An unfamiliar entry in your router’s device list is worth checking. On its own, though, it doesn't mean somebody has gained access to the network. Router interfaces often mix current Wi-Fi associations with DHCP leases, remembered clients, and names supplied by devices. Any of those records can be incomplete or out of date. A phone using a private Wi-Fi address can look like a new device. A lease may still be listed after a laptop goes to sleep, and a name such as “android-1234” tells you very little.
Instead of asking “what is this, immediately?” start with “what did the router observe, on which network, and what can I safely compare it with?” This process is for a network you own or are authorized to administer. Start with observations and changes you can undo, rather than blocking or resetting devices before you have enough evidence.
A record of the first observation
Before changing a setting, record what the router shows. Note the date and time, network name or VLAN, displayed IP address, hardware address, device name, connection type, and any last-seen or lease-expiry field. A screenshot can help, provided you store it privately. When asking for help, don't post router screenshots that contain local addresses, Wi-Fi names, serial numbers, or administration details.
Check which list you're looking at, too. A page labeled DHCP leases isn't necessarily the same as one labeled connected devices. A DHCP lease records an address allocation with a lifetime. RFC 2131 describes how a client can renew, release, or receive that allocation, so an entry may remain visible after the device is no longer actively connected. A Wi-Fi client list may be more current. It still won't necessarily tell you who owns the device.
Write the source beside the observation: for example, “main-router DHCP lease list, 11 October, 09:40.” You'll need that context when comparing records later. A remembered lease isn't proof that a client is currently transmitting.
The network boundary
Many homes have more than one network. A guest SSID, an IoT segment, a mesh network, a second router, or a work VPN can change what appears in a particular list. Check which router or DHCP server is responsible for the network where you found the entry. On a computer you're authorized to use, note the local IPv4 address, prefix length or subnet mask, and default gateway.
Private IPv4 addresses are common, but seeing a prefix such as 192.168 doesn't tell you that two devices share a local segment. RFC 1918 reserves several private ranges. The prefix length and routing rules determine what's local from a given interface. A client on the guest network might be invisible to a scan from the main LAN, just as intended. Check whether that separation is deliberate before treating it as a fault.
If you have a modem-router and a separate Wi-Fi router, find out which one assigns addresses. Two DHCP servers on one simple network can give confusing results. But a second router serving a deliberately separate network can be normal. Different device lists aren't a reason to reset either router.
Ordinary explanations
Start with the devices your household already owns. It's easy to forget phones, tablets, watches, streaming boxes, printers, smart plugs, and visitors’ devices. While they're connected to the same network, check their Wi-Fi settings. Compare the connection time, IP address, and any displayed device name against the router's record. Ask the owner before disconnecting anything that isn't yours.
Pay particular attention to private Wi-Fi addressing. Apple documents that its devices can use a private Wi-Fi address for each network. A familiar device can appear with a different hardware address after a privacy setting changes, after forgetting and rejoining a network, or after restoring settings. That's a privacy feature. By itself, it isn't a sign of unauthorized access. Other platforms can behave similarly, so don't turn off a privacy feature just to tidy up the router's list.
Device names are clues, not identities. A name might come from the manufacturer or the user, or it might have been copied from an old lease. There may be no name at all. A MAC-address prefix can also hint at the interface vendor, but it doesn't conclusively identify a model or owner, especially if the address is private or randomized.
One read-only comparison
From a computer on the same authorized network, make a single read-only check. You can run a local network scan, check the router's current association view, or consult a managed switch's address table if you administer it. Record the method and time alongside the result. What you see locally can support a hypothesis, but a device's absence doesn't prove it has left the network. A sleeping phone, a firewall rule, client isolation, or a different segment can affect what's visible.
If something appears to answer at the address, look for a non-invasive way to confirm what it is. Open the known printer's local status page, inspect the NAS network settings, or watch what changes when an authorized owner joins or leaves the Wi-Fi. Avoid probing services you don't need to use. Never create a duplicate IP address to test this; an address conflict can interrupt other devices. RFC 5227 explains how hosts that implement address-conflict detection handle it. Deliberately creating a conflict isn't a diagnostic shortcut.
Keep your notes to what you've established. “Lease present; no matching household device yet” is more useful than a guess that it belongs to a neighbor or an intruder. A local observer such as DeviceShelf can give you another point of comparison on a network you administer, but it doesn't replace the router or the device's own settings.
Reasons for a security response
If the entry is still unexplained after those comparisons, take a closer look. Check who knows the Wi-Fi password, whether the guest network is separate, and whether the router firmware is current. NIST's guidance on wireless-network security provides a useful checklist for reviewing security settings and router administration. Follow the router vendor's documented update process. Don't use an update link supplied by an unexpected device name or message.
Changing the Wi-Fi password can be reasonable if there's evidence that an unauthorized person may know it, or if a router-administration credential has been exposed. That will disconnect legitimate devices, too. Plan to reconnect them and update their stored credentials. Choose a new, unique passphrase, and review the router's administrator password separately. Blocking a single MAC address isn't a complete fix: a hardware address isn't a lasting identity, and blocking it doesn't replace securing the wireless network.
If you recognize the device, keep a short note in a dated network inventory. If it remains unknown, keep the facts you observed and a record of the checks you made. Those notes will help with the next review without treating one ambiguous line in the router's list as a conclusion.