Last updated: July 13, 2026
TL;DR — Key Takeaways
- Most “unknown” devices turn out to be your own forgotten gear, not an intruder.
- Check your router’s own client list first. It is more accurate than a scanner app.
- A MAC vendor lookup narrows an unknown device down to a manufacturer and product type.
- A mesh app’s “first seen” date often just marks when tracking started, not when the device joined.
- If a device genuinely does not belong, change your Wi-Fi password and enable WPA3.
Seeing an unfamiliar device on your network is unsettling. Most of the time it is not an intruder. It is usually a smart plug, an old phone, or a gadget you forgot about.
Start with your router’s client list, not a scanner app
Your router already tracks every connected device by IP and MAC address. That built-in list is more accurate than a third-party scanner app.
Log into your router’s admin page, usually at 192.168.1.1 or 192.168.0.1. Look for a section named Connected Devices, Client List, or Attached Devices.
If you have a mesh system, the manufacturer’s app shows the same list under a Devices tab. Both sources pull from the router’s own DHCP and ARP tables. That is why they tend to agree.
What that “first seen” date actually means
Many mesh apps only start logging a “first seen” date once you install the app or turn on device tracking. An old device can look brand new for that reason alone.
This trips people up constantly. You buy a new mesh router and set up the app. Suddenly a smart plug installed two years ago gets tagged first seen: last week. The router is new to tracking that device, not the device itself.
Before treating a “first seen” date as suspicious, ask whether you recently replaced your router or reinstalled its app. If so, that date likely reflects the tracking history, not the device’s actual age on your network.
Cross-reference the MAC vendor before assuming the worst
The first six characters of a MAC address identify the manufacturer, not the specific model or owner. A vendor lookup can narrow an unknown device to a product category in seconds.
Copy the device’s MAC address from your router’s client list. Paste it into our MAC Address Lookup tool to see the registered manufacturer.
The result usually points you in the right direction fast:
- Apple, Samsung, or Google — likely a phone, tablet, or laptop.
- Amazon — likely an Echo speaker, Fire TV stick, or Ring device.
- Espressif — almost certainly a smart plug, sensor, or budget IoT gadget. This chipmaker’s components show up in a huge share of inexpensive smart-home products, no matter the brand on the box.
- A gaming console maker like Sony, Microsoft, or Nintendo — self-explanatory.
See our guide on what a MAC address is for more on how the OUI-to-vendor system works.
Rule out your own forgotten devices first
Before assuming intrusion, check for the devices people forget about most. Old phones, smart TVs, streaming sticks, printers, and guest devices are common culprits.
Households accumulate more connected devices than most people realize. A retired phone repurposed as a baby monitor can sit quietly on your network for months. So can a starter-kit smart bulb or a relative’s old tablet.
The disable-one-at-a-time method
If a device still will not identify itself, turn your known devices off one at a time. Watch your router’s client list after each one to see which entry disappears.
This method is slow but reliable. It works even when a device reports a blank or generic name. You are matching by disappearance, not by label.
When a device genuinely does not belong
If you rule out every device you own and something is still unaccounted for, change your Wi-Fi password immediately. That step disconnects anything using the old credentials, regardless of MAC address.
A password change is more effective than blocking a single MAC address. MAC addresses can be spoofed, so a determined intruder can simply fake a new one and reconnect.
Follow up with a few standing improvements:
- Enable WPA3 if your router supports it, or WPA2 with a long, unique password at minimum.
- Move smart-home and IoT gadgets to a separate guest network, isolated from your main devices.
- Disable WPS, since it is a known weak point for unauthorized access.
- Keep router firmware updated, since many exploits target outdated firmware specifically.
For a broader connectivity check afterward, see our guide on troubleshooting network connectivity.
Frequently Asked Questions
How do I see all devices connected to my Wi-Fi?
Log into your router’s admin page and look for Connected Devices, Client List, or Attached Devices. Most mesh router apps show the same list under a Devices tab. This built-in list is more accurate than a third-party scanner app.
Why does my mesh app show a device as first seen recently, even though I have had it for years?
Many mesh apps only start logging first-seen dates once you install the app or set up device tracking. An old device can show a recent first-seen date simply because that is when tracking began, not when it joined.
Can someone fake a MAC address to get around MAC filtering?
Yes. MAC addresses can be spoofed with built-in OS settings or free software. MAC filtering alone is not a strong access control. Treat it as a minor speed bump, and rely on a strong Wi-Fi password and WPA3 for real security.
What if I cannot identify a device even after checking the MAC vendor?
Try the disable-one-at-a-time method: turn devices off individually and watch which entry disappears from your router’s list. If it still will not resolve, change your Wi-Fi password. That immediately disconnects anything using the old credentials.
Should I be worried if I see a device named just Espressif or a string of random characters?
Not automatically. Espressif is a chipmaker whose components power a huge share of budget smart plugs, sensors, and IoT gadgets. A generic Espressif or random-character name usually points to a smart-home device rather than an intruder.
References
- IEEE Registration Authority — Public OUI and MAC address block registry. standards.ieee.org/regauth
- Wi-Fi Alliance — WPA3 security overview. wi-fi.org/discover-wi-fi/security