To find every smart-home device on your network, scan the whole subnet and match each result on three signals: the MAC vendor (OUI), the mDNS/SSDP services the device announces, and its open ports. IoT gadgets rarely offer a useful hostname, so those three fingerprints do the identifying that a name usually would.
Why IoT devices are so hard to spot
A laptop tells you what it is. A €9 smart plug does not. Most cheap connected hardware ships without a meaningful hostname, so your router list fills up with blanks, IP addresses, or a generic string like ESP_A1B2C3. The chipsets underneath are shared across hundreds of brands, which is both the problem and the solution: a plug, a bulb and a doorbell might all run the same Espressif or Tuya module, so they look identical at first glance but carry a very recognizable vendor prefix.
Randomized MAC addresses muddy this further. Phones and tablets rotate their MAC per network, and some newer IoT firmware borrows the trick. A locally administered address that resolves to no vendor is usually a phone, not a rogue camera. Knowing that saves you from chasing ghosts.
Start with the MAC vendor (OUI)
The first three bytes of a MAC address are the Organizationally Unique Identifier, and they name the manufacturer of the network chip. This is the single most useful signal for IoT. Prefixes owned by Espressif (A4:CF:12, 24:0A:C4 and many more), Tuya, Sonoff/Itead, Shelly, Amazon, Google and Roku account for a large share of consumer smart-home gear. Your router shows the MAC beside each lease; any OUI lookup table turns it into a vendor name.
The vendor rarely tells you the exact model, but it narrows the field hard. An Espressif prefix means you are looking at a plug, sensor, bulb or DIY board, not a printer.
Let mDNS and SSDP announcements do the work
Here is where identification usually clicks. Well-behaved devices announce their services on the network, and those announcements are self-describing. A Chromecast or Google speaker broadcasts _googlecast._tcp over mDNS. Apple TVs and HomePods answer to _airplay and _raop. Printers advertise _ipp. Smart TVs, media receivers and many cameras respond to SSDP (M-SEARCH) with a device description URL that spells out make and model in plain text.
You can listen for these by hand. On macOS or Linux, dns-sd -B _services._dns-sd._udp or avahi-browse -a enumerates mDNS responders; nmap has SSDP and mDNS discovery scripts. Between the vendor prefix and a service announcement, most IoT devices identify themselves without any guesswork.
Open ports are a fingerprint too
Silent devices that announce nothing still expose services. An nmap -sV sweep against a suspect IP reveals what it is running: RTSP on 554 points to a camera, a stripped-down web server on 80 or 8080 is a typical plug or bridge admin page, MQTT on 1883 suggests a hub, and Telnet on 23 is a red flag on any modern gadget. The combination of open ports plus vendor is often enough to name a device the mDNS pass missed.
Doing all of this manually across a /24 is slow. A local scanner collapses the passes into one: DeviceShelf reads the MAC vendor, hostname, mDNS/SSDP announcements and open ports in a single sweep, then labels each device by type. It runs on your machine with no account and no telemetry. If you have compared it against Fing or LanScan, the feature-by-feature comparison and the Fing alternative page lay out where a local-first scanner differs.
Why the inventory matters: guest VLAN candidates
An IoT inventory is not busywork. Cheap connected hardware is patched rarely, ships with default credentials often, and sometimes phones home over ports you would never open on purpose. Once you know which devices are plugs, bulbs and cameras, the practical move is to isolate them: put IoT on a separate SSID or VLAN that has internet access but cannot reach your laptops, NAS or phones. If a camera firmware is ever compromised, the blast radius stops at the guest segment.
That segmentation only works if the list stays current. New gadgets arrive; old ones get re-flashed. DeviceShelf watches the network in the background and alerts you when a device you have not seen before joins, so the inventory maintains itself instead of going stale the day after you build it. There is a free 7-day trial, no account needed.