Investigate an unfamiliar device on your home network

Router client lists can reveal connected devices, but names are often vague or stale. An unknown entry could be a smart bulb, a visitor or a phone using a randomized Wi-Fi address. Investigate before concluding that someone breached the network.

Before you start​

Open the router's official app or local admin page and note the current Wi-Fi password and connected-device count. Ask household members what they recently added.

Do it step by step​

1. Find Connected devices, Wireless clients or DHCP clients and record the displayed name, connection type and last-seen time for the unfamiliar entry.
2. Compare the device with known phones, TVs, cameras and guests. Use a manufacturer's app or the device's network settings to match its current Wi-Fi address; avoid assuming a changing address means an intruder.
3. Temporarily power off one suspected household device and refresh the client list. If its entry disappears, label it clearly in the router rather than blocking it.
4. If the entry truly cannot be accounted for and appears active, change the Wi-Fi password to a new strong one and reconnect known devices. Disable WPS if available and review guest-network access.
5. Update the router firmware and admin password. Recheck the client list after all known devices reconnect; if the unknown device returns, contact the provider or manufacturer for deeper diagnosis.

Check the result​

Every currently connected client should map to a device or known guest. Save a simple inventory; it will make the next review much faster.

If something goes wrong​

A DHCP history entry may remain after a device leaves. Conversely, a malicious device could use an unremarkable name. Use multiple observations rather than one label.

Know the limit​

The client list is a starting point, not a definitive intrusion report. FTC recommends reviewing connected-device or DHCP-client lists as part of home-device security. FTC's connected-device guidance