Find every device on your network

Whether you are hunting for a printer's address or wondering who is on your Wi-Fi, the answer comes from the same three sources: the router, the ARP table, and the devices announcing themselves. Each misses something, so use two.

1. The router's client list (start here)

The DHCP server knows every device it has leased an address to, with the hostname the device supplied. Log in at the gateway address and look for Attached Devices (Netgear), DHCP Client List or Clients (TP-Link, ASUS), Device list / My devices (BT, Sky, Virgin), Home Network › Network (Fritz!Box), Status › Overview › Active DHCP Leases (OpenWrt), Client Devices (UniFi). Gaps: devices with static addresses never appear, and devices that left may linger until the lease expires.

2. Ask the network directly

Windows · Command Prompt

:: ping every address on the subnet (fast, no output), then read the ARP cache
for /L %i in (1,1,254) do @start /b ping -n 1 -w 100 192.168.1.%i >nul
timeout /t 5 >nul
arp -a

Windows · PowerShell

# PowerShell 7: parallel sweep, then ARP
1..254 | ForEach-Object -Parallel { $ip="192.168.1.$_"; if (Test-Connection $ip -Count 1 -TimeoutSeconds 1 -Quiet) { $ip } } -ThrottleLimit 64
Get-NetNeighbor -AddressFamily IPv4 -State Reachable,Stale | Sort-Object { [version]$_.IPAddress } | Format-Table IPAddress, LinkLayerAddress, State
# resolve names where possible
Get-NetNeighbor -AddressFamily IPv4 -State Reachable,Stale | ForEach-Object { [pscustomobject]@{ IP=$_.IPAddress; MAC=$_.LinkLayerAddress; Name=(Resolve-DnsName $_.IPAddress -ErrorAction SilentlyContinue).NameHost } }

Devices that ignore ping (Windows PCs with the firewall on, some phones) still answer the ARP request that precedes it, so they appear in arp -a even though ping "failed". Windows has no built-in scanner; nmap (Npcap) or Advanced IP Scanner are the usual installs.

Linux · Terminal

sudo arp-scan --localnet                       # fastest and most complete: every host answering ARP, with vendor
sudo arp-scan -I wlp2s0 --localnet
sudo nmap -sn 192.168.1.0/24                   # ping/ARP sweep with vendor names (needs root for ARP)
nmap -sn 192.168.1.0/24 | grep -E 'report|MAC'
sudo nmap -sn -PR 192.168.1.0/24               # ARP only
ip neigh                                       # what the kernel already knows
avahi-browse -art                              # everything advertising services over mDNS (Apple gear, printers, Chromecasts, Linux boxes)
avahi-browse -rt _workstation._tcp
sudo nmap --script broadcast-dhcp-discover     # find DHCP servers
sudo nmap -sn --script broadcast-upnp-info 192.168.1.0/24   # UPnP/SSDP devices: TVs, consoles, media servers
# install: apt install arp-scan nmap avahi-utils

macOS · Terminal

# ping sweep then ARP (built in)
for i in {1..254}; do ping -c1 -W 200 192.168.1.$i >/dev/null 2>&1 & done; wait; arp -an
# Bonjour
dns-sd -B _services._dns-sd._udp local.        # service types present on the LAN (Ctrl+C to stop)
dns-sd -B _airplay._tcp local.
dns-sd -B _ipp._tcp local.                     # printers
dns-sd -B _smb._tcp local.
# with Homebrew
brew install nmap arp-scan
sudo arp-scan --localnet
sudo nmap -sn 192.168.1.0/24

Output

$ sudo arp-scan --localnet
Interface: enp3s0, type: EN10MB, MAC: 08:00:27:4e:66:a1, IPv4: 192.168.1.42
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.1.1     d4:6e:0e:11:22:33       TP-Link Technologies Co.,Ltd.
192.168.1.10    3c:22:fb:aa:bb:cc       Apple, Inc.
192.168.1.20    00:1e:8f:12:34:56       Canon Inc.
192.168.1.23    5e:a1:2b:3c:4d:5e       (Unknown: locally administered)
192.168.1.57    dc:a6:32:9f:8e:7d       Raspberry Pi Trading Ltd
192.168.1.88    64:16:66:0a:0b:0c       Nest Labs Inc.

6 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.043 seconds (125.31 hosts/sec). 6 responded

Unknown: locally administered is a phone or laptop using a randomised Wi-Fi address. Devices on a guest network or behind Wi-Fi client isolation do not answer ARP from your segment and will only show in the router's list. Sleeping phones and laptops may not answer for a few seconds; scan twice.

3. Identify what each device is

Vendor from the MAC: arp-scan and nmap print it; otherwise look up the first three bytes. OUI lookup → Randomised addresses have no vendor.
Hostname: the router's list, nslookup 192.168.1.88 (if the router does reverse DNS), avahi-resolve -a 192.168.1.88 / dns-sd -q 88.1.168.192.in-addr.arpa PTR for mDNS names, nbtstat -A 192.168.1.88 for Windows names.
Open ports: nmap 192.168.1.88 or nmap -sV 192.168.1.88 on your own network. 80/443 with a web page usually identifies an appliance; 9100/631 a printer; 8009/8008 a Chromecast; 62078 an iPhone; 5000/7000 an Apple TV or AirPlay speaker; 3389 a Windows PC with Remote Desktop; 22 a Linux box or NAS; 1900 (UDP) anything with UPnP.
DHCP fingerprint: the router or Pi-hole may show "Android", "iPhone", "Windows" from the DHCP request options; nmap -O guesses the OS from TCP behaviour.
Turn things off: the low-tech method that always works. Unplug the suspect, rescan.

4. An unknown device on your Wi-Fi

Before assuming an intruder: smart plugs, TVs, doorbells, thermostats, printers, game consoles, e-readers, cars, a visitor's phone from last week still holding a lease, a Sonos or Hue bridge, your ISP's set-top box, and mesh satellites all appear as unfamiliar names. Randomised MACs make one phone look like several devices over time. If you have ruled those out: change the Wi-Fi password (which evicts everything and forces a re-join), move to WPA3 or WPA2-AES only (no WPS, no WEP/TKIP), disable WPS, put guests on a guest network, and check the router's admin password is not the default. MAC filtering is not worth the trouble. Why →

5. Keep a list

Give infrastructure fixed addresses via DHCP reservations, name devices in the router (most allow editing the display name), and export the scan occasionally: