When a new device is connects to my OpenWRT router, I get a notification on Gotify. This serves as a good low-key intrusion detection along with my earlier OpenWRT login alerts.
Heavy lifting was already done by Brandon McFarlin, I had to just modify the code to send messages to Gotify instead of MQTT.
#!/bin/sh
cat << "EOF" > /etc/hotplug.d/dhcp/90-newdev
[ "$ACTION" == "add" ] || exit 0
# [ "$ACTION" == "add" -o "$ACTION" == "update" ] || exit 0
known_macs="/etc/known_macs"
if ! /bin/grep -iq "$MACADDR" "$known_macs"; then
msg="New device detected:
MAC: $MACADDR
IP: $IPADDR
Hostname: $HOSTNAME"
echo "$MACADDR $IPADDR $HOSTNAME" >> /etc/known_macs
curl "http://[Gotify Server]/message?token=[Token]" -F "title=New Device Connected to Router" -F "message=$msg" -F "priority=5"
fi
exit 0
EOF
Now, when a new device connects to my router I get a notification on my Gotify client immediately.
I strive to write low frequency, High quality content on Health, Product Development, Programming, Software Engineering, DIY, Security, Philosophy and other interests. If you would like to receive them in your email inbox then please consider subscribing to my Newsletter.