A phone you don't recognize, a MAC address with no obvious owner, a device name that's just a string of hex — this is the moment most people's mental model of their own network runs out. The good news: you don't need networking expertise to answer this properly, just the right view of what's actually connected.
Why "just check the router" isn't enough
Most home routers do have a "connected devices" or "client list" page somewhere in their admin interface. In practice it's often the worst place to start:
- Device names are whatever the device chose to broadcast — often a generic factory name like "android-7f3c91a2" or nothing at all, not "Mom's Phone."
- It only shows what's talking to the router right now, so a device that connected briefly and left won't appear, and one on a guest network or a separate VLAN might not show up on the main list at all.
- It tells you almost nothing else — no open ports, no OS guess, no way to tell a smart plug from a laptop beyond a vague icon.
- The interface itself is often clunky, buried three menus deep, and different on every router brand — hard to check regularly.
A dedicated network scanner solves all four problems at once: it actively discovers devices (not just ones currently chatting with the router), fingerprints them by MAC vendor, hostname, open ports and response behavior, and gives you one consistent view regardless of router brand.
What actually shows up on a device scan
When you scan your network with a tool like LANsentry, each device typically shows:
| Field | What it tells you |
|---|---|
| IP address | Its current address on your LAN (e.g. 192.168.1.47) — can change if DHCP leases rotate. |
| MAC address | A hardware identifier that (mostly) doesn't change, even if the IP does. |
| MAC vendor | Looked up from the MAC's first 3 bytes — often reveals the manufacturer, e.g. "Apple, Inc.", "Espressif" (many IoT devices), "Amazon Technologies". |
| Hostname | The name the device announces itself with, if any — e.g. "DESKTOP-7QK21", "iPhone-von-Anna". |
| Open ports | Services running on the device — a strong hint at what it is (port 62078 is classic iOS; 9100 is a network printer). |
| Inferred device type | A best-guess classification (router, PC, phone, IoT, camera, printer...) combining the signals above. |
No single field is fully reliable on its own — a phone with a randomized MAC (common on iOS and Android for privacy) will break vendor lookup, and a hostname can be renamed to anything. But taken together, these signals usually make a device's identity obvious within seconds.
Step-by-step: auditing your network
- Run a full scan. Open LANsentry (or your preferred scanner), pick your network adapter, and let it discover every device — this typically takes under a minute on a home network.
- Sort by device type, then walk the list. Group the obvious ones first: your router, your own PC, your phone, your printer, your smart TV. These usually account for 70–90% of entries immediately.
- Cross-reference what's left with physical devices in the room. Smart plugs, doorbell cameras, game consoles, a work laptop, a guest's phone — count them and match against the remaining list.
- Label what you've confirmed. LANsentry lets you name and tag devices permanently, so next time you scan, "kitchen smart plug" already has a name and doesn't need re-investigating.
- Investigate anything still unexplained. See the next section for exactly how.
Do this once when your network is "calm" — most devices you own connected, nothing mid-download. It makes the baseline much easier to build, and every future scan is just a diff against it.
Telling your own devices apart from strangers
For a device you can't place immediately, work through these in order — most unknowns resolve in the first two steps:
- Check the MAC vendor. "Sonos, Inc." is almost certainly your speaker. "Espressif Inc." usually means a cheap IoT gadget (smart plug, sensor, bulb) — check what you've plugged in recently.
- Turn things off one at a time. If you strongly suspect a device, power it off (or disable its Wi-Fi) and re-scan. If the entry disappears, you've confirmed it.
- Check open ports for a fingerprint. Port 8009 (Chromecast), 9100 (network printer), 554 (RTSP — a camera), 3389 (RDP — a Windows PC someone left exposed) all narrow things down fast.
- Check your router's own client list too, purely for the connection timestamp — "connected 3 minutes ago" vs. "connected for 6 days" tells you whether this is a fleeting guest connection or a permanent fixture you simply never labeled.
You found an unknown device — now what?
If, after all of the above, a device genuinely doesn't match anything you or people you trust own:
- Don't panic, but don't ignore it either. It's more often an old device you forgot about (a previous phone still auto-connecting, a neighbor's device that connected once during a Wi-Fi password mix-up) than an active intruder — but verify rather than assume.
- Change your Wi-Fi password and make sure WPA2/WPA3 is enabled (never WEP or an open network). This immediately kicks off anyone who isn't you.
- Disable WPS on your router if it's on — it's a common weak point for unauthorized access.
- Re-scan after the password change. If the device reappears, it means someone re-entered your new password (a household member you forgot to ask, most likely) rather than having cracked the old one.
- If it persists and you truly can't explain it, check for a rogue access point or a compromised device already inside your network relaying traffic — at that point it's worth involving a professional, especially in a business setting.
See every device on your network right now
LANsentry discovers, labels, and fingerprints every device on your LAN — and alerts you the moment a new one joins.
Keeping it that way
A one-time audit answers "who's on my network today." The more useful question is "will I notice the moment that changes." Two things make that automatic:
- Scheduled re-scans with change alerts. LANsentry can run scans on a schedule and notify you (email, Slack, or Telegram) the instant a device you haven't seen before joins the network.
- A maintained label list. Once every legitimate device is named, a fresh, unlabeled entry stands out immediately instead of blending into a wall of unfamiliar hostnames.
For the broader picture of what else is worth checking on a home or small-office network beyond device discovery, see our Windows network security checklist.