Unknown devices on a Wi-Fi network

If you have just scanned a home or rental network and found six things you cannot account for, that is the ordinary result. This guide explains why, what the small amount of information you do get actually means, and how to narrow an unknown down without leaping to a conclusion.

Why networks are full of unidentifiable devices

Count what is on a typical household network: a router, a range extender or mesh node or two, a television, a streaming stick, a games console, a printer, a couple of smart bulbs or plugs, a speaker, a thermostat, a robot vacuum, a doorbell, phones and laptops belonging to people who live there, and a smart watch. Fifteen to twenty-five addresses is unremarkable.

Now consider what each of those tells a scanner about itself. Some publish a friendly name over Bonjour and are instantly recognisable. Many publish nothing at all — they connect, get an address, talk outward to their manufacturer's servers, and never announce themselves locally. A smart plug has no reason to advertise a service to other devices in the house, so it does not.

There are further reasons an address looks anonymous:

• Private Wi-Fi addresses. Modern phones and laptops rotate their hardware address per network for privacy, which by design defeats identification.
• Reassigned addresses. Local IP addresses are handed out by the router and change over time, so the device at a given address today is not necessarily the one that was there last week.
• Sleeping devices. Battery equipment wakes periodically, so it appears in one scan and not the next. That is not a device hiding.
• Guests and neighbours. A visitor's phone, or a device belonging to a neighbouring flat that shares the network in a converted building.
• Firewalled hosts. A laptop with its firewall on answers a ping and nothing else. Silence is often a sign of good configuration, not concealment.

What a device name actually tells you

Names are self-declared. A device chooses what to call itself, and there is nothing verifying it. A name is a hint of varying quality:

The asymmetry matters: a suspicious name is meaningful because harmless devices rarely adopt one, but a harmless name proves nothing, and no name proves nothing at all.

What an open port actually tells you

An open port means a device is running a service that accepts connections on that port number. Port numbers are conventions, not guarantees — anything can listen on any port.

• 554 and 8554 are the conventional RTSP ports, the streaming protocol most IP cameras and recorders use. This is the most informative single indicator a scan can give you, because relatively few non-camera devices speak RTSP.
• 80, 443, 8080, 8000 are ordinary web ports. Enormous numbers of devices have a web interface: routers, printers, NAS boxes, smart-home hubs, media servers. On its own, an open web port is close to meaningless.
• 88, 37777, 34567, 8899 are ports associated with particular camera and DVR vendors' control protocols. More specific than a web port, less definitive than RTSP.

The reasoning that holds up is combination. One open web port on an unnamed device is noise. An RTSP port plus a Bonjour _rtsp._tcp advertisement plus a camera-suggestive name, on a device that was not there yesterday, is a coherent picture worth acting on — by going and looking at the room, not by concluding anything from the screen.

How to reason about an unknown without panicking

1. Account for what you own first. Work through your own devices and the property's obvious equipment and tick them off. Most unknowns resolve here.
2. Check the count against the room. How many connected things can you actually see? Televisions, speakers, bulbs, thermostats, a doorbell, a printer. If the numbers roughly match, the unknowns are probably those objects failing to introduce themselves.
3. Scan again later. A second scan a few hours apart separates permanently present devices from sleeping ones and passing phones. A device present in both scans, at the same address, is a fixture.
4. Look at the indicators together, not one at a time. A device with several camera-related signals is a different proposition from a device with one.
5. Turn things off, one at a time — but only equipment you control or are permitted to switch off, such as unplugging your own laptop or asking a host about a device. Rescan and see what disappeared. This is the most reliable way to attribute an address to a physical object.
6. Take the shortlist into the room. If something still looks camera-shaped after all that, the next step is a visual inspection of the rooms where such a device would have a sightline. See the hotel guide or the rental guide.

Two things not to do. Do not try to log in to, probe aggressively, or interfere with a device you do not own — that is unlawful in most jurisdictions regardless of what you suspect. And do not scan a network you were not given access to.

Hotel networks are a special case

On most hotel Wi-Fi you will see almost nothing at all, because hotels run client isolation to stop guests reaching each other's laptops. That is good security and bad visibility: an empty scan in a hotel is the expected result and tells you nothing about whether devices exist. Do not read it as reassurance. In hotels, the visual inspection carries the weight.

Rentals are the opposite. You are usually on the household's ordinary network with no isolation, so a scan is genuinely informative — and correspondingly full of ordinary unknowns.

What Findy can help with

• Enumerating what responds on the local subnet, so you have a list to reason about rather than a vague worry.
• Browsing Bonjour advertisements, including _rtsp._tcp and _http._tcp, which is where a self-declared name usually comes from.
• Probing the camera-associated ports — 554, 8554, 80, 443, 8080, 8000, 88, 37777, 34567 and 8899 — and showing you which answered.
• Showing the reason behind every flag, so you can see whether a device was highlighted for an open port, a service advertisement, or nothing more than its name.
• Comparing against your last scan of the same network, so a newly appeared device stands out.
• Labelling honestly: each device is marked either Ordinary or Shows camera-related indicators, with the reason shown alongside it, no "confirmed" state and no certainty score. Note that a name matching a manufacturer known for cameras is enough on its own to flag a device.

The network scanner requires the subscription, $39.99 per year in the US.

What Findy cannot determine

• What an unidentified device is. If a device publishes no name and opens no recognisable port, there is nothing to work from, and Findy will say so rather than guess.
• The manufacturer. iOS does not expose the ARP table, so there is no hardware address available and no vendor lookup is possible.
• Whether a device is a camera, who owns it, where it physically is, or what it is pointing at.
• Anything on a different network — a separate private network in the same building, a guest network you are not joined to, or a neighbouring property.
• Anything behind client isolation, which is most hotel networks and some business networks.
• Devices that are powered off, asleep at the moment of the scan, recording only to a local card, or connected over mobile data.
• Wired devices with no network presence at all.

The complete limitations.

Related guides

• How to check a holiday rental — where network scanning is most worth doing.
• How to check a hotel room — where it mostly is not.
• Bluetooth tracker or ordinary device? — the same reasoning applied to radio rather than networks.
• The network scanner in detail.