Using MAC vendor lookup to spot a rogue device on your network

Start with “unidentified,” not “intruder”

An unfamiliar entry in a router’s client list is common and usually harmless — a device you own simply isn’t showing a recognizable name, or it reconnected under a different randomized address than last time. This guide walks through the practical steps for narrowing that entry down before deciding whether it’s actually a problem, using AdminKit’s MAC vendor lookup as the first identification step rather than the only one.

Step 1: find the device’s MAC address

Most home routers and access points have a page in their admin interface — often called “connected devices,” “DHCP clients,” or “attached devices” — listing every client currently or recently on the network, along with its IP address, hostname (if the device reports one) and MAC address. If you’re on a network already and want a second source, running arp -a from a connected computer (Windows, macOS and Linux all support this command) lists MAC-to-IP pairs for hosts that device has recently exchanged traffic with, which is a useful cross-check against what the router itself reports.

Step 2: look up the vendor

Enter the unfamiliar MAC address into AdminKit’s MAC vendor lookup. The result tells you one of three things, covered in full in how to read a MAC address vendor lookup result:

• A matched manufacturer name — the address’s OUI prefix is a real, IEEE-registered assignment, narrowing the device down to a specific company’s product lines.
• No match on an otherwise normal-looking prefix — the addressing bits suggest a factory-assigned address, but that specific prefix isn’t in the published registry yet.
• A locally-administered or randomized flag — the address was never drawn from a vendor’s registered block at all, most often because it belongs to a phone or laptop randomizing its Wi-Fi address per network, as described in RFC 9542.

Step 3: combine the vendor with what you already know

A vendor match narrows “unknown device” down to a maker, not a specific unit — a manufacturer routinely reuses the same OUI across an entire product catalog. Combine it with context the router or arp -a already gave you:

• IP address and DHCP lease time — a lease that started recently, around when you first noticed the unfamiliar entry, is a useful timing clue.
• Hostname, if the device reports one — many IoT devices and smart TVs broadcast a recognizable default hostname even without a friendly name set.
• Traffic pattern, if your router shows bandwidth per client — a device pulling meaningful traffic at odd hours is a different finding than one that’s essentially idle.

A vendor name matching a brand of smart plug, camera, or streaming device you already own is usually enough, combined with these, to close the question without further action.

When the result shows no vendor: don’t assume the worst

A “no vendor” or “locally-administered” result is the expected outcome for a large share of modern personal devices, not a red flag by itself: Android 10+ and recent iOS, iPadOS and desktop operating systems randomize the MAC address used per Wi-Fi network by default, specifically to prevent the kind of tracking an OUI lookup enables. If the unfamiliar entry’s hostname or IP otherwise looks like a guest’s phone or your own secondary device, a vendor-less result is consistent with that, not evidence of something hidden.

The honest limits: spoofing, and what a MAC address can’t prove

A MAC address is easy to change in software on most operating systems — a practice called MAC spoofing — so a match against a device you recognize, or even an address identical to one you own, is informative rather than conclusive. It’s also strictly a local-network identifier: a MAC address never travels past the first router hop, so it only ever tells you about a device on your own segment, never about something several hops away. If you suspect deliberate spoofing rather than just an unidentified device, look for a stronger signal than the MAC alone — two devices intermittently fighting over the same address is a concrete sign, as is a device’s traffic pattern not matching what its claimed vendor’s product would normally do. See ARP spoofing for the related local-network attack this overlaps with, and DHCP for how the lease information you’re cross-referencing is assigned in the first place.

Next step: run the lookup

Open AdminKit’s MAC vendor lookup and work through the unfamiliar address from your router’s client list. If what you actually want to confirm is whether a device is exposing something to the internet rather than just identifying it, follow up with AdminKit’s open ports check on your own public IP.

This guide is general information, not a security audit of your specific network — see our disclaimer for what AdminKit's guidance does and does not commit to.