How to find a rogue smart device on your network

Finding an unknown device on your network is a common security task when you run a local-first smart home with Home Assistant. An unrecognized device — a forgotten plug, an old camera, a guest’s gadget, or something you never installed — can be worth tracking down. Here’s how to identify what’s connected and decide what to do about it.

A note up front: Home Assistant does not ship a packet-capture or traffic-inspection panel, and the Apple Home app has no “device network” screen. The real tools are your router, standard network utilities, and a couple of Home Assistant integrations. This guide sticks to what actually exists.

1. Start With Your Router

Your router has the authoritative list of everything on the LAN. Log into its admin page and look for a section usually called Connected Devices, DHCP Clients, or Device List. It shows each device’s IP address, MAC address, and often a hostname.

The MAC address is the most useful clue. The first half (the OUI) identifies the manufacturer — you can paste it into any public MAC/OUI lookup to see whether it’s an Espressif (ESP), Tuya, Amazon, or other known IoT vendor. A device whose hostname and manufacturer you don’t recognize is your candidate.

If your router supports it, you can reserve or block a MAC address from this same screen, which is the cleanest way to cut off a device you don’t want.

2. Scan the Network Yourself

To cross-check the router, scan the subnet directly with nmap:

nmap -sn 192.168.1.0/24

This ping-scan lists live hosts with their IP and (where resolvable) MAC and hostname. Compare it against the devices you know about. For more detail on a single suspicious host, a port scan can hint at what it is:

nmap -sV 192.168.1.42

An open RTSP port (554) suggests a camera; an open MQTT port or a tiny web server is typical of ESP-based gear. If you specifically suspect a hidden camera, see how to detect hidden cameras with an app and network scan.

3. Reconcile Against Home Assistant

Home Assistant can help you map IPs to known devices. The Nmap Tracker integration scans your network on a schedule and creates device_tracker entities by MAC address, and the Ping (ICMP) integration tracks specific hosts by IP. Both are local-polling and add no cloud dependency.

To audit what Home Assistant itself manages, open Settings > Devices & Services. Anything on your network scan that doesn’t correspond to a device here — and isn’t a phone, computer, TV, or other expected client — deserves a closer look.

If you run a Zigbee or Z-Wave network, also check that coordinator’s device list (for Zigbee, ZHA or Zigbee2MQTT; for Z-Wave, Z-Wave JS). A radio device won’t appear in an IP scan at all, so an unexpected paired node is found here rather than via nmap.

4. Isolate IoT Going Forward

The durable fix isn’t hunting devices one by one — it’s putting smart-home gear on its own VLAN or guest network so anything unexpected is contained and easy to spot. Many routers offer a separate IoT SSID for exactly this, and hardware built for segmentation makes it routine: the UniFi Dream Machine Pro runs the UniFi Network controller that manages your VLANs and shows every wired and Wi-Fi client, and the OpenWrt-based GL.iNet Flint 2 is a strong base for IoT VLAN isolation with no vendor cloud. For the full approach, see how to secure IoT devices on your network. Once IoT lives on its own segment, a stranger on your main network is immediately obvious.

For deeper traffic analysis when you really need it, capture packets with Wireshark or tcpdump on a mirrored switch port or on the router itself — not inside Home Assistant, which has no such feature.

Quick Verdict

To find a rogue device: read your router’s connected-devices list, scan with nmap, and reconcile against Home Assistant’s known devices and your Zigbee/Z-Wave node lists. Use MAC/OUI lookups to identify manufacturers, and segment IoT onto its own VLAN so unknowns stand out. From there, audit which smart devices still phone home to understand what the ones you keep are actually doing. These are ordinary, reliable tools — no imaginary Home Assistant “Network Monitor” required.