To see who's on your Wi-Fi, open your router's admin page and look at its connected-devices list, or run a network scanner that pings every address on your subnet. Each entry shows an IP, a MAC address, and often a hostname. From there you match each device to something you actually own, and whatever's left over is worth a closer look. If one of those leftovers turns out to be real, changing your Wi-Fi password disconnects everyone at once.
Start with your router's device list
Type your router's address into a browser (often 192.168.1.1 or 192.168.0.1, printed on a sticker on the box). Log in, then find a section called Attached Devices, DHCP Clients, or Connected Devices. You get a table of everything the router has handed an address to: IP, MAC, and sometimes a name.
This is the fastest free check, but router lists have limits. They often miss devices on a guest network or a second access point, they drop stale entries slowly, and the names are frequently blank or cryptic.
Read the MAC address and vendor (OUI)
Every network device has a MAC address, six pairs of hex like a4:83:e7:2b:19:0c. The first three pairs are the OUI (Organizationally Unique Identifier), assigned to the manufacturer. a4:83:e7 maps to Apple, for instance. Look the prefix up in any OUI database and an anonymous row becomes "some Apple device."
Vendor alone rarely finishes the job. A house full of Apple gear turns into a wall of "Apple, Apple, Apple," and you still have to work out which entry is the iPhone and which is the Apple TV.
Get real names with hostnames and mDNS
Hostnames close some of that gap. Many devices announce a name over DHCP or mDNS/Bonjour, like Christofs-MacBook or living-room-tv. NetBIOS does the same on older Windows networks. A scanner that queries all three resolves far more names than the router shows on its own.
Why randomized MAC addresses confuse things
Since iOS 14, Android 10, and recent Windows builds, phones use a random MAC per network by default, and some rotate it over time. The upside is privacy. The downside for you is that a phone can show up under a vendor prefix that no longer maps to its maker, and a device you already trust can look brand new after a rotation.
This is also the wrinkle most likely to fake an intruder. Before you assume the worst, test it directly: turn Wi-Fi off on a phone you suspect and watch whether the mystery entry disappears. Look at the vendor too. A randomized MAC often reads as "locally administered" or an unknown vendor rather than a clean Apple or Samsung block. And if an entry only shows up when one particular family member is home, it is theirs.
The broader fix is to match on hostname and behavior rather than MAC alone, and to name devices in a tool that remembers them across scans, so a rotated address doesn't reset your whole inventory. If the randomization itself is what puzzles you, we've covered why your phone shows a random MAC address separately.
Name everything in one pass with a scanner
Doing all of the above by hand is slow. A scanner sweeps the whole subnet, collects MAC/OUI vendor, hostname, an OS guess, and open ports, then hands you one labeled inventory. nmap does this from the command line (nmap -sn 192.168.1.0/24 for a quick host sweep). GUI tools do the same with less typing.
DeviceShelf is one such scanner. It discovers every device on your LAN or Wi-Fi, identifies each by vendor, hostname, and type, and lets you rename and pin the ones you recognize so the list stays meaningful next time. It runs locally, with no account and no data leaving your machine, which is why people looking for a private alternative to Fing tend to land on it. If you're weighing tools, our comparison of network scanners shows where each one fits.
Match every device against hardware you own
Now the tedious but decisive part. Walk through the place and count: phones, laptops, tablets, the TV, a streaming stick, the console, printer, robot vacuum, smart plugs, thermostat, doorbell, speakers, the router itself, and any range extenders. Write them down, then cross each one off the scan.
The MAC vendor is your best clue here. A prefix that resolves to Amazon is probably an Echo or Fire TV. Espressif or Tuya usually means a cheap smart-home gadget. Apple, Samsung, and Google cover most phones and laptops. Line up hostnames where you can. Smart-home gear is the hardest group to pin down, so there's a separate walkthrough on finding IoT devices on your network.
Once every entry is named, the unknowns stand out. Go one by one: power a suspect device off and see which row drops, or check the vendor against what you own. A camera vendor you don't recognize, an open Telnet port, or a host that only appears at odd hours all deserve a second look. Open ports are worth understanding before you judge them, and our guide to what an open port actually means covers which ones matter.
What to do if someone really is on your Wi-Fi
If a device survives all of that and you're confident it isn't yours, the fastest fix is to lock everyone out and let your own gear back in.
- Change the Wi-Fi password. This kicks every device off instantly, the intruder included, and they can't rejoin without the new key. Reconnect your own hardware afterward.
- Switch to WPA3, or at least WPA2-AES. Never run WEP or an open network. WPA3 makes offline password guessing far harder.
- Disable WPS. Its 8-digit PIN is brute-forceable and a well-known way in.
- Move IoT gadgets to a guest network. A cheap camera with weak firmware has no business sharing a subnet with your laptop.
Changing the password is the step that actually disconnects someone. The rest stops them from coming back. For the full pass over your router settings, work through the home network security checklist.
Why a one-time check isn't enough
A manual sweep only catches whoever is connected the moment you look. It says nothing about last night or next week. Someone who joins at 2am and is gone by morning never appears in a check you run at noon.
Continuous monitoring closes that gap. The network gets watched around the clock, you approve the devices you own once, and an alert fires only when a genuinely new one shows up. DeviceShelf does this on the desktop while your computer is awake, or 24/7 on a Raspberry Pi or NAS with the server edition. That always-on watch is one of the main things separating it from a pull-to-refresh phone app.
You can do every step here with free tools and some patience. If you'd rather get the labeled list and the alerts in one pass, DeviceShelf has a free 7-day trial, no account needed.
