Thanks @DL6ER.
Thanks for the implementation but I just wanted to ask again what you think about removing the arp flush
from the WEB "Flush network table"?
I still think it is a potential source of false-positive mock devices by the mechanism I described above.
I had a look in the code and the relevant section is in pi-hole/advanced/Scripts/piholeARPTable.sh
# Flush ARP cache to avoid re-adding of dead entries
if ! output=$(ip neigh flush all 2>&1); then
echo -e "${OVER} ${CROSS} Failed to clear ARP cache"
echo " Output: ${output}"
return 1
Thanks for reminding me.
edit Merged