How to See Who Is Connected to Your Wi-Fi

The most reliable way to see who is connected to your Wi-Fi is your router's connected-devices or DHCP client list, which shows every device's name, IP address and MAC address. You can then identify unknown devices from their MAC address and remove intruders by changing the Wi-Fi password and tightening a few router settings.

A slow connection, a light on the router blinking while everything at home is off, or simple curiosity are all good reasons to check. This guide walks through each way of listing devices, how to work out what an unfamiliar entry really is, and how to lock the network down properly.

Check your router's connected devices list

Your router hands out IP addresses to every device that joins (that is its DHCP server at work), and it keeps a table of them. That table is the most complete view you can get, because it includes devices your own computer has never communicated with.

1. Find the router's address. It is your default gateway, usually something like 192.168.1.1, 192.168.0.1 or 10.0.0.1. On Windows run ipconfig and read "Default Gateway"; on macOS run route -n get default.
2. Log in. Open that address in a browser, for example 192.168.1.1 or 192.168.0.1, and sign in with the admin password. The default is often printed on a sticker on the router.
3. Find the client list. Depending on the manufacturer it is called "Attached Devices", "Connected Devices", "DHCP Clients", "Client List", "Device Manager" or "Wireless Clients". It is often on the main status page or under LAN or Wireless settings.

Many routers and mesh systems also have a companion phone app that shows the same list, usually with friendlier names and a button to pause or block a device.

See devices from your computer with arp -a

If you cannot log in to the router, your computer's ARP table is the next best thing. ARP maps IP addresses on your local network to MAC addresses, and every operating system keeps a cache of it:

C:\> arp -a

Interface: 192.168.1.23 --- 0x7
  Internet Address      Physical Address      Type
  192.168.1.1           3c-84-6a-12-34-56     dynamic
  192.168.1.40          a4-83-e7-ab-cd-ef     dynamic
  192.168.1.57          d2-11-4f-9a-0b-7c     dynamic
  192.168.1.255         ff-ff-ff-ff-ff-ff     static

The same command works on macOS and Linux. Linux also has ip neigh, which shows the same information. Ignore broadcast and multicast entries such as ff-ff-ff-ff-ff-ff and addresses beginning with 01-00-5e.

The catch is that the cache only contains devices your computer has talked to recently. To fill it, ping every address on the subnet first. On Windows, for a 192.168.1.0/24 network:

for /L %i in (1,1,254) do @ping -n 1 -w 100 192.168.1.%i > nul
arp -a

On macOS or Linux you can do the same with a short loop, which runs the pings in parallel and may take several seconds to finish:

for i in $(seq 1 254); do ping -c 1 192.168.1.$i > /dev/null & done; wait
arp -a

The free, open-source scanner nmap does this in one step with nmap -sn 192.168.1.0/24. Some devices ignore ping but still answer the ARP request that precedes it, so they usually show up in the table anyway. Only scan networks you own or are allowed to test.

Identify unknown devices

Look up the manufacturer from the MAC address

The first three bytes of a MAC address are the OUI (Organizationally Unique Identifier), assigned by the IEEE to a manufacturer. Paste an address into our MAC address lookup to see the vendor. An entry that resolves to a TV, printer, smart plug or games console maker is probably one of your own devices that you forgot about. Our guide to MAC addresses explains the format in more detail.

Watch out for randomized MAC addresses

Modern phones and laptops hide their real hardware address on Wi-Fi to prevent tracking. iOS and iPadOS (Private Wi-Fi Address), Android 10 and later, and Windows (Random hardware addresses) can all use a different, made-up MAC for each network. A vendor lookup on these returns nothing useful.

You can recognise a randomized address by its second hex digit: if it is 2, 6, A or E, the "locally administered" bit is set and the address was not assigned by a manufacturer. In the example above, d2-11-4f-9a-0b-7c is randomized. It is very likely a family member's phone, not an intruder, but you will need another way to confirm it.

Other ways to put a name to a device

• Hostname. Many router lists show the name a device reported, such as "Living-Room-TV" or a phone owner's name.
• Check each device. Phones and laptops show their own Wi-Fi MAC (including the randomized one) in their network settings. Match them off one by one.
• Process of elimination. Turn off or disconnect devices you know, refresh the router list, and see what remains.
• Band and signal. A device with a weak signal that is always connected may be something outdoors, such as a camera or doorbell, or a neighbour.
• Remember the infrastructure. Mesh satellites, Wi-Fi extenders and powerline adapters appear as clients too.

How to remove unwanted devices

1. Change the Wi-Fi password

This is the only step that reliably removes everyone at once. Choose a long passphrase that is not used anywhere else. Every device, including yours, will be disconnected and must rejoin with the new password, so anyone who learned the old one is locked out.

2. Use WPA3 or WPA2 with AES

In the wireless security settings, choose WPA3-Personal if all your devices support it, or the mixed WPA2/WPA3 mode if some older devices do not. WPA3's SAE handshake resists the offline password-guessing attacks that work against captured WPA2 handshakes. Never use WEP or open networks, and avoid WPA2 with TKIP.

3. Disable WPS

Wi-Fi Protected Setup lets devices join with a button press or an 8-digit PIN. A design flaw published in 2011 showed that the PIN is checked in two halves, which reduces the search to about 11,000 combinations and lets attackers recover the Wi-Fi password regardless of how strong it is. Turn WPS off if your router allows it.

4. Change the router admin password and update firmware

Whoever can log in to the router can see your Wi-Fi password and re-enable anything you turn off. Replace the default admin password, disable remote administration from the internet unless you need it, and install firmware updates.

5. Block a specific device (with limits)

Most routers can block or pause a client by MAC address, and some offer a MAC allow-list. This is useful for parental controls or a misbehaving gadget, but it is not real security: MAC addresses are sent unencrypted in every Wi-Fi frame, so anyone already capable of attacking your network can copy an allowed address. Randomized MACs on your own devices can also break allow-lists. Treat MAC filtering as a convenience, and rely on a strong password and WPA3 for protection.

6. Put visitors and smart devices on a guest network

A guest network gives internet access while keeping devices off your main network, so a visitor's phone or a poorly secured smart plug cannot see your computers and storage. Give it its own password and change that password whenever you like without disturbing your main devices.

Frequently asked questions

Can a neighbour see what I browse if they use my Wi-Fi?

Being on the same network does not automatically let them read your traffic, and most websites use HTTPS, which encrypts page content. They do share your bandwidth and your public IP address, so their activity appears to come from your connection. You can see that shared address on our What Is My IP page.

Why does the same phone appear several times?

Randomized MAC addresses can change periodically or after a network is forgotten and rejoined, so the router records each as a new device. Old entries usually disappear when their DHCP lease expires.

Can I see who is on my Wi-Fi without the router password?

Partially. arp -a after a ping sweep, or a network scanner, lists devices on the same subnet as you. It cannot show devices on a separate guest network or anything that is currently asleep, so the router list remains the authoritative source.

Is MAC filtering enough to keep people out?

No. It stops casual users but not anyone who can capture Wi-Fi traffic and copy an allowed address. Use WPA2 or WPA3 with a strong passphrase and disable WPS.