How to Check Connected Devices to Wi-Fi Using CMD: A Complete Guide

Monitoring the devices connected to your Wi-Fi network isn't just a security issue, it's also a way to optimize internet speed. If you notice your connection has slowed down or suspect unauthorized access to your network, use the command line (CMD) V Windows will help you quickly get a list of all active clients.

Many users mistakenly believe that this requires access to the router's web interface or special programs. In fact, with a few commands in CMD you can not only see MAC addresses And IP addresses devices, but also to identify their manufacturers. This method works on all versions Windows (from 7 to 11) and does not require installation of additional software.

In this article, we'll walk you through the step-by-step process, explain how to decrypt the resulting data, and provide recommendations for next steps if you detect suspicious devices.

Why CMD is the best way to quickly check

Using the command line has several key advantages over alternative methods:

• ⚡ Instant results — no need to enter router settings or wait for third-party utilities to load.
• 🔒 Security - there is no risk of downloading malware, as is the case with using unknown programs to scan the network.
• 📊 Detailed information — CMD shows MAC addresses, by which you can identify the manufacturer of the device.
• 🖥️ Versatility - works on any PC with Windows, regardless of the router model.

Furthermore, this method does not require administrator privileges (except for some advanced commands) and does not affect the operation of other devices on the network. If you have ever used utilities like Wireless Network Watcher or Advanced IP Scanner, then you know that they are often blocked by antiviruses or require complex configuration. CMD is free from these shortcomings.

However, there are limitations. For example, you won't see device names (only IP And MAC), and some routers may hide some information due to security settings. In such cases, you'll have to combine CMD with access to the router's web interface.

Preparation: What you need to know before you begin

Before you start executing commands, make sure that:

1. Your computer is connected to the same Wi-Fi network you want to check.
2. You have permission to execute commands in CMD (usually a standard account is sufficient).
3. You know Your router's IP address (usually it is 192.168.0.1, 192.168.1.1 or 199.168.1.1).

If Router IP address unknown, it can be found out through the command ipconfig (More on this in the next section.) It is also helpful to write down in advance MAC addresses your devices (smartphones, tablets, smart speakers) and then compare them with the resulting list.

Another important point: some devices (for example, smart light bulbs or IP cameras) may not appear in the list if they are in sleep mode or connected through a separate subnet. In this case, only checking through the router's web interface will help.

Step 1: Find out the IP address of the router and local network

The first command we will execute is ipconfigIt will show your computer's current network settings, including Default gateway IP address (this is the router address).

Open CMD:

1. Click Win + R, enter cmd and press Enter.
2. In the black window, enter the command:

ipconfig

Find the block in the results Wireless LAN adapter (or Wireless LAN adapter in the English version Windows). We are interested in two lines:

• IPv4 address — the address of your computer on the local network (for example, 192.168.1.100).
• Main gateway — router address (for example, 192.168.1.1).

Write it down Router IP address — you'll need it for the following commands. Also, pay attention to Subnet mask (usually 255.255.255.0). It defines the range IP addressesthat may be on your network.

Step 2: Get a list of connected devices

Now that we have Router IP address, we can scan the local network for active devices. To do this, use the command arp (Address Resolution Protocol), which shows the mapping table IP And MAC addresses.

Enter in CMD:

arp -a

You will see a list of several lines, where:

• Internet address — IP address devices.
• Physical address — MAC address.
• Type - usually dynamic or static.

However arp -a It doesn't show all network participants, but only those devices with which your computer has recently interacted. To get a complete list, you must first ping all possible IP addresses in your subnet.

Make sure Wi-Fi is turned on

Write down the IP address of the router (e.g. 192.168.1.1)

Define a range of IP addresses (usually .1 to .254)

Open CMD as administrator (for ping command)

-->

To do this, run the command (replace 192.168.1. to your subnet, if it is different):

for /L %i in (1,1,254) do ping -n 1 192.168.1.%i

This command will send one by one ping-request for each IP address from 192.168.1.1 to 192.168.1.254. Once completed (this will take 1-2 minutes), repeat arp -a — now all active devices will be in the list.

Step 3: Decipher MAC addresses and identify manufacturers

List MAC addresses doesn't mean much to the average user, but the first six characters (the so-called OUI (Organizationally Unique Identifier) ​​can be used to identify the device manufacturer. For example:

• 00:1A:79 — Samsung.
• 3C:5A:B4 — Google (devices Nest or Chromecast).
• B8:27:EB — Raspberry Pi.

To find out the manufacturer by MAC address, copy the first 6 characters (separators : or - can be removed) and enter them in the search bar Google with the request "MAC vendor lookup" Or use specialized services:

• 🌐 MAC Vendors
• 🌐 Wireshark OUI Lookup

Example: If the list contains a device with MAC address 5C:F9:DD:XX:XX:XX, then by the first three bytes (5CF9DD) you can find out that this device is from Apple (For example, iPhone or MacBook).

If the list contains a device with an unknown MAC address or the manufacturer, this is a cause for concern. Especially if:

• 🚨 IP address is not within the range of your local network (for example, 192.168.0.X instead of 192.168.1.X).
• 🚨 MAC address belongs to a manufacturer whose devices you do not have (for example, Huawei, if you don't use them).
• 🚨 The device is responding to ping, but you don't know what it is.

Step 4: Check device activity in real time

Team arp -a shows devices that have been active recently, but does not provide information about current traffic. To see which devices Now use the network, you can use the command netstat.

Enter in CMD:

netstat -ano

This command will list all active network connections, including:

• Local address — IP and your computer's port.
• External address — IP and the port of the remote device.
• State — ESTABLISHED (connection established), TIME_WAIT (waiting), etc.
• PID — the identifier of the process that is using the connection.

To filter only connections to local IP addresses, use:

netstat -ano | findstr "192.168.1."

(replace 192.168.1. to your subnet).

If you see suspicious activity (for example, an unknown IP address with a large number of connections), you can find out which process is calling it. To do this:

1. Remember PID from the output netstat.
2. Enter the command tasklist | findstr "PID" (replace PID to a real number).

This will help identify malware or unauthorized use of your network.

Step 5: Block unwanted devices

If you find a foreign device on the network, you can block it in two ways:

1. Via the router's web interface (recommended method):

• 🔌 Open your browser and enter Router IP address (For example, 192.168.1.1).
• 🔌 Log in (using your login and password, usually found on the router sticker).
• 🔌 Find the section MAC filter or Access control.
• 🔌 Add MAC address unwanted device to the blacklist.

2. Via command line (temporary blocking):

It can be blocked IP address devices using Windows Firewall:

netsh advfirewall firewall add rule name="Block Device" dir=in action=block remoteip=192.168.1.100 enable=yes

(replace 192.168.1.100 on IP address blocked device).

However, this method only works until you reboot the router or device (since IP address may change). For permanent blocking, use MAC filtering in the router settings.

Additional commands for avanzado users

If you want to get even more information about the network, use these commands:

• 📡 nbtstat -a [IP address] — shows NetBIOS name devices (works only for Windows-machines).
• 📊 tracert [IP address] - determines the route to the device (useful for diagnosing problems).
• 🔍 nslookup [IP address] — is trying to determine DNS name devices.
• 📥 pathping [IP address] - combination ping And tracert for detailed network analysis.

To automatically scan your network, you can create .bat- a file with the following contents:

@echo off
for /L %%i in (1,1,254) do (
ping -n 1 192.168.1.%%i | find "TTL="
If not errorlevel 1, echo 192.168.1.%%i — active
)
arp -a
pause

Save the file with the extension .bat and run it as administrator. It will scan the network and list active ones. IP addresses.

For experienced users, the utility is also useful Nmap, which can be installed through Windows Package Manager:

winget install nmap.nmap

After installation, run:

nmap -sn 192.168.1.0/24

This command will show all devices on the network with additional details (open ports, OS versions, etc.).

Common mistakes and how to avoid them

When working with CMD Users often encounter typical problems. Here are the most common ones and how to solve them:

Another common problem is MAC address misinterpretationFor example, some routers use virtual MAC addresses for a guest network, which can be confusing. It's also worth remembering that:

• 🔄 Some devices (eg. smart speakers) can change MAC address at each connection.
• 📱 Smartphones on Android 10+ And iOS 14+ use MAC address randomization to protect privacy.
• 🖥️ Virtual machines and Docker containers can have unexpected MAC addresses.

FAQ: Answers to frequently asked questions

arp -d *