When a new device is connects to my OpenWRT router, I get a notification on Gotify. This serves as a good low-key intrusion detection along with my earlier OpenWRT login alerts.
Heavy lifting was already done by Brandon McFarlin, I had to just modify the code to send messages to Gotify instead of MQTT.
#!/bin/sh
cat << "EOF" > /etc/hotplug.d/dhcp/90-newdev
[ "$ACTION" == "add" ] || exit 0
# [ "$ACTION" == "add" -o "$ACTION" == "update" ] || exit 0
known_macs="/etc/known_macs"
if ! /bin/grep -iq "$MACADDR" "$known_macs"; then
msg="New device detected:
MAC: $MACADDR
IP: $IPADDR
Hostname: $HOSTNAME"
echo "$MACADDR $IPADDR $HOSTNAME" >> /etc/known_macs
curl "http://[Gotify Server]/message?token=[Token]" -F "title=New Device Connected to Router" -F "message=$msg" -F "priority=5"
fi
exit 0
EOFNow, when a new device connects to my router I get a notification on my Gotify client immediately.
