# How to find and identify unknown devices connected to your network

By: ManageEngine Team  
9–10 minutes  
Last updated: August 18, 2026

Seeing unknown devices connected to your network or WiFi can be concerning, especially when you don't know who they belong to or why they're connected. An unknown device may appear as an unfamiliar hostname in your router's device list, an unrecognized MAC address in a DHCP lease, or an unknown IP address during a network scan.

However, an unknown device isn't necessarily an unauthorized device. Enterprise networks commonly include personal laptops, IoT devices, contractor endpoints, wireless clients, and other unmanaged devices that may not be immediately identifiable. The key is to identify unknown devices on your network, determine whether they are authorized or unmanaged, and detect devices that shouldn't be there.

This guide explains how to find unknown devices connected to your network or WiFi, identify what they are, and determine whether they are authorized, unmanaged, or unauthorized. It also covers how to detect unmanaged devices and what to do when you find an unauthorized network device.

## Why unknown devices appear on your network

Before investigating an unknown device, understanding why unidentified devices appear on a network is necessary. Often, a device is simply unmanaged, newly connected, temporarily used, or difficult to identify from its network information alone. Here are some of the reasons why unknown devices appear.

**Devices with generic or missing hostnames:** Many IoT devices, such as IP cameras, smart TVs, badge readers, environmental sensors, and printers, may not provide a descriptive hostname. Some use generic manufacturer-assigned names such as ESP_4A2B3C or android-f7a2b1c4. These devices can normally communicate on the network but remain difficult to identify by hostname alone.

**New devices not yet added to inventory:** In certain cases, devices can be deployed faster than asset inventories are updated. For example, a newly provisioned laptop may connect to the network before it is added to the organization's asset management or endpoint management system. Until the new device is identified and recorded, it may appear as an unknown IP address, MAC address, or device during a network scan.

**Personal devices in BYOD environments:** Employees may connect personal smartphones, tablets, and laptops to corporate WiFi for legitimate work purposes. If these devices aren't enrolled in the organization's device management system, they may appear as unknown or unmanaged devices even though they aren't unauthorized.

**MAC address randomization:** Modern smartphones, tablets, and laptops can use random MAC addresses for WiFi connections to improve privacy. This can make it harder to consistently associate a device with an existing inventory record, particularly when it connects to different networks or changes its WiFi identity. As a result, a previously identified device may sometimes appear as an unfamiliar device during network discovery.

**Shared or temporary access devices:** Contractor workstations, conference room equipment, guest laptops, loaner devices, and other temporary endpoints may connect to the network without being formally added to the asset inventory. These devices can remain unidentified until an administrator reviews and approves them.

**Unauthorized network devices:** Some unknown devices are genuinely unauthorized. They may be connected by users who bypass IT approval processes or introduced by attackers who gain access to the network. Examples include personal wireless routers, unmanaged switches, unauthorized IoT devices, and other endpoints that have not been approved by the IT team.

The challenge isn't simply finding unknown devices on a network. It's to identify every device on the network, determine whether it is authorized or unmanaged, and detect devices that don't belong. Establishing this difference helps the IT teams investigate potential security risks without treating every unfamiliar device as a threat.

## How to see what devices are connected to your network

Before you can identify unknown devices on your network, you need to exactly know what are the devices connected to your network. The best method to discover all the devices depends on the size and complexity of the network. Home users and small offices can usually start with the router's connected-device list, while enterprise networks may require information from wireless controllers, DHCP servers, network scans, and other management systems. Let's look at how enterprises can discover and onboard devices across every part of their network.

Let's begin right from the basics.

### Check your router or wireless controller

For home networks and small offices, most routers and wireless access points provide a connected devices list that shows devices currently connected to the network. Depending on the router, this information may include the device's IP address, MAC address, hostname, connection type, and lease status.

You can find this information by signing in to your router's administrator interface and opening sections such as Connected Devices, DHCP Clients, Attached Devices, or Client List. Some routers use common private gateway addresses such as `192.168.1.1` or `192.168.0.1`, although the address varies by manufacturer and network configuration.

In enterprise networks, wireless LAN controllers and cloud-managed wireless platforms such as Cisco Meraki and Aruba Central can provide more detailed information about connected clients. Depending on the platform, administrators may be able to view details such as connection time, access point, signal strength, authentication method, VLAN, IP address, and MAC address.

This gives you a starting inventory of devices connected to the network. However, a connected-device list alone may not tell you who owns a device, whether it is managed, or whether it is authorized. To identify unknown devices, you may need to correlate this information with DHCP records, DNS data, switch information, asset inventories, and network discovery results.

### Review your DHCP server's lease records

Your DHCP server maintains lease records for devices that have requested dynamic IP addresses. Reviewing these records can provide useful information for identifying devices on your network, including their IP address, MAC address, hostname (when provided by the client), and lease duration.

DHCP records are particularly useful for identifying devices that have recently received an IP address, including both wired and wireless clients. By comparing DHCP lease information with your approved device inventory, you can identify devices that don't have a corresponding asset record.

However, DHCP records aren't a complete view of your network. Devices using static IP addresses, manually configured addresses, or other IP assignment methods may not appear in the DHCP lease table.

### Scan your subnets

A network scan can help identify active devices across your configured IP ranges and subnets. Scanning tools send network probes to IP addresses and log hosts that respond, providing another way to find devices that may not appear in DHCP records.

For example, Nmap can be used to perform a basic host discovery scan:

```bash
nmap -sn 192.168.1.0/24
```

You can also use Nmap to gather additional information, such as MAC addresses and device vendor details, where the network and scan method allow it:

```bash
nmap -sn -PE --send-eth 192.168.1.0/24
```

This information can help you identify an unknown device by giving you more context about its network identity and manufacturer.

Network scanning is particularly useful for finding devices with static IP addresses or devices that aren't registered with your DHCP server. However, a scan may not detect every device if hosts are configured to block probes or if network controls restrict discovery traffic.

For a more complete view of unknown devices, combine network scan results with DHCP records, ARP information, switch data, DNS records, and your authorized asset inventory. Correlating these sources makes it easier to determine which devices are known, unmanaged, or potentially unauthorized.

### Check your switch forwarding tables

Managed network switches maintain forwarding tables, also known as CAM tables or MAC address tables, that associate learned MAC addresses with switch ports. Querying these tables through the switch management interface or via SNMP can reveal which MAC addresses are reachable through each port, including devices that may not appear in DHCP records.

Switch forwarding data becomes particularly valuable when you've identified an unknown device and need to determine where it is physically connected. By mapping the device's MAC address to a switch port, network administrators can identify the device's connection point and investigate it more quickly.

For example, if an unfamiliar MAC address appears during a network scan, matching that MAC address against switch forwarding data can show the switch and port where the device was last connected. This can help narrow down the device's physical location and determine whether it is an authorized endpoint, an unmanaged device, or a potentially unauthorized network device.

Keep in mind that MAC address entries can age out of a switch's forwarding table, and trunk or uplink ports may represent multiple downstream devices. For this reason, switch data is most effective when correlated with other sources such as DHCP records, network scans, and device inventory information.

## How to identify an unknown device: What to look for

Finding unknown devices on your network is only the first step. The next challenge is determining what each device is, who it belongs to, and whether it is authorized to connect. No single piece of information is always enough to identify a device. Instead, compare multiple attributes such as the MAC address, hostname, IP address, manufacturer, network location, and device behavior.

Here are some of the key details to examine when identifying unknown devices on your network.

### MAC address and OUI lookup

Every network interface has a MAC address consisting of six groups of hexadecimal characters, such as 3C:22:FB:A1:44:7D. The first three octets traditionally identify the Organizationally Unique Identifier (OUI), which is associated with the organization that was assigned the MAC address block.

Performing an OUI lookup on an unknown MAC address can provide an immediate clue about the device or network hardware manufacturer. You can use the IEEE's public OUI registry or a MAC lookup feature in your network management software.

For example:

- 3C:22:FB → Apple, Inc.
- 00:50:56 → VMware, Inc.
- B0:7D:64 → Ubiquiti
- DC:A6:32 → Raspberry Pi Foundation

Knowing the manufacturer can help narrow down what an unknown device might be and whether it matches hardware commonly used in your organization. However, an OUI lookup generally identifies the MAC address block owner, not the exact device model or user.

MAC address randomization can make this identification more difficult. Modern smartphones, laptops, and other WiFi devices may use randomized MAC addresses, meaning the MAC address seen by the network may not correspond directly to the device's permanent hardware address. In these cases, OUI information should be treated as one identification signal rather than definitive proof of device identity.

### Hostname resolution

A device's hostname can provide a much clearer indication of what it is and who it belongs to. Names such as DESKTOP-JK82L4, Johns-MacBook-Pro, or HP-LaserJet-Pro-M428 can help identify a workstation, laptop, or printer without requiring deeper investigation.

You can obtain hostname information from sources such as DNS records, DHCP lease records, device discovery tools, or the device itself. Comparing the hostname with its IP address and MAC address can help match an unknown device to an existing asset or user.

If a device has no hostname or uses a generic name, it may be an IoT device, embedded system, guest device, or endpoint that hasn't been properly configured or registered in your inventory. However, a missing hostname alone doesn't indicate that a device is unauthorized.

### Device fingerprinting

When a device doesn't provide enough identifying information through its hostname or MAC address, device fingerprinting can provide additional clues. Fingerprinting examines characteristics such as network protocols, DHCP behavior, open ports, and advertised services to estimate the type or operating system of a device.

Common fingerprinting signals include:

- **DHCP fingerprint:** The parameters and order of options in a DHCP request can provide clues about the operating system or device type. Different operating systems may use different DHCP option patterns, allowing network tools to make an educated identification without installing an agent on the device.
- **Open port profile:** A network scan can reveal open ports such as 80 (HTTP), 443 (HTTPS), 8080, or 22 (SSH). The combination of open ports and services can help distinguish a web server, network device, printer, workstation, or other endpoint.
- **mDNS and service discovery:** Devices that advertise services through mDNS or Bonjour can expose device names and service types. This is common among Apple devices, printers, smart speakers, and other IoT equipment.
- **NetBIOS and LLMNR:** Windows environments may expose computer names through NetBIOS or LLMNR, providing another way to associate an IP address with a device name.

Fingerprinting is useful for narrowing down what an unknown device is, but it should not be treated as definitive identification. Different devices can expose similar network characteristics, and security controls may prevent some fingerprinting methods from collecting complete information.

### Check the device's network location

Knowing where an unknown device is connected can provide an important clue about its identity. If the device is connected through WiFi, check the access point, SSID, VLAN, and authentication information associated with the client. For wired devices, map the MAC address to the switch and port where it was learned. A device connected to an access point in a conference room may have a disparate context from one connected to a restricted server VLAN.

Switch port information can be particularly useful because it can help determine the physical location of an unknown endpoint. Once you know the switch and port, you can check what is physically connected there and determine whether the device belongs to an employee, department, contractor, or approved infrastructure.

### Examine traffic behavior and communication patterns

The destinations and services a device communicates with can provide additional context about its purpose. For example, an IP camera may periodically communicate with a video management system, a printer may connect to print servers, and an IoT device may communicate with its manufacturer's cloud service.

Unexpected communication patterns can also indicate that an unknown device requires further investigation. A device contacting unusual external destinations, communicating with systems it normally shouldn't access, or generating unexpected traffic volumes may warrant closer examination.

Traffic behavior should be treated as supporting evidence rather than definitive identification. A device's communication pattern can help establish whether its behavior is consistent with its suspected role, but it doesn't by itself prove that the device is unauthorized.

## Authorized, unmanaged, and unauthorized: Understanding the difference

Once you've gathered enough information about an unknown device, the next step is to classify it. An unknown device is simply a device that hasn't been identified yet. After inspection, it can generally be classified as authorized, unmanaged, or unauthorized. Let's drill down into each category further more.

### Authorized devices

An authorized device is one that has been approved by the organization and is permitted to access the network. It should typically have a corresponding asset or device record and comply with the organization's security policies. For example, a newly deployed workstation, recently replaced printer, or managed IoT device may appear as an unknown device because its inventory record hasn't been updated yet. Once its identity and ownership are confirmed, the device can be added to the appropriate inventory or trusted device record.

### Unmanaged devices

An unmanaged device is connected to the network and may be legitimate, but it isn't registered or managed through the organization's IT processes. Examples include personal devices in BYOD environments, contractor laptops, conference room tablets, and IoT devices deployed by individual business units without IT involvement.

Unmanaged devices aren't necessarily unauthorized. However, they can create security gaps because they may not have required endpoint protection, patch management, configuration controls, or compliance policies applied to them. Detecting unmanaged devices helps IT teams identify these gaps and decide whether to bring the devices under management, place them on an appropriate network segment, or restrict their access.

### Unauthorized devices

An unauthorized device is a device that isn't approved to access the organization's network or cannot be associated with a legitimate user, business function, or approved process. Examples of unauthorized devices include personal wireless routers installed without IT approval, devices connected to unused switch ports, and endpoints that violate the organization's network access policies.

Unauthorized network devices require investigation because they may introduce security, compliance, or operational risks. Depending on the device and the organization's policies, the response may include contacting the device owner, restricting network access, disabling the associated switch port, moving the device to a restricted network segment, or initiating a security investigation.

**Unknown vs. unmanaged vs. unauthorized: Key differences**

These terms describe different stages or conditions and shouldn't be used interchangeably:

| Device status | What it means | Typical response |
|---|---|---|
| Unknown | The device has been detected, but its identity or ownership hasn't been established. | Investigate and identify the device. |
| Authorized | The device is identified and approved to access the network. | Add or update its inventory record if necessary. |
| Unmanaged | The device may be legitimate but isn't enrolled in the organization's management processes. | Assess the risk and bring it under management or restrict access. |
| Unauthorized | The device isn't approved to access the network or violates access policies. | Investigate and restrict or remove access as appropriate. |

## Unknown devices connected to WiFi: Specific considerations

Identifying unknown devices connected to WiFi can be more challenging than identifying devices on a wired network. A wired device can often be traced to a physical switch port, while a wireless client can connect from anywhere within the access point's coverage area. Depending on the network design and signal range, a device may even connect from outside the organization's physical premises.

Wireless networks also introduce additional factors that can make device identification more difficult, including MAC address randomization, multiple access points, guest networks, shared SSIDs, and temporary or roaming clients. As a result, identifying an unknown WiFi device requires more than simply checking its IP or MAC address.

When investigating an unknown device connected to WiFi, look at the following information:

### Check the access point and SSID

Identify which wireless access point the device is connected to and which SSID or wireless network it is using. This can help determine whether the device is connected to the corporate network, guest network, IoT network, or another segmented wireless network.

### Check authentication details

Review how the device authenticated to the wireless network. Depending on the configuration, this may include a username, certificate, PSK, or other authentication method. Authentication information can help establish whether the device is associated with an authorized user or access method.

### Check signal and connection information

Wireless controllers and access points may provide details such as signal strength, connection time, frequency band, and access point association. These details can help narrow down the device's approximate location and determine whether it is a stationary or roaming client.

### Account for MAC address randomization

Modern mobile devices can use randomized MAC addresses when connecting to WiFi. This can cause the same physical device to appear under different MAC addresses and may make inventory matching less reliable. When investigating an unknown WiFi device, consider MAC randomization alongside hostname, authentication, access point, and other available information rather than relying on the MAC address alone.

### Check guest and IoT networks

Devices connected to guest or IoT SSIDs may be legitimate even when they aren't present in the organization's primary device inventory. Check the network segment and access policies before classifying an unfamiliar wireless client as unauthorized.

These additional details can help distinguish between a legitimate guest, an unmanaged endpoint, a roaming employee device, and a genuinely unauthorized wireless device.

## Identifying unknown WiFi devices

The same techniques used to identify wired devices such as MAC address lookup, hostname resolution, and DHCP fingerprinting also apply to WiFi clients. However, wireless controllers and cloud-managed wireless platforms can provide additional context, including the SSID, connected access point, authentication method, signal strength, and approximate location.

This information can help determine whether an unknown device is connected to an approved corporate or guest network, and can also help identify devices connecting through an unauthorized wireless access point.

## What to do when you find an unauthorized device

Once you've confirmed that a device is unauthorized, take a measured approach rather than immediately blocking it. Gathering enough information first helps prevent legitimate devices from being mistakenly disconnected and provides useful evidence for investigation.

- **Document the device details:** Record the IP address, MAC address, hostname, vendor, connected switch and port, VLAN, and discovery time. This information can support further investigation, incident response, and audit requirements.
- **Verify ownership:** Before restricting access, check IT helpdesk records, recent device deployments, onboarding activity, or the relevant business unit to confirm that the device doesn't have a legitimate owner.
- **Isolate or restrict the device:** If the device is confirmed to be unauthorized, restrict its network access according to your organization's security policies. Depending on the network infrastructure, this may involve disabling a switch port, applying an access-control rule, or moving the device to a restricted network segment.
- **Investigate how it connected:** Determine whether the device connected through an authorized switch port, an unmanaged switch, a guest network, or an unauthorized wireless access point. Identifying the access path can help prevent similar devices from connecting again.
- **Strengthen access controls:** If the device exposed a gap in network security, such as an unused active port, poorly secured wireless network, or uncontrolled VLAN, review and strengthen the relevant access controls.

## Why manual identification doesn't scale in enterprise environments

Manually reviewing DHCP leases, router device lists, ARP tables, and network scans may work for small networks, but the approach becomes difficult to maintain as the environment grows.

- **Volume:** Enterprise networks can contain thousands of endpoints, making it impractical to investigate every unknown device manually.
- **Constant changes:** Devices connect and disconnect throughout the day as employees move between locations, contractors join the network, and temporary devices come online.
- **Limited visibility:** Individual DHCP tables, ARP records, router dashboards, or network scans provide only a partial view of the environment. Devices on other network segments may be missed.
- **MAC address randomization:** Randomized MAC addresses can cause the same wireless device to appear as a different device, creating additional unknown-device entries.
- **No consistent baseline:** Manual processes make it difficult to continuously compare newly discovered devices against an up-to-date inventory of authorized devices.

Automating device discovery, identification, and classification provides a more consistent approach. By continuously comparing detected devices against trusted inventory data, IT teams can identify unknown, unmanaged, and unauthorized devices faster and investigate potential rogue devices before they become a larger security or operational problem.

## How ManageEngine OpUtils helps find and identify unknown devices

[ManageEngine OpUtils](https://www.manageengine.com/products/oputils/) helps administrators discover, identify, classify, and locate devices connected to their network from a centralized console. By combining network discovery, MAC address tracking, Active Directory integration, trusted-device management, and Switch Port Mapper, OpUtils helps identify unknown and unmanaged devices across wired and wireless environments.

- **Discover devices across your network:** OpUtils periodically scans configured subnets, IP ranges, routers, switches, and other IP-connected devices to discover devices on the network. Discovery data can come from IP scanning, MAC address information, [DHCP monitoring](https://www.manageengine.com/products/oputils/dhcp-monitoring.html), switch scans, and other network sources, providing broader visibility across network segments.
- **Build a trusted device inventory:** OpUtils allows administrators to establish a trusted baseline for their network. Devices associated with Active Directory can be automatically marked as trusted, while administrators can manually approve additional known devices or import trusted MAC addresses. Once the baseline is established, newly discovered devices can be identified for further investigation.
- **Identify unknown and unmanaged devices:** When a newly discovered device doesn't match the trusted inventory, administrators can review its IP address, MAC address, DNS name, vendor, and other available details to determine what it is and whether it should have network access. This helps distinguish legitimate new devices and unmanaged endpoints from devices that may be unauthorized.
- **Classify devices as trusted, guest, or rogue:** Not every unknown device is unauthorized. OpUtils allows administrators to classify discovered devices as trusted, guest, or rogue. Guest devices can be given temporary access with a defined validity period, while devices confirmed as unauthorized can be marked as rogue and investigated further. Read more on [OpUtils' rogue device detection capabilities](https://www.manageengine.com/products/oputils/rogue-detection-tool.html).
- **Locate unknown devices with Switch Port Mapper:** When an unknown or rogue device is connected to a wired network, OpUtils can use [Switch Port Mapper](https://www.manageengine.com/products/oputils/switch-port-mapper.html) to identify the switch and port associated with its MAC address. This helps administrators determine where the device is physically connected and take action without manually checking individual switches.
- **Block unauthorized devices and prevent reconnection:** Once a device is confirmed as unauthorized, administrators can block the associated switch port directly from OpUtils. [DHCP-based MAC filtering](https://www.manageengine.com/products/oputils/mac-address-filtering.html) can also help prevent a blocked device from reconnecting through another switch port, providing an additional layer of control.
- **Get alerts when new devices are detected:** OpUtils can notify administrators when new devices are discovered and when temporary guest access expires. These alerts help network teams investigate unknown devices promptly instead of relying solely on manual reviews.

By combining device discovery, trusted inventory management, device classification, Switch Port Mapper, and rogue device controls, OpUtils provides a centralized way to find unknown devices, identify unmanaged endpoints, locate where they are connected, and investigate unauthorized network access.

## Frequently asked questions on identifying unknown devices on the network

### How do I find unknown devices connected to my network?

You can find unknown devices by checking your router's connected device list, reviewing DHCP server lease records, running a subnet scan using tools such as Nmap, or querying switch forwarding tables on managed network equipment. In enterprise environments, automated network discovery software continuously scans all configured subnets and maintains a centralized inventory of connected devices, making it easier to identify unknown or unauthorized endpoints as soon as they appear.