Ask a family how many devices are connected to their network and the answer will almost always be too low. Besides phones and computers there are TVs, smart plugs, light bulbs, the boiler, the robot vacuum, the printer, the console, the voice assistant and some device nobody remembers any more. You cannot protect what you do not know about: a network inventory is the first step in any serious work on home security.
Source 1: the router's list
The starting point is the router's interface. Almost all of them show a list of connected devices or DHCP leases, with name, IP address, MAC address and sometimes the Wi-Fi band in use. It is handy, but it has limits:
- it often shows only the devices active at that moment;
- the name depends on what the device reports, and may be generic or missing;
- it does not see devices with a static address that never ask DHCP for anything;
- on a network with several access points it may be incomplete.
It is still worth photographing or exporting this list: it is the base to work from.
Source 2: the computer's ARP table
Every computer keeps a table linking local network IP addresses to the MAC addresses it has communicated with. You can view it with a command that is the same on Windows, macOS and Linux:
arp -a
On its own it shows only the devices the computer has talked to recently, but after a network scan it becomes much more complete.
Source 3: a scan with nmap
nmap is a free and widely used network analysis tool. For an inventory you only need its simplest function, discovering live hosts, without any port analysis:
nmap -sn 192.168.1.0/24
The command queries every address on the given network and reports those that respond, with the MAC and, when it recognises it, the manufacturer of the network card. Use it only on your own network. On smartphones there are apps that run a similar scan with a graphical interface.
Repeating the scan at different times, for example during the day and in the evening, reveals devices that only switch on at certain hours.
Identifying a device by its MAC
The first three pairs of a MAC address normally identify the manufacturer of the network card. There are public databases that, given that prefix, return the company name. So an anonymous "esp-3f2a" device becomes recognisable as a module from a particular maker, and by elimination you arrive at the smart plug in the living room.
There is one important exception: modern phones, tablets and computers often use random MAC addresses for each network. You can spot them because the second character of the address is 2, 6, A or E. In that case the prefix indicates no manufacturer, and the device has to be identified in another way, for example by checking the phone's settings.
A method for identifying unknowns
- Start with the easy devices: those with a clear name or an obvious manufacturer.
- For the doubtful ones, switch off one device at a time and see which entry disappears from the list.
- Check the label underneath the device: the MAC is often printed there.
- Give each identified device a readable name in the router.
- If something genuinely unknown remains, change the Wi-Fi password and see who reconnects.
What to record
A spreadsheet with a few columns is enough:
| Field | Example |
|---|---|
| Readable name | Washing machine smart plug |
| Type | Smart home |
| Maker and model | From the MAC or the label |
| MAC address | Fixed or random |
| IP address | Dynamic or reserved |
| Network or VLAN | Main, guest, IoT |
| Owner | Who uses it in the family |
| Updates | Automatic, manual, none |
The last column is often the most revealing: a device that has not received updates for years is a good candidate for a separate network or for replacement.
Keeping it current
An inventory is useful only if it is up to date. Some systems, including several routers and tools such as DNS filters, can notify you when a new device appears. Otherwise, simply repeat the scan every few months and compare it with the spreadsheet. In my work this periodic review almost always turns something up: an old phone still connected from a drawer, a gadget received as a gift and forgotten, a guest who was given the main password instead of the guest network one.
In short
- The router provides a first list, useful but often incomplete.
- The ARP table and an
nmap -snscan bring the other devices to light. - The MAC prefix identifies the manufacturer, except when the address is random.
- Switching off one device at a time is the simplest way to identify unknowns.
- A spreadsheet updated every few months keeps the network manageable.
