An unfamiliar name, address, or old-looking entry in your router can be unsettling.
But it doesn't tell you much on its own. Router interfaces often put several
kinds of information on the same screen: devices connected to Wi-Fi now, DHCP
leases issued earlier, remembered host names, and sometimes a history of
clients. A row on that screen can be useful evidence. By itself, though, it
doesn't show that a device is currently connected or belongs to an intruder.
Start with a narrower question: what kind of record is this, and when was it
last observed? Work that out before blocking an address, resetting the router,
or changing a password. The steps below are for a network you own or are
authorized to administer. The first checks are reversible, and each leaves you
with a record of what you actually observed.
The type of router list
Check the page label and its fields as well as the device name. A page called
DHCP leases, address reservations, or known clients can keep
information after a client goes offline. DHCP is the protocol a server uses
to assign an address for a lease time; RFC 2131 describes how clients obtain,
renew, and release those leases. A lease tells you the server allocated an
address. It doesn't necessarily mean there's a live Wi-Fi session.
A current Wi-Fi association list tells you something different. It may show
signal, band, connection time, or a short inactivity timer. An Ethernet switch’s MAC address table is another kind of observation. A router dashboard may combine all three
without making the differences clear. Write down the page name beside the
entry. When you compare it later, that detail helps you avoid treating a
remembered lease as evidence of a current connection.
Record the time, network name or VLAN, IP address, displayed hardware address,
host name, and any last-seen or expiration value. Keep the note private:
router screenshots can expose local addresses, Wi-Fi names, or administration
details. No timestamp? Put that in the note too. Leave that uncertainty in the
record instead of filling in a time from memory.
The lease lifetime
A device can leave the room while its DHCP lease stays on the screen. A phone
may be asleep, a laptop may have moved to another network, or a streaming box
may simply be powered off. The router normally decides when to reuse an
address based on how it handles leases. Manually deleting a row doesn't prove
anything about who used it.
Compare the entry's expiration or last-seen time with the time you recorded
your observation. A recent Wi-Fi association and packets moving through the
router are stronger evidence of current activity than an address under an old
lease. A lease that expired long ago but still appears on the screen, on the
other hand, may just be a remembered client. Router vendors use different
words for these fields. Read the labels as that vendor's descriptions, not as
status terms that mean the same thing on every router.
Don't create an address conflict to test the record. RFC 5227 describes IPv4
address-conflict detection used by hosts that implement it; deliberately
assigning the same address can interrupt a printer, NAS, or another legitimate
device. It's safer to observe what's there than to create a conflict.
The network boundary and a known device
First, check which device is actually assigning addresses. Homes with a
modem-router plus a separate Wi-Fi router, mesh system, guest network, or VLAN
can have more than one client list. A device may belong on one list and be
correctly absent from another. Note the SSID, subnet, and gateway of the
network you're checking before comparing results from a scanner or a computer.
Then test an ordinary explanation. Check household phones, tablets, printers,
consoles, watches, and IoT devices on the same network. With the owner's
permission, compare their Wi-Fi details, connection time, and displayed IP
address with the router entry. Keep private Wi-Fi addresses in mind too.
Apple documents private Wi-Fi addressing per network; a settings change,
forgetting and rejoining a network, or a different privacy mode can make a
familiar device appear under a different address. That doesn't prove the entry
is harmless. It does give you a reason to compare before blocking it.
Names and address prefixes are clues, not proof of identity. A host name can
be generic, copied from an older record, or set by a user. A private or
randomized address doesn't reliably identify a manufacturer. Write down what
matches and what you're still unsure about, rather than guessing who owns a
device from one label.
One limited, read-only observation
If the entry is still unclear, make one observation from an authorized computer
on the same network. Check the router's current association view, a managed
switch table, or a local network scan that you understand. Record the method
and time with the result. A device missing from a scan isn't a conclusive
result: sleeping devices, firewalls, client isolation, and separate subnets can
all affect what you can see.
Avoid broad service probing or logging into an unfamiliar device. If you
suspect a household printer or NAS, a less invasive way to check is to look at
that known device's own network settings or watch its entry while its owner
connects and disconnects it. DeviceShelf is one option for making another local
observation on a network you administer, but it can't turn an ambiguous router
record into a confirmed identity.
You don't need a sweeping conclusion. “Old DHCP lease; no current association observed”
is useful. So is “current connection observed; ownership not yet confirmed.”
For the next review, a dated note of what you did and didn't see is better
evidence than a confident label based on a single dashboard row.
Escalation based on the facts
If a current connection is still unexplained after those comparisons, review
who knows the Wi-Fi password, whether the guest network is separated, and
whether the router firmware and administrator credentials are current. NIST's
wireless LAN guidance provides a useful checklist for reviewing the network's
security configuration. Make changes through the router vendor's documented
interface, not through a link in a device name or a message about the device.
Changing a Wi-Fi password can make sense when there's evidence behind a concern
that an unauthorized person knows it. The change also disconnects legitimate
devices, so plan for it and reconnect them deliberately. Blocking one MAC
address isn't a complete security response: addresses can change, and a block
doesn't replace secure Wi-Fi and router administration. If you've explained
the record, keep a short inventory note. If you haven't, keep your observations
and seek appropriate local administration help. Be clear about what the router
list actually proved.
Top comments (0)