Flushing the ARP cache to remove stale entries - Network Overview

See if below ones clear things up a bit :wink:

pi@noads:~ $ sudo lsof
COMMAND PID     USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
[..]
php-cgi 777 www-data    6rr  REG  179,2  1740800 134391 /etc/pihole/pihole-FTL.db
[..]

pi@noads:~ $ grep 'www-data\|pihole' /etc/passwd
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
pihole:x:999:996::/home/pihole:/usr/sbin/nologin

pi@noads:~ $ sudo cat /etc/sudoers.d/pihole
[..]
# Allows the WebUI to use Pi-hole commands
[..]
www-data ALL=NOPASSWD: /usr/local/bin/pihole

pi@noads:~ $ stat /usr/local/bin/pihole
Access: (0755/-rwxr-xr-x)  Uid: (    0/    root)   Gid: (   50/   staff)

pi@noads:~ $ ps -o pid,uid,user,gid,group,cmd -C pihole-FTL -C lighttpd
  PID   UID USER       GID GROUP    CMD
  574    33 www-data    33 www-data /usr/sbin/lighttpd -D -f /etc/lighttpd/light
 8738   999 pihole     996 pihole   /usr/bin/pihole-FTL


pi@noads:~ $ stat /etc/pihole/pihole-FTL.db
Access: (0644/-rw-r--r--)  Uid: (  999/  pihole)   Gid: (  996/  pihole)

EDIT: plus there is communication between the web frontend and the 4711 TCP API backend.