_events_url":"https://api.github.com/users/evilsocket/received_events","type":"User","site_admin":false},"assignees":[{"login":"evilsocket","id":86922,"avatar_url":"https://avatars1.githubusercontent.com/u/86922?v=4","gravatar_id":"","url":"https://api.github.com/users/evilsocket","html_url":"https://github.com/evilsocket","followers_url":"https://api.github.com/users/evilsocket/followers","following_url":"https://api.github.com/users/evilsocket/following{/other_user}","gists_url":"https://api.github.com/users/evilsocket/gists{/gist_id}","starred_url":"https://api.github.com/users/evilsocket/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/evilsocket/subscriptions","organizations_url":"https://api.github.com/users/evilsocket/orgs","repos_url":"https://api.github.com/users/evilsocket/repos","events_url":"https://api.github.com/users/evilsocket/events{/privacy}","received_events_url":"https://api.github.com/users/evilsocket/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/bettercap/bettercap/milestones/1","html_url":"https://github.com/bettercap/bettercap/milestone/1","labels_url":"https://api.github.com/repos/bettercap/bettercap/milestones/1/labels","id":3018125,"number":1,"title":"2.0.0","description":"The first stable release of this new generation.","creator":{"login":"evilsocket","id":86922,"avatar_url":"https://avatars1.githubusercontent.com/u/86922?v=4","gravatar_id":"","url":"https://api.github.com/users/evilsocket","html_url":"https://github.com/evilsocket","followers_url":"https://api.github.com/users/evilsocket/followers","following_url":"https://api.github.com/users/evilsocket/following{/other_user}","gists_url":"https://api.github.com/users/evilsocket/gists{/gist_id}","starred_url":"https://api.github.com/users/evilsocket/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/evilsocket/subscriptions","organizations_url":"https://api.github.com/users/evilsocket/orgs","repos_url":"https://api.github.com/users/evilsocket/repos","events_url":"https://api.github.com/users/evilsocket/events{/privacy}","received_events_url":"https://api.github.com/users/evilsocket/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":36,"state":"open","created_at":"2018-01-08T01:43:03Z","updated_at":"2018-02-25T04:06:59Z","due_on":"2018-02-28T08:00:00Z","closed_at":null},"comments":8,"created_at":"2018-02-25T04:05:03Z","updated_at":"2018-02-25T13:41:04Z","closed_at":null,"author_association":"NONE","body":"### Description\r\n\r\n`net.show` is showing the gateway twice with the second time with a random IP address and hostname (eg. IP owned by Twitter or Google or AWS). It also shows two IPv4 Multicast devices that did not used to show up until yesterday.\r\n\r\n### Environment\r\n\r\n* macOS High Sierra 10.13.3 Beta (17D25b)\r\n* go version go1.9.4 darwin/amd64\r\n* `bettercap --debug`\r\n\r\n<details><summary>Full debug output</summary><p>\r\n\r\n```\r\nbettercap v2.0.0RC2 (type 'help' for a list of commands)\r\n\r\n[19:33:35] [sys.log] [dbg] env.change: ticker.commands -> 'clear; net.show'\r\n[19:33:35] [sys.log] [dbg] env.change: ticker.period -> '1'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: mac.changer.iface -> '<interface name>'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: mac.changer.address -> '<random mac>'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: net.probe.throttle -> '10'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: arp.spoof.targets -> '<entire subnet>'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: dhcp6.spoof.domains -> 'microsoft.com, goole.com, facebook.com, apple.com, twitter.com'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: dns.spoof.domains -> '*'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: dns.spoof.address -> '<interface address>'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: dns.spoof.all -> 'false'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: net.sniff.verbose -> 'true'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: net.sniff.local -> 'false'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: net.sniff.filter -> 'not arp'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: net.sniff.regexp -> ''\r\n❯ [19:33:35] [sys.log] [dbg] env.change: net.sniff.output -> ''\r\n❯ [19:33:35] [sys.log] [dbg] env.change: net.sniff.source -> ''\r\n❯ [19:33:35] [sys.log] [dbg] env.change: http.server.path -> '.'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: http.server.address -> '<interface address>'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: http.server.port -> '80'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: http.server.certificate -> ''\r\n❯ [19:33:35] [sys.log] [dbg] env.change: http.server.key -> ''\r\n❯ [19:33:35] [sys.log] [dbg] env.change: http.port -> '80'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: http.proxy.address -> '<interface address>'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: http.proxy.port -> '8080'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: http.proxy.script -> ''\r\n❯ [19:33:35] [sys.log] [dbg] env.change: https.port -> '443'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: https.proxy.address -> '<interface address>'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: https.proxy.port -> '8083'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: https.proxy.certificate -> '~/.bettercap-ca.cert.pem'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: https.proxy.key -> '~/.bettercap-ca.key.pem'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: https.proxy.script -> ''\r\n❯ [19:33:35] [sys.log] [dbg] env.change: tcp.port -> '443'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: tcp.address -> ''\r\n❯ [19:33:35] [sys.log] [dbg] env.change: tcp.proxy.address -> '<interface address>'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: tcp.proxy.port -> '8443'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: tcp.proxy.script -> ''\r\n❯ [19:33:35] [sys.log] [dbg] env.change: api.rest.address -> '<interface address>'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: api.rest.port -> '8083'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: api.rest.username -> ''\r\n❯ [19:33:35] [sys.log] [dbg] env.change: api.rest.password -> ''\r\n❯ [19:33:35] [sys.log] [dbg] env.change: api.rest.certificate -> '~/.bcap-api.rest.certificate.pem'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: api.rest.key -> '~/.bcap-api.rest.key.pem'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: wifi.recon.channel -> ''\r\n❯ [19:33:35] [sys.log] [dbg] env.change: wifi.hop.period -> '250'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: wifi.skip-broken -> 'true'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: iface.index -> '8'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: iface.name -> 'en0'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: iface.ipv4 -> '192.168.0.29'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: iface.ipv6 -> 'fd00:bc4d:fb98:1c32:f4bd:c0f2:b8b:b906'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: iface.mac -> 'dc:a9:04:xx:xx:xx'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: gateway.address -> '192.168.0.1'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: gateway.mac -> 'bc:4d:fb:98:1c:32'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: log.debug -> 'true'\r\n❯ [19:33:35] [sys.log] [dbg] env.change: log.silent -> 'false'\r\n❯ [19:33:35] [session.started] {session.started 2018-02-24 19:33:35.509364 -0800 PST m=+0.077244043 <nil>}\r\n❯ [19:33:35] [mod.started] events.stream\r\n❯ [19:33:35] [mod.started] net.recon\r\n❯ [19:33:35] [endpoint.new] Endpoint 192.168.0.24 (appletv) detected as 40:cb:c0:xx:xx:xx.\r\n❯ [19:33:35] [endpoint.new] Endpoint 224.0.0.251 detected as 01:00:5e:00:00:fb.\r\n❯ [19:33:35] [endpoint.new] Endpoint 239.255.255.250 detected as 01:00:5e:7f:ff:fa.\r\n❯ [19:33:38] [endpoint.new] Endpoint 199.59.148.241 detected as bc:4d:fb:98:1c:32 (Hitron Technologies.).\r\n❯ net.show\r\n\r\n+-----------------+-------------------+-----------------------------+-----------------------------+--------+--------+-----------+\r\n|       IP        |        MAC        |            NAME             |           VENDOR            |  SENT  | RECVD  | LAST SEEN |\r\n+-----------------+-------------------+-----------------------------+-----------------------------+--------+--------+-----------+\r\n| 192.168.0.29    | dc:a9:04:xx:xx:xx | en0                         | Apple                       | 17 kB  | 17 kB  | 19:33:35  |\r\n| 192.168.0.1     | bc:4d:fb:98:1c:32 | gateway                     | Hitron Technologies.        | 28 kB  | 1.3 kB | 19:33:35  |\r\n|                 |                   |                             |                             |        |        |           |\r\n| 192.168.0.24    | 40:cb:c0:xx:xx:xx | appletv                     |                             | 0 B    | 0 B    | 19:33:35  |\r\n| 199.59.148.241  | bc:4d:fb:98:1c:32 | r-199-59-148-241.twttr.com. | Hitron Technologies.        | 1.1 kB | 660 B  | 19:33:52  |\r\n| 224.0.0.251     | 01:00:5e:00:00:fb |                             |                             | 0 B    | 0 B    | 19:33:35  |\r\n| 239.255.255.250 | 01:00:5e:7f:ff:fa |                             |                             | 0 B    | 25 kB  | 19:33:35  |\r\n+-----------------+-------------------+-----------------------------+-----------------------------+--------+--------+-----------+\r\n\r\n❯ [19:47:19] [endpoint.lost] Endpoint 199.59.148.241 (r-199-59-148-241.twttr.com.) lost.\r\n❯ [19:47:20] [endpoint.new] Endpoint 54.190.15.71 detected as bc:4d:fb:98:1c:32 (Hitron Technologies.).\r\n❯ [19:47:41] [endpoint.lost] Endpoint 54.190.15.71 (ec2-54-190-15-71.us-west-2.compute.amazonaws.com.) lost.\r\n❯ [19:47:41] [endpoint.new] Endpoint 199.59.148.241 detected as bc:4d:fb:98:1c:32 (Hitron Technologies.).\r\n```\r\n\r\n</p></details>\r\n\r\n---\r\n**Expected behavior:**\r\n\r\n- Should not see the `Hitron Technologies` gateway twice.\r\n- Should not see a Twitter IP address and hostname for the gateway.\r\n- Possibly shouldn't see the last two devices (vendor is IPv4 Multicast - not sure where they are from)\r\n\r\n**Actual behavior:**\r\n\r\n- Seeing the `Hitron Technologies` gateway twice.\r\n- Duplicated gateway shows IP address owned by Twitter and a twttr.com hostname (note: this changes to any other random IP and hostname each time I run bettercap). Every few minutes it \"loses\" this device and then finds it again with another IP address.\r\n- Seeing two IPv4 Multicast devices(?)\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/bettercap/bettercap/issues/comments/368310300","html_url":"https://github.com/bettercap/bettercap/issues/82#issuecomment-368310300","issue_url":"https://api.github.com/repos/bettercap/bettercap/issues/82","id":368310300,"user":{"login":"alexmozzhakov","id":5459149,"avatar_url":"https://avatars0.githubusercontent.com/u/5459149?v=4","gravatar_id":"","url":"https://api.github.com/users/alexmozzhakov","html_url":"https://github.com/alexmozzhakov","followers_url":"https://api.github.com/users/alexmozzhakov/followers","following_url":"https://api.github.com/users/alexmozzhakov/following{/other_user}","gists_url":"https://api.github.com/users/alexmozzhakov/gists{/gist_id}","starred_url":"https://api.github.com/users/alexmozzhakov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexmozzhakov/subscriptions","organizations_url":"https://api.github.com/users/alexmozzhakov/orgs","repos_url":"https://api.github.com/users/alexmozzhakov/repos","events_url":"https://api.github.com/users/alexmozzhakov/events{/privacy}","received_events_url":"https://api.github.com/users/alexmozzhakov/received_events","type":"User","site_admin":false},"created_at":"2018-02-25T13:41:04Z","updated_at":"2018-02-25T13:41:04Z","author_association":"CONTRIBUTOR","body":"@evilsocket Sorry, do you want something specific? "}}
{"actor":{"display_login":"alexmozzhakov"}}