An unfamiliar name in your router's device list does not automatically mean someone is using your Wi-Fi without permission. It might be your television, a phone using a private Wi-Fi address, an Ethernet-connected accessory, or an old DHCP lease.
The reliable approach is to match the entry to a physical device using several clues. Start with its current IP address, confirm the network address shown on the device itself, then use a controlled disconnect if the identity is still unclear.
1. Make a list of the devices you actually own
Count phones, laptops, tablets, televisions, speakers, cameras, printers, game consoles, streaming boxes, and smart-home hubs. Include Ethernet devices: a local network scanner can discover them even though they are not Wi-Fi clients.
A mesh node or extender may have its own entry. A laptop can have different addresses for Wi-Fi and Ethernet, and a virtual machine may appear separately depending on its network configuration. The device count is a starting point, not evidence of an intruder.
Open your router's currently connected clients or associated devices view. A DHCP lease list can include devices that have already left the network. Note which kind of list you are looking at and when you checked it.
2. Scan the local network and record the clues
Connect to your main home network and run a local scan. On a Mac, the Network Scanner for Mac page explains the first scan. For iPhone options, see our iOS network scanner comparison.
For each unfamiliar entry, record whatever is available:
| Clue | What it helps establish | Limitation |
|---|---|---|
| Current local IP | Match the entry to a device's network settings | DHCP can change it later |
| Hostname | Suggest a device name or product family | Names may be blank, generic, or misleading |
| MAC address | Compare against the address used on that network | Some platforms do not expose it to apps |
| Manufacturer | Narrow the possibilities | May identify a component vendor; private addresses may have no vendor match |
| Responding services | Suggest a printer, NAS, or other device role | An open port alone does not establish identity |
| Connection type and access point | Narrow where the device is connected | Depends on what your router reports |
A scanner is one source of evidence. It cannot guarantee a complete inventory or identify every device's owner. If expected devices are absent, use the missing-device troubleshooting guide before interpreting the count.
3. Match the IP address on the physical device
Check the device while it is connected to the same network:
- iPhone or iPad: Settings → Wi-Fi → the information button beside the connected network → IP Address.
- Mac: System Settings → Network → the active network service → Details → TCP/IP.
- Windows: run
ipconfigand read the IPv4 address under the active Wi-Fi or Ethernet adapter. - Android: open the connected Wi-Fi network's details and look for IP address; menu names vary by manufacturer.
- TV, printer, or console: open its network status screen or print the printer's network configuration report.
For example, if your television shows 192.168.1.42 and the unfamiliar entry currently has that address, you have a strong candidate. Confirm with another clue or the disconnect test below before labeling it.
4. Compare private MAC addresses correctly
Do not assume the MAC address on the device's box is the address your router sees. Phones and newer Macs can use a private or randomized address for a particular Wi-Fi network.
On an iPhone, check the connected network's Wi-Fi details. On a Mac, check Wi-Fi → Details. Compare the address used for that network with the router entry. Android exposes a randomized MAC address in network settings on supported devices. Apple and Google explain the behavior in their private Wi-Fi address guide and Android network settings guide.
This can explain an unfamiliar manufacturer or an apparent new device. Keep private addressing enabled when your network supports it; you do not need to disable it merely to identify a device.
Use MAC Address Lookup when you have a suitable address, but treat a vendor match as supporting evidence. A chipset manufacturer is not necessarily the brand printed on the appliance. Our MAC address guide explains the distinction.
5. Disconnect one candidate at a time
If the name is still unclear, use a simple comparison:
- Record the suspicious entry's address and the time.
- Turn Wi-Fi off on one candidate device, or unplug its Ethernet cable.
- Refresh the router's live-client view. Allow time for its status to update.
- Reconnect the candidate and check which entry returns.
- Confirm its current address in the device settings and label it in your router or inventory.
Use a noncritical device for this test. Do not disconnect alarms, medical equipment, or work systems during an active task. An old lease remaining in the router does not invalidate the test; check live connection status rather than lease existence.
6. Use services to narrow the remaining candidates
If your scanner exposes service information, a printing service may point toward a printer, while file-sharing services may suggest a computer or NAS. Verify against the device's own settings or documentation.
Do not assume port 80 means a camera, or port 22 means a particular computer. Many unrelated products expose the same services. Inspect only your own devices; identification does not require trying default passwords or repeatedly attempting logins.
If you still cannot account for a live device
Check guest clients, mesh equipment, visitors' phones, and equipment another household member configured. Record the evidence before changing anything.
If a live client remains unexplained, manage access through your router. Update its firmware, use WPA2-AES or WPA3 where supported, disable WPS if you do not need it, and change the Wi-Fi password. Reconnect known devices deliberately so you can label them. If router administration itself looks compromised, change its admin password too and follow the manufacturer's recovery guidance.
The IP Scanner app helps investigate devices; it does not block them or change router settings. A MAC block can be bypassed and is not a substitute for securing access to the network.
Questions that often cause confusion
Can an IP lookup identify the person using a device?
No. A public IP Lookup provides information about an internet address, not the owner of a private LAN device. To identify a local device, compare its current network settings and router records.
Why does the same phone appear under a new entry?
A private MAC address, a changed DHCP address, or retained router history can explain it. Match the address currently used for your network before concluding that the entry is a different physical device.
Does an unknown device prove my network was hacked?
No. An unfamiliar label is a reason to investigate. A confirmed, unauthorized live client is stronger evidence and should prompt you to secure Wi-Fi access.