Security Technology Explained

How to Check Your Wi-Fi Network for Suspicious Devices

James Frew 12-04-2016

If you aren’t already, you should be checking your network and all of the devices connected to it every once in a while. It sounds like a technical task, but it’s actually way easier than you think.


It can be easy to fall into a pattern of connecting devices to your Wi-Fi without a second thought, but when your Wi-Fi begins to slow down, or if you’re worried about security, or even if you’re just doing some home computing improvements, you may want to know what devices are running on your network How To Tell If Someone Is Using Your Wireless Network Read More .


Ideally, it would be as simple as heading over to your router and checking the cables like you could back in the “good ole days”, but since everything is wireless these days, you’ll have to do a bit of digging.

Understanding Wireless Connections

When you connect a device to your network, it is assigned an IP (Internet Protocol) address, which is a unique numeric label that identifies each device that connects to the Internet at large.

But when you use a router, it’s the router itself that connects to the Internet — and then shares that connection with all the devices that connect to the router. The devices all share the same external IP address, but they have unique internal IP addresses which is how the router differentiates between them.


These internal IP addresses commonly take the form of where xxx is an identifying number between 1 and 255. Most modern routers use what’s known as DCHP (Dynamic Host Configuration Protocol) to automatically assign IP addresses to devices upon connection.


Furthermore, these IP addresses are usually dynamic, meaning they may or may not change the next time the device connects. If you don’t want a device’s IP address to change like that, you’ll have to specifically assign it a static IP address What Is a Static IP Address? Here's Why You Don't Need One A static IP address is one that never changes. Dynamic IP addresses do change. We explain why you don't need a static IP address. Read More .

Dynamic IP addresses mean that you can not track a device over time, or if the name of the device is unclear, you need an additional way to identify the device — and that’s where Media Access Control (MAC) addresses come into play. Every device has a unique MAC address that’s defined by its manufacturer.


Knowing all of this, we can now explore some of the methods you can use to discover and identify the various devices that are connected to your network at any given time.

Checking on the Router

Nearly all routers have a dedicated Web interface that you can log onto to access information about the router such as its firmware version, connection status, security settings, and what devices are currently connected to it. Most router interfaces, especially D-Link and Netgear, are accessed by typing into a Web browser.

Note: If your router interface isn’t accessible through, you can find your address by opening Command Prompt, using the ipconfig/all command, and looking for the “Default Gateway” address.



The router will then ask you to log on using your administrator credentials. These are usually set to defaults when you first set up the router, and if you haven’t changed them yet, then you absolutely should!

Once logged on, the options and information will vary depending on the router, but usually somewhere in the Settings there is an option for “Device Connection Status”.


I use Virgin Media in the U.K. as my ISP, and you can see in the screenshot above that the Web interface lists out the devices currently connected to my network. There is information provided for each device, including the IP address, MAC address, and device name.


If there is a device that looks suspicious or foreign, you can power off each of your network-connected devices one at a time. If a device still remains after everything is disconnected, this could be evidence of an unwanted or potentially sinister device connected to your network.

While this method of finding the devices on your network is fairly straightforward, it does mean having to log onto your router every time you want to see what’s connected, and it doesn’t provide any tracking over time or detailed information, so it’s an okay method at best.

Also worth keeping in mind is that most routers will only display IP addresses that are assigned using DCHP, so static IP devices won’t show in these lists and will potentially evade your notice.

Checking With WNW

As is usually the way with Windows, there are a whole host of different ways to identify devices on your network. One of the most effective tools is Wireless Network Watcher (WNW) by NirSoft.


This is a tool which scans the network you are connected to and returns a list of devices with their MAC and IP addresses. You can also export the list if needed. The main difference between this method and the router method is that you can automatically refresh this list, and even create alerts for when a particular device is added or removed from the network.

One of the best benefits, however, is that you can choose to download it either as an installable executable or as a ZIP which you can run without installation. Take it with you anywhere you go by tossing it on a USB flash drive Are USB Flash Drives Still Worth It In 2015? USB flash drives are great for storage, but they have so many other uses. Here's how they're worth their weight in gold. Read More and carrying it in your pocket!

Checking With Fing

There are a lot of third-party apps that allow you to view network devices, but Fing is one of the most useful, and has great cross-platform support being able to run on Windows, iOS, and Android.

On iOS and Android, you can download the app and, once it’s installed, open it and run the “Network Discovery” function. This will scan the network you are currently connected to and return a list of connected devices.


As with the previously mentioned techniques, this returns IP address, MAC address, and device name. It is a quick and painless method of checking your network status while on a mobile device. You can also refresh the list whenever you want, allowing you to turn on and off devices and quickly see the impact on the device list.

What makes Fing particularly useful for regular monitoring is that it stores the information about the network so that when you view the devices list next time, you are able to see which devices have been seen on the network but are no longer connected (shown in grey text in the screenshot above).


By long-pressing on a specific device, you enter device edit mode. Here you can name the device and add additional notes. I use the notes section to add whether the device is wired or wireless and where it’s located in the house.

Fing can be run as a command line tool on most non-mobile operating systems, including Windows, OS X, Linux, and even the Raspberry Pi Turn Your Raspberry Pi into a Network Monitoring Tool Network monitoring software Nagios is quick to install and straightforward to configure –but a waste of a full PC. Raspberry Pi to the rescue. Read More .


Fing also has a paid subscription service called Fingbox. This is a cloud-connected hub that allows you to monitor up to 10 networks remotely. This is run using a “sentinel” from Fingbox on your computer which will monitor the network. You can also log into your Fingbox account on the mobile app and sync the network to Fingbox.

Do You See Any Suspicious Devices?

There are many reasons—from security to maintenance to just plain curiosity—why you should regularly check your home network for foreign devices. Depending on your reason, you may be able to get by with something as simple as the router Web interface or you may need a more comprehensive tool like Fing.

If you are trying to hunt out a rogue device, this can require some mild detective work and investigation. Setting up these tools and practices is a good place to start though, and with proactive monitoring of your network How to Monitor and Restrict Router Traffic: 4 Tips and Tricks How do you make sure your kids are actually sleeping on a school night and not staying up streaming internet videos? Read More , you are putting yourself in a position to better protect your home network How To Test Your Home Network Security With Free Hacking Tools No system can be entirely "hack proof" but browser security tests and network safeguards can make your set-up more robust. Use these free tools to identify "weak spots" in your home network. Read More . If you ever come across any problems with it, try these simple steps to diagnose network problems Network Problems? 7 Diagnostic Tricks and Simple Fixes Network problems must be diagnosed before they can be resolved. This article covers seven simple tricks for fixing your network. Read More .

Image Credit: VectorPainter via

Related topics: Computer Networks, Online Security, Router, Wi-Fi.

Affiliate Disclosure: By buying the products we recommend, you help keep the site alive. Read more.

Whatsapp Pinterest

Leave a Reply

Your email address will not be published. Required fields are marked *

  1. Laura
    October 18, 2018 at 1:59 pm

    My neighbor is using an app called wpsapp to try and Crack wifi passwords. Mine is strong enough and it can be hacked with that app. He wanted to show off so he talk me about it. Not about my network specifically of course. But what worried me is the fact that he gets the bssid (is it the same than Mac address?) of all the wifi networks around. So for what a iresd it is not a good thing he can see that information, is it?. Can he trick my router knowing the Mac or bssid to connect to it? Is something I can do to hide it?

    Thank you

    • James Frew
      October 18, 2018 at 3:53 pm

      WPSApp is an Android app designed to audit networks for their security. The app scans nearby networks to see if they use the default security settings. What its looking for is the WPS pin, which allows you to quickly set up a device on the network. The default WPS Pin is usually created using an algorithm that includes the basic service set identifier (BSSID), SSID, and serial number.

      If you believe that your network is secure and doesn't use the default PIN numbers and passwords, then it is unlikely your neighbor can access your network. However, the app is intended for diagnosis only - in most places around the world hacking, or breaking into, digital devices without permission is illegal.

      • Laura
        November 2, 2018 at 7:18 am

        Hi James

        Thank you for your reply. I know that it is illegal and that is why I'm worried. Not about the wifi, cause I know it is secure, but about him having that Mac address and bssid and etc. I read that someone can change his Mac address, what of he replaces for mine and then I look guilty. Is it possible?

        • James Frew
          November 2, 2018 at 12:30 pm

          So it's probably best to view a device's mac address and bssid as a bit like serial numbers. They are used to identify a paticular device or network.

          If an intruder was able to get these numbers, there's not a lot they can do with them. You can change the mac address of device, but on the device itself. As you point out, there is a scenario where he obtains your mac address and changes his devices to that number.

          In that case, if something illegal were to occur and linked to your mac address, there are many other ways of eliminating yourself from these enquires.

          Although it's not impossible that this would happen, it's certainly unlikely. So, unless he has explicitly said this is what he plans to do, I would focus your efforts on improving and maintaining your network's and device's security.

  2. Waldo
    September 20, 2018 at 10:29 pm

    I checked with my router and saw only one device wirelessly connected which I recognized. It was my phone. But then I checked with Fing on my phone and a Samsung S5 Neo phone is shown as attached. I do not recognize this item.

    I tried to block the MAC address of this Samsung phone in the router settings and it still shows up as connected in Fing.

    What could account for the discrepancy?

    • James Frew
      September 20, 2018 at 10:46 pm

      Although I can't say for certain, I think I have a possible reason. When a device's Wi-Fi is turned on, it goes into searching mode. This broadcasts the phone's ID and looks for nearby Wi-Fi networks. In order to establish if a network is known, or capable of connection, the two devices have to briefly communicate. I wonder if Fing is detecting this, and it isn't displayed on your router because the device isn't actually connected.

      • Waldo
        September 20, 2018 at 11:13 pm

        A good thought. However I can ping the device through Fing. 5ms with no packet loss. I would not think that this was possible if it were some sort of transient connection as you mentioned as a possibility.

        Also it has been present for quite some time. Since Aug 31 2018.

      • Waldo
        November 9, 2018 at 3:13 pm

        I had a more in depth look at the issue and Fing is making a mistake.

        My router came from my ISP with a 5G wifi connection established. Fing is miss-reporting this as "another device" (for some reason Fing sees this as a Samsung S5 Neo phone device!?) connected to the network.

        Fing has its limitations!

  3. cat12345
    July 4, 2018 at 4:29 am

    Hi, I used Fing and it said that a WFA device is attached to my router. I’m not sure what a WFA device is, but I reset my router and changed the router, but it’s still showing up. I don’t know what to do?

  4. Faith
    February 1, 2018 at 6:39 pm

    I have read the article. It is frightening. I find it very technical and wish you offered something easy enough for a 70 year old Zimbabwean woman to follow. I shall follow one method and hope you will help when I get stuck. I use a Samsung phone but hope to change to an iPhone in the near future.

    • James Frew
      February 7, 2018 at 1:20 pm

      How did you get on?

  5. Lady11
    April 30, 2017 at 3:44 am

    Hi, I had some reasons to be suspicious of a man who works at my college and I scanned the school wifi one night when everyone is gone because school ended and it was late. I used fing and my phone popped up as well as a macbook with the dude I am suspicious of's first name in front. It had a wake on lan and many ip addresses attached. I notified my tech support at school. Is this a coincidence? Do colleges use macbook's as remote routers/servers to other devices commonly?

    • James Frew
      May 2, 2017 at 4:42 pm

      I'm not quite clear on what you mean by suspicious of a man but now that you have referred this to the school's tech support I think they are better equipped to provide you with assistance in this than I am.

  6. duke
    January 10, 2017 at 6:58 am

    i have about 10 devices all named kindle-09294b615 on my network, some online some offline, some with the same IP address, all with different MAC addresses. Neither me nor my gf own a kindle. i think maybe two of them might be from our ipads although neither of us use the app. i don't know where the others are coming from. no one but us knows the password

    • James Frew
      January 10, 2017 at 12:19 pm

      If neither of you own a Kindle then you should begin by logging into your Router (usually by typing in your browser's address bar). Change your Wi-Fi password and reconnect all of your devices. Monitor the connections using Fing (as mentioned in the article). If the "Kindle" devices reappear then its likely to be an item you own and you can narrow it down from there.

  7. Jo8
    November 2, 2016 at 12:25 pm

    Very helpful in many ways although I could not find the "devices connected" section but am still working on it.
    Also thanks for the monitoring program suggestions.

    • James Frew
      November 2, 2016 at 12:27 pm

      Where are you looking for the devices connected - on your router or another bit of software?