I have created this complementary application to Pi-hole, that I think may be of interest to you.
WIFI / LAN intruder detector.
Scan the devices connected to your WIFI / LAN and alert you the connection of
unknown devices. It also warns the disconnection of "always connected" devices.
How it works
The system continuously scans the network for:
- New devices
- New connections (re-connections)
- "Always Connected" devices down
- Devices IP changes
- Internet IP address changes
Up to three scanning methods are used:
Method 1: arp-scan. The arp-scan system utility is used to search
for devices on the network using arp frames.
Method 2: Pi-hole. This method is optional and complementary to
method 1. If the Pi-hole DNS server is active, Pi.Alert examines its
activity looking for active devices using DNS that have not been
detected by method 1.
Method 3. dnsmasq. This method is optional and complementary to the
previous methods. If the DHCP server dnsmasq is active, Pi.Alert
examines the DHCP leases (addresses assigned) to find active devices
that were not discovered by the other methods.
More info here: https://github.com/pucherot/Pi.Alert
Thank you very much