Who is on my Wi-Fi? How to list every device on your network

Most people massively underestimate how many things are on their home network. Count the obvious ones: phones, laptops, a tablet, a TV. Then add the doorbell, the thermostat, three smart plugs, a printer nobody has used since 2023, two speakers, a robot vacuum, a games console, a set top box, and whatever the neighbours' kid connected the last time they visited. Thirty devices in an average household is normal now.

That matters for two reasons. Something on that list is probably misbehaving, and something on that list might not belong to you.

Step one: find out what your network actually is

Before scanning, you need to know the range to scan. Look at your device's IP address and subnet mask. If you see 192.168.1.24 with a mask of 255.255.255.0, your network is 192.168.1.0/24 and it contains 254 usable addresses.

If the mask is anything other than 255.255.255.0, hand it to a subnet calculator rather than working it out by hand. A /22 or a /16 covers far more addresses than most people expect, and a scan of the wrong range either misses devices or takes forever.

Two things worth knowing before you start:

• Guest networks are usually separate. Devices there will not appear in a scan of the main network, which is exactly the point of a guest network.
• Mesh systems sometimes use multiple subnets. If your scan comes back suspiciously empty, check whether the node you are attached to puts you somewhere else.

Step two: scan it

A LAN Scan walks every address in the range and reports which ones answer. There are usually two modes worth understanding:

Fast checks each address quickly and returns in seconds. It is ideal for a routine look at what is online, but it misses devices that are configured not to respond to pings, which includes plenty of IoT hardware and any Windows machine with default firewall settings.

Deep takes longer and tries harder, probing common ports to coax a response out of devices that stay quiet otherwise. Use it when you suspect something is present but hiding, or when a device you know exists did not show up.

Run the fast scan first. If the count looks lower than reality, run the deep one.

# Quick look at what is online
https://netdebug.app/open/lanscan?subnet=192.168.1.0/24&mode=fast

# Slower, finds devices that ignore pings
https://netdebug.app/open/lanscan?subnet=192.168.1.0/24&mode=deep

Step three: work out what each device is

A list of IP addresses is not an answer. Turning it into names takes a few passes.

Hostnames

Many devices announce a name, and it is often unmistakable: Johns-iPhone, HP-OfficeJet-8600, living-room-tv. This identifies maybe half the list with no effort at all.

Bonjour and mDNS

Apple devices, printers, speakers, TVs, NAS boxes and a lot of smart home equipment advertise their services on the local network. A Bonjour browser shows you what each one is offering: AirPlay, HomeKit, printing, file sharing, media servers. This is frequently more informative than the hostname, because a device that offers AirPlay and HomeKit is clearly a speaker or a TV even if it calls itself something cryptic.

MAC address vendor prefix

The first three bytes of a MAC address identify the manufacturer. Apple, Samsung, Amazon, Espressif (which makes the chips inside an enormous number of cheap smart devices), TP-Link, Sonos and so on. This narrows things down fast, with one large caveat covered in the next section.

Open ports

What a device listens on describes what it is. Port 9100 means a printer. Port 32400 means a Plex server. Ports 80 and 443 on something that is not a computer usually means a device with a web admin panel, which is your way in to identify it properly. A port scan against a single unknown address on your own network usually settles the question in seconds.

Why the MAC address may not help any more

Here is the thing that trips up anyone who learned this a few years ago: modern phones lie about their MAC addresses on purpose.

iOS, Android and recent Windows builds all use private or randomised MAC addresses by default. Each device generates a different MAC for each network it joins, specifically so it cannot be tracked between locations. That means:

• The vendor prefix may resolve to nothing recognisable, or to a locally administered range rather than a real manufacturer.
• A device can appear as a brand new unknown entry after a settings change or an OS update.
• MAC address filtering on your router is even less useful than it already was.

So an unfamiliar MAC is much weaker evidence of an intruder than it used to be. Before panicking, turn off every device you own one at a time and re-scan. Tedious, but conclusive.

You found something you cannot identify

Work through this before assuming the worst.

1. Count your own devices honestly

   Write the list out. Include the things that do not feel like computers: TV, streaming stick, console, printer, doorbell, thermostat, plugs, bulbs, speakers, watch, tablet, e-reader, vacuum, car if it joins Wi-Fi. The list is almost always longer than the mystery.

2. Check what it advertises

   Run a Bonjour browse and a port scan against that one address. A device offering AirPlay is a speaker or a TV. One with a web interface on port 80 will usually tell you its model on the login page.

3. Turn things off

   Power down the suspect category (all the smart plugs, say) and scan again. Whatever disappears is what you turned off.

4. Look at the router's client list

   Your router keeps a DHCP lease table with hostnames, MAC addresses and often connection times. It also knows whether a device is on 2.4GHz or 5GHz and which access point it is using, which a scan from a phone cannot see.

5. If it still does not resolve, change the Wi-Fi password

   This is the decisive move. Change it, use WPA3 or at minimum WPA2 with a long passphrase, and reconnect your own devices one by one. Anything you do not reconnect is gone. While you are in there, turn off WPS, which has a long history of being brute forced.

Locking things down properly

Two changes are worth more than everything else combined.

Put IoT devices on a separate network. Most routers support a guest or IoT network. Smart bulbs, plugs, cameras and appliances rarely need to reach your laptop or your NAS, and they are the devices most likely to be running firmware that stopped receiving updates years ago. Isolating them limits what a compromised one can reach.

Give guests the guest network. Not because your friends are a threat, but because their devices might be, and because it means your main passphrase never travels.

Beyond that: a long unique Wi-Fi passphrase, WPA3 if your equipment supports it, WPS off, remote administration off, and router firmware updated. MAC filtering is not worth the effort given address randomisation, and hiding your SSID does nothing useful at all.

Make it a habit

Run a scan now and save the result. Run another next month. The comparison is what makes this valuable: you stop asking "is this device new?" and start knowing. Saving the scan as an automation with your subnet already filled in turns the whole thing into one tap, and Run History keeps the previous results for comparison.

The short version

Find your subnet, scan it fast, then scan it deep if the numbers look wrong. Identify devices by hostname, by what they advertise over Bonjour, and by what ports they listen on, and treat MAC vendor prefixes with suspicion now that phones randomise them. Most unknown devices turn out to be something you own and forgot about, and if one genuinely does not resolve, changing the Wi-Fi password settles it permanently.