Most "unknown" devices turn out to be something you own and forgot about: a smart plug, a TV that has not been turned on in a month, a visitor's phone. The MAC address is the quickest way to tell, because it names the company that made the device's network chip. This takes about ten minutes.
1. Get the list from your router
Your router knows every device connected to it. Log in to its admin page or app and find the device list. It is called Attached Devices on Netgear, Clients on ASUS and TP-Link, and DHCP Client Table on Linksys. Our router guide has the steps for each brand.
Each entry shows a name, an IP address and a MAC address. The name is whatever the device chose to call itself, which is often blank, a model number, or something unhelpful like "android-3f9a". The MAC address is the part you can trust.
2. Look up each address
Paste each MAC address into the lookup on our home page. The result is the organization that registered that address block with the IEEE. Some of them are obvious, and some need translating:
| Lookup says | It is probably |
|---|---|
| Apple | iPhone, iPad, Mac, Apple TV, HomePod or Apple Watch |
| Samsung Electronics | A Galaxy phone or tablet, a TV, or a Samsung appliance |
| Amazon Technologies | Echo, Fire TV, Kindle or a Ring camera |
| Nest speaker, thermostat or camera, Chromecast, or a Pixel phone | |
| Espressif | A cheap smart plug, bulb or sensor. Espressif makes the chips inside thousands of brands |
| Tuya Smart | Smart home gadgets sold under many different brand names |
| Sonos, Roku, Nintendo | Exactly what the name says |
| Sony Interactive Entertainment | A PlayStation |
| Microsoft | An Xbox or a Surface |
| Intel Corporate, Realtek, Qualcomm | The network card in a PC or laptop |
| AzureWave, Liteon, Murata, Wistron NeWeb | A Wi-Fi module inside a laptop, console, TV or printer |
| Raspberry Pi | A Raspberry Pi |
| Hon Hai Precision (Foxconn), Compal, Quanta | A contract manufacturer. The device could be almost anything they build for others |
| TP-Link, Netgear, ASUS, Ubiquiti | A router, extender, switch, or one of their smart plugs and cameras |
If the lookup says locally administered instead of a company, the device is using a randomized address. Phones and laptops do this by default, so that entry is most likely someone's phone. Our guide to locally administered addresses explains how to get the real one.
3. Narrow it down
Once you have a vendor for each entry, a few tricks settle the rest:
- Count. Go through the house and count things with Wi-Fi. TVs, speakers, printers, thermostats, doorbells, consoles, e-readers and plugs all count. The number is usually higher than you expect.
- Turn things off. Switch Wi-Fi off on a suspect device, or unplug it, and watch which entry disappears from the router's list.
- Read the hostname. Names like "Galaxy-S25", "ESP_1A2B3C" or "BRW" followed by hex digits (a Brother printer) give it away.
- Check wired or wireless. Most routers show which band or port a device is on. Something on the Ethernet port is physically plugged into your router.
- Look at the signal. Router apps often show signal strength. A device with a weak signal that connects at odd hours may be a neighbour who was once given the password.
4. If it really is a stranger
Change the Wi-Fi password. That kicks every device off at once, and you reconnect the ones you own. While you are in the router settings:
- Use WPA3 if everything you own supports it, otherwise WPA2. Never WEP or an open network.
- Turn off WPS, which is a common way in.
- Check whether a guest network is on and what its password is.
- Update the router's firmware.