How to Identify an Unknown Device on Your Wi-Fi

Six steps from “who is that?” to a name — and why a blank answer is usually your own phone.

What do I do about an unknown device, step by step?

Start with the address, not the name. Names in a router list are whatever the device chose to announce, and most gadgets announce nothing. The hardware address is assigned at the factory and cannot be left blank.

Most people are done at step 3 or step 4. The rest of this page explains why those two steps work, using the actual contents of the manufacturer database behind the lookup.

What does the hardware address actually tell me?

Two things: who made the network radio, and whether the address is real. Both are in the first half.

The first three pairs are a 24-bit prefix that a manufacturer buys from the IEEE, the standards body that keeps the registry. The last three pairs are a serial the manufacturer assigns itself, which is why one prefix covers exactly 16,777,216 devices. The database behind the lookup on this site holds 52,276 registered blocks under 31,771 company names. Ownership is lopsided in a way that helps you: 28,939 of those names own a single block, while Apple alone owns 1,274, enough for more than 21 billion devices.

The second character carries a flag. In binary, the second-lowest bit of the first pair says whether the address came from the factory (bit clear) or was made up locally (bit set). Setting that bit turns the second hex character into 2, 6, A or E. That is the whole trick behind step 4, and it is not a rule of thumb: it is how the address format is defined.

The MAC Address Analyzer reads both flags for you and prints the address in every common notation, which is useful when a router shows hyphens, a phone shows colons and a printer shows twelve bare characters.

Why does the lookup find nothing?

Because the address was never registered to anyone, and in a home that almost always means a phone. Since iOS 14, Android 10 and Windows 10, phones and laptops generate a fresh private address for each Wi-Fi network they join, and they do it by default. Your own iPhone can appear in the router list under an address that no database on earth has heard of.

Two numbers make the check reliable rather than merely likely. Registered prefixes occupy only 0.22% of the 16,777,216 possible values, and a randomized address can only fall in the quarter of that space where the local flag is set. Just 218 registered blocks live in those 4,194,304 values, so a made-up address landing on a real maker by chance is roughly a 1-in-19,000 event. And the owners of those 218 blocks the owners are names like Digital Equipment Corporation, 3Com and Racal-Datacom: registrations from the era of minicomputers, not anything that would join your Wi-Fi today.

So when the lookup comes back empty and the second character is 2, 6, A or E, you are not looking at an intruder. You are looking at one of your own screens. To prove which one, check the device itself rather than the router:

• iPhone or iPad: Settings → Wi-Fi → the i next to your network. The Wi-Fi Address shown there is the randomized one the router sees. Below it, Private Wi-Fi Address is the switch that turns randomization off for that network.
• Android: Settings → Network & internet → Wi-Fi → the network's details. Look for Randomized MAC or Privacy.
• Windows: Settings → Network & internet → Wi-Fi → the network's properties → Random hardware addresses.

Match the address, not the name, and every phone in the list accounts for itself. There is no need to switch randomization off; it protects you from being tracked between networks, and the router list is the only place it causes confusion.

Which maker names mean which devices?

The lookup names the company that registered the prefix, and that company built the Wi-Fi radio. For phones, laptops and consoles that is the brand you expect. For smart-home gear it is usually the chip or module maker inside, which is why a smart plug you bought under some brand you have forgotten shows up as a semiconductor company.

The pattern to notice: brands you can name are at the top of the table, and the chip makers you have never heard of are the ones most likely to be the “unknown” entry. 1,148 of the company names in the database contain the word Shenzhen. A great deal of the smart-home hardware on sale is built there, and its addresses say so.

A real device list, decoded

Here is the kind of list a home router produces, with the name column left exactly as the router shows it. Every prefix below is looked up as written.

Seven of the eight resolve to something ordinary. The one worth chasing is not the blank no-match — that was a phone — but the Intel laptop nobody can account for. That is the general shape of the exercise: the frightening entries turn out to be your own phones, and the real question, if there is one, hides behind a perfectly respectable manufacturer name.

If you want the network side of the list to make sense as well, the addresses in the IP column all sit inside one range that the router hands out. The IP Subnet Calculator shows that range from the router's address and mask, and tells you how many devices can fit in it, which is a quick way to notice that a device is on a guest network or a second router rather than the main one.

What if the answer is “IEEE Registration Authority” or “Private”?

Both are answers, not errors, and both point the same way: a small manufacturer.

IEEE Registration Authority means the maker bought a smaller block than a full prefix. Since 2014 the IEEE has sold blocks of 1,048,576 and 4,096 addresses as well as the classic 16,777,216, and the smaller ones share their first six characters with a handful of umbrella prefixes owned by the IEEE itself. In the database behind the lookup there are 360 such umbrella prefixes, and underneath them sit 16,019 smaller blocks belonging to 12,240 companies that appear nowhere else in the list. Nearly all of them are small electronics firms, sensor makers and start-ups, because a small block is what a company buys when it will never ship a million units. In a home, that is a budget smart-home product, a development board or a piece of a hobby project. The lookup on this site reads the first six characters, so it stops at the umbrella name; the maker behind it is one of those 12,240.

Private means the registrant paid the IEEE not to publish its name. There are 203 such blocks. Some belong to large companies keeping a product line quiet before launch, some to defence and industrial suppliers. Either way the device is a manufactured product with a real registration, not a spoofed address.

How do I get rid of a device I cannot explain?

Change the Wi-Fi password. It is blunt, it takes two minutes, and it is more informative than any blocklist, because it disconnects everything at once and lets you watch the list refill as you reconnect your own devices one at a time. Whatever you did not reconnect and still comes back has the new password, which is a different and much more specific problem than an unknown entry.

1. Change the password and the network name. Devices remember networks by name; a new name stops them auto-joining with a cached password.
2. Turn on WPA3 if the router offers it, WPA2 otherwise. Never leave a network open or on WEP.
3. Move smart-home gear to the guest network. Plugs, bulbs and cameras do not need to see your laptop. Most routers let you give the guest network its own password.
4. Turn off WPS. The push-button pairing feature has a long history of letting devices join without the password.
5. Reconnect your devices one at a time and watch each one appear. You are building the list of what belongs, which is the list you will compare against next time.

Two things that sound like solutions and are not. Hiding the network name does nothing, because devices still broadcast it when they look for the network. Address filtering, where the router only admits listed addresses, is defeated by anyone who can see the traffic and copy an allowed address, and it also locks out your own phones every time they rotate a private address. If you do decide to set up filtering to keep a specific old gadget on the network, the MAC Address Generator is useful for producing a valid test address to confirm the filter actually blocks what it should.

If the router's log shows the unexplained device talking to an address on the internet, that address has an owner. Paste it into the WHOIS Lookup to see which company or network holds it, and into the DNS Lookup to see whether a name resolves to it. A smart plug phoning home to its maker's cloud is normal; a laptop you do not own talking to a hosting provider at 3 a.m. is not.

Terms worth knowing

MAC address (hardware address)

The 48-bit identifier burned into a network radio, written as twelve hexadecimal characters. Routers list it because it is the one field every device must present.

OUI (manufacturer prefix)

The first 24 bits of a MAC address, registered to one company. Sixteen million addresses per prefix.

Locally administered address

An address made up by software rather than assigned at the factory, marked by a set bit that turns the second character into 2, 6, A or E. Randomized private addresses are the everyday example.

Randomized / private Wi-Fi address

A locally administered address that a phone or laptop generates per network so it cannot be tracked across networks. On by default on iOS, Android and Windows.

Unicast and multicast

The other flag in the first pair. A device's own address is always unicast; a multicast address in a client list is a display glitch, not a device.

DHCP client list

The router's record of every device it has handed an IP address to. Some routers keep entries for hours after a device leaves, so an “unknown” device may simply be gone.

Guest network

A second Wi-Fi network, isolated from the main one, meant for visitors and for gadgets you do not fully trust.

WHOIS

The public registry of who holds an internet address or domain name. Useful for the outside addresses in a router log, not for the 192.168.x.x ones inside your home.

All 11 tools in this guide

Authoritative sources

• IEEE Registration Authority — the registry every manufacturer prefix comes from, including the smaller MA-M and MA-S blocks.
• MAC address — Wikipedia — the address format, and the two flag bits in the first byte.
• Use private Wi-Fi addresses on Apple devices — Apple Support — how and why iPhones and iPads randomize per network.
• MAC randomization behavior — Android Open Source Project — the Android defaults since version 10.
• Home Network Security — CISA — the password, encryption and guest-network advice in the eviction section.

Last updated: 2026-09-03 · Published: 2026-09-03 · Written by the miniwebtool.com editorial team.

This guide is for general and educational use. Every count on this page — the 52,276 blocks, the 218 locally administered registrations, the 360 umbrella prefixes and the per-maker totals — comes from the manufacturer database behind the MAC Address Lookup on this site as it stood when this page was written, and you can reproduce any of them with a vendor-name search in that tool. Registrations are added continually, so newer devices may not be listed. Identifying a device by its address tells you who made its radio, not what it is doing; nothing here replaces securing your router with a strong password and current firmware. Tool behaviour is described as it works today and may change.