Who's connected to my Wi-Fi? How to find devices by MAC address

Have you noticed that your internet speed has suddenly dropped, and unknown devices have appeared in the list of connected devices? Or just want to check if someone is using your Wi-Fi without permission? Identifying devices by MAC address — one of the most reliable ways to identify "uninvited guests" on your network. Unlike an IP address, which can change, a MAC address is assigned to a device at the factory and remains unchanged (unless it's been spoofed).

In this article, you will learn how to find the MAC addresses of all connected devices via router web interface, specialized mobile applications and even command lineWe'll explore how to distinguish legitimate devices from rogue ones, what to do if you detect a rogue device, and why MAC addresses can sometimes be misleading. We'll also learn how to block unwanted connections permanently.

Spoiler: If you've never changed the factory Wi-Fi password or are using a security protocol WEP (instead of WPA2/WPA3), the chances that your neighbors have connected to your network are extremely high. But even in this case, the problem can be solved in 10 minutes—the main thing is to know where to look.

What is a MAC address and why is it more important than an IP address for Wi-Fi testing?

MAC address (Media Access Control) is a unique identifier for a network interface that is assigned to each device at the manufacturing stage. Unlike IP addressesWhile the MAC address can change dynamically (for example, when reconnecting to a network), the MAC address remains constant. This makes it ideal for tracking devices on a local network.

The MAC address format is six pairs of hexadecimal characters separated by colons or hyphens. Example: 00:1A:2B:3C:4D:5E or 00-1A-2B-3C-4D-5EThe first three pairs (prefix) usually indicate the device manufacturer. For example:

• 📱 3C:5A:B4 — devices Google (Pixel, Nest)
• 💻 8C:85:90 - laptops and PCs Dell
• 📺 78:31:C1 - televisions Samsung
• 🎮 00:0A:95 - game consoles Sony PlayStation

Why is MAC address more reliable than IP for Wi-Fi testing?

1. It does not change when you reboot the router or device (unlike a dynamic IP).
2. It is more difficult to counterfeit (although it is possible with the help of special software).
3. The prefix can be used to determine the brand of the device, which helps identify suspicious gadgets.

How to view MAC addresses of connected devices via a router

The easiest way to get a list of all the devices on your network is to go to router web interfaceThe instructions are universal for most models, but the paths to the necessary sections may vary slightly. Below, we'll break down the process for popular brands: TP-Link, ASUS, Keenetic And MikroTik.

First, connect to your router via cable or Wi-Fi. Then:

1. Open your browser and enter your router's IP address in the address bar. This is usually 192.168.0.1 or 192.168.1.1 (the exact address is indicated on the device sticker).
2. Enter your login and password (by default it is often admin/admin, if you haven't changed it).
3. Find the section with a list of connected devices (names may vary).

The list will show all devices that have ever connected to your network (including those that are currently disconnected). Note the following columns:

• 🔹 MAC address — unique identifier.
• 🔹 IP address — current network address (may change).
• 🔹 Host name — often contains the device model (for example, iPhone-12-Pro).
• 🔹 Connection type — Wi-Fi or Ethernet.

Compare MAC addresses with your gadgets|

Pay attention to unknown hostnames|

View last connection time|

Check if the devices are connected via cable (if you only have Wi-Fi) -->

⚠️ Attention: Some routers only show active connections, while others show the entire history. If the list is too long, sort it by last active time or filter by connection type (for example, Wi-Fi only).

How to determine the manufacturer of a device by its MAC address

The first three bytes (six characters) of a MAC address are called OUI (Organizationally Unique Identifier) ​​and are assigned to manufacturers by the organization IEEEThey can be used to determine which company the device belongs to. This helps distinguish, for example, a smartphone. Samsung from a laptop Lenovo or identify suspicious gadgets from unknown brands.

Here are some ways to find out the manufacturer by MAC:

1. Online services for checking MAC

Copy the first six characters of the MAC address (e.g. 3C:5A:B4) and enter them in one of the services:

• 🌍 MAC Vendors - basic check.
• 🔍 Arul John’s MAC Address Lookup - extended base.
• 📊 Wireshark OUI Lookup — official base IEEE.

2. Local check via command line (Windows/Linux)

If you don't want to use online services, you can download the database OUI and check addresses offline. For example, in Linux install the package wireshark-common:

sudo apt install wireshark-common

Then use the command:

grep -i "3C:5A:B4" /usr/share/wireshark/manuf

3. Examples of MAC address decoding

Here are some common prefixes and their corresponding brands:

• 📱 B8:27:EB — Raspberry Pi (single-board computers).
• 💻 00:0C:29 — VMware (virtual machines).
• 🎮 00:1E:68 — Microsoft Xbox.
• 📺 00:0A:EB — LG Electronics (TVs, monitors).

How to find "foreign" devices on the network: signs and actions

Now that you have a list of MAC addresses, you need to determine which of them belong to your gadgets and which belong to other people. Here key featuresthat the device is not yours:

• 🚨 Unknown MAC address - does not match any of your devices.
• 🕵️ Suspicious hostname - For example, android-123456 (if you don't have Android devices) or unknown.
• 📡 Wi-Fi connection during non-working hours (at night, when everyone is sleeping).
• 📈 High traffic — the device consumes a lot of data (visible in some routers).
• 🔌 Connection via cable (if you only have Wi-Fi clients).

A critical sign of hacking: if a MAC address with the prefix of your router appears in the list of devices (for example, TP-Link this is often 50:C7:BF or 90:F6:52), but you know for sure that it is not your repeater or mesh device - this could be a sign of an Evil Twin attack.

What to do if you find a suspicious device?

1. Check again - perhaps it’s a family member’s gadget or a smart device (light bulb, camera) that you forgot.
2. Look at the traffic — if the device is actively consuming data, it is definitely not a “sleeping” gadget.
3. Block the MAC address in the router settings (instructions below).
4. Change your Wi-Fi password - use WPA3 and a complex password (at least 12 characters with numbers and special characters).

⚠️ Attention: Some smart devices (eg. Amazon Echo or Google Home) may have non-obvious hostnames and MAC addresses. Before blocking, make sure it's not your gadget—disconnect all smart devices from the network and check if the "suspicious" MAC address disappears from the list.

How to block a device by MAC address in a router

If you're sure a device is unnecessary on your network, you can block it permanently. Most routers support this. MAC filtering - this means that a device with the specified address will not be able to connect to your Wi-Fi, even if it knows the password.

Instructions for popular routers:

TP-Link

1. Go to Advanced Settings → Wireless Mode → MAC Filter.
2. Select mode Enable filtering and indicate Deny the stations specified in the list access to the network.
3. Add the MAC address of the suspicious device and save the settings.

ASUS

1. Open Wireless Network → MAC Filter.
2. Turn on filtering and select the mode Reject.
3. Enter the MAC address and apply changes.

Keenetic

1. Go to Home Network → Devices.
2. Find the device you need and click on it.
3. Select Block Internet access or Block Wi-Fi connection.

Once blocked, your device will be unable to connect to your network, even if the Wi-Fi password hasn't changed. However, keep in mind:

• 🔄 MAC addresses can be spoofed, so blocking does not provide 100% protection.
• 🔒 It is better to combine it with changing the password and turning it on WPA3.
• 📵 Some routers allow you to block devices only for a certain amount of time (useful for temporary guests).

Mobile apps for Wi-Fi network monitoring

If it is inconvenient to go into the router settings every time, you can use mobile applications for network scanning. They show all connected devices, their MAC addresses, manufacturers, and even their approximate location (based on signal strength). Here are the best options:

1. Fing (Android/iOS)

One of the most popular network analysis apps. Shows:

• 📋 List of devices with MAC, IP and hostname.
• 🔍 Manufacturer by MAC address.
• 📊 Internet speed and network congestion.
• 🛡️ Ability to block devices (on some routers).

Cons: The free version limits the number of scans.

2. NetScan (Android)

A more advanced tool with features:

• 🔄 Real-time network monitoring.
• 📡 Show Wi-Fi signal strength for each device.
• 📌 Geolocation of devices (approximate).
• 📤 Export device list to CSV.

3. WiFi Guard (Android)

Specializes in detecting unauthorized connections. Automatically compares current devices against a whitelist and alerts you to new MAC addresses.

How to use such applications?

1. Download and install the application from the official store.
2. Connect to your Wi-Fi network.
3. Start the scan (usually the button Scan or Network analysis).
4. Compare the list with your devices.

⚠️ Attention: Some apps require root access to lock devices. Without it, they can only display a list of connected devices. Also, be wary of apps that request too many permissions (such as access to SMS or contacts)—they could be rogue.

Checking connected devices via the command line (for advanced users)

If you prefer to work through terminal, you can get a list of devices on the network using standard tools Windows, Linux or macOSThis method requires a little technical knowledge, but gives more control.

1. In Windows (through arp And ping)

Open Command line (Win + R → enter cmd → Enter) and run:

arp -a

This command will display the ARP (Address Resolution Protocol) table, where each IP address on the local network corresponds to a MAC address. However, by default, not all devices may be listed there. To wake them up, first ping the entire range of your network. For example, if your router has an IP address 192.168.1.1, execute:

for /L %i in (1,1,254) do ping -n 1 192.168.1.%i

Then run it again arp -a - Now the list should contain all active devices.

2. In Linux/macOS (through nmap And arp-scan)

Install nmap (if not installed):

sudo apt install nmap # For Debian/Ubuntu
brew install nmap # For macOS

Then scan the network:

sudo nmap -sn 192.168.1.0/24

Or use arp-scan (more accurate method for MAC addresses):

sudo arp-scan --localnet

3. Analysis of results

In the command output you will see something like:

192.168.1.10   00:1A:2B:3C:4D:5E   (unknown)
192.168.1.100  3C:5A:B4:6F:8E:9D   Samsung Electronics

Please note:

• 🔹 MAC addresses without hostname (unknown) - potentially suspicious.
• 🔹 Devices with unusual names (eg. hacker-pc - Yes, this happens!).
• 🔹 Multiple devices from the same manufacturer (may be a sign of an attack).

For automation, you can save the output to a file and compare it with the previous scan:

arp -a > devices.txt

What to do if you find a "stranger" online

You've found an unknown device - what next? Here step-by-step action plan:

1. Make sure it's not your device.:
   • Check the MAC addresses of all your gadgets (see the section below “How to find the MAC address of your device”).
   • Turn off smart devices (lamps, cameras, speakers) one by one and see if the “intruder” disappears from the list.
2. Lock your device:
   • Add its MAC address to the router's blacklist (instructions above).
   • Enable MAC address filtering (allow only known devices to connect).
3. Change your Wi-Fi security settings:
   • Change your password to a complex one (at least 12 characters, with numbers and special characters).
   • Turn it off WPS (this is a vulnerable protocol).
   • Turn on WPA3 instead of WPA2 (if the router supports it).
   • Hide the network name (SSID) - this does not protect against hacking, but it reduces the number of accidental connections.
4. Check your router for vulnerabilities:
   • Update your router firmware to the latest version.
   • Disable remote administration (if enabled).
   • Change your login/password for entering the web interface (do not leave it admin/admin).

ipconfig /all

networksetup -listallhardwareports

ifconfig en0 | grep ether

ip link show

ifconfig -a | grep ether