An unfamiliar name, address, or old-looking entry in your router can be unsettling. But it doesn't tell you much on its own. Router interfaces often put several kinds of information on the same screen: devices connected to Wi-Fi now, DHCP leases issued earlier, remembered host names, and sometimes a history of clients. A row on that screen can be useful evidence. By itself, though, it doesn't show that a device is currently connected or belongs to an intruder.
Start with a narrower question: what kind of record is this, and when was it last observed? Work that out before blocking an address, resetting the router, or changing a password. The steps below are for a network you own or are authorized to administer. The first checks are reversible, and each leaves you with a record of what you actually observed.
The type of router list
Check the page label and its fields as well as the device name. A page called DHCP leases, address reservations, or known clients can keep information after a client goes offline. DHCP is the protocol a server uses to assign an address for a lease time; RFC 2131 describes how clients obtain, renew, and release those leases. A lease tells you the server allocated an address. It doesn't necessarily mean there's a live Wi-Fi session.
A current Wi-Fi association list tells you something different. It may show signal, band, connection time, or a short inactivity timer. An Ethernet switch’s MAC address table is another kind of observation. A router dashboard may combine all three without making the differences clear. Write down the page name beside the entry. When you compare it later, that detail helps you avoid treating a remembered lease as evidence of a current connection.
Record the time, network name or VLAN, IP address, displayed hardware address, host name, and any last-seen or expiration value. Keep the note private: router screenshots can expose local addresses, Wi-Fi names, or administration details. No timestamp? Put that in the note too. Leave that uncertainty in the record instead of filling in a time from memory.
The lease lifetime
A device can leave the room while its DHCP lease stays on the screen. A phone may be asleep, a laptop may have moved to another network, or a streaming box may simply be powered off. The router normally decides when to reuse an address based on how it handles leases. Manually deleting a row doesn't prove anything about who used it.
Compare the entry's expiration or last-seen time with the time you recorded your observation. A recent Wi-Fi association and packets moving through the router are stronger evidence of current activity than an address under an old lease. A lease that expired long ago but still appears on the screen, on the other hand, may just be a remembered client. Router vendors use different words for these fields. Read the labels as that vendor's descriptions, not as status terms that mean the same thing on every router.
Don't create an address conflict to test the record. RFC 5227 describes IPv4 address-conflict detection used by hosts that implement it; deliberately assigning the same address can interrupt a printer, NAS, or another legitimate device. It's safer to observe what's there than to create a conflict.
The network boundary and a known device
First, check which device is actually assigning addresses. Homes with a modem-router plus a separate Wi-Fi router, mesh system, guest network, or VLAN can have more than one client list. A device may belong on one list and be correctly absent from another. Note the SSID, subnet, and gateway of the network you're checking before comparing results from a scanner or a computer.
Then test an ordinary explanation. Check household phones, tablets, printers, consoles, watches, and IoT devices on the same network. With the owner's permission, compare their Wi-Fi details, connection time, and displayed IP address with the router entry. Keep private Wi-Fi addresses in mind too. Apple documents private Wi-Fi addressing per network; a settings change, forgetting and rejoining a network, or a different privacy mode can make a familiar device appear under a different address. That doesn't prove the entry is harmless. It does give you a reason to compare before blocking it.
Names and address prefixes are clues, not proof of identity. A host name can be generic, copied from an older record, or set by a user. A private or randomized address doesn't reliably identify a manufacturer. Write down what matches and what you're still unsure about, rather than guessing who owns a device from one label.
One limited, read-only observation
If the entry is still unclear, make one observation from an authorized computer on the same network. Check the router's current association view, a managed switch table, or a local network scan that you understand. Record the method and time with the result. A device missing from a scan isn't a conclusive result: sleeping devices, firewalls, client isolation, and separate subnets can all affect what you can see.
Avoid broad service probing or logging into an unfamiliar device. If you suspect a household printer or NAS, a less invasive way to check is to look at that known device's own network settings or watch its entry while its owner connects and disconnects it. DeviceShelf is one option for making another local observation on a network you administer, but it can't turn an ambiguous router record into a confirmed identity.
You don't need a sweeping conclusion. “Old DHCP lease; no current association observed” is useful. So is “current connection observed; ownership not yet confirmed.” For the next review, a dated note of what you did and didn't see is better evidence than a confident label based on a single dashboard row.
Escalation based on the facts
If a current connection is still unexplained after those comparisons, review who knows the Wi-Fi password, whether the guest network is separated, and whether the router firmware and administrator credentials are current. NIST's wireless LAN guidance provides a useful checklist for reviewing the network's security configuration. Make changes through the router vendor's documented interface, not through a link in a device name or a message about the device.
Changing a Wi-Fi password can make sense when there's evidence behind a concern that an unauthorized person knows it. The change also disconnects legitimate devices, so plan for it and reconnect them deliberately. Blocking one MAC address isn't a complete security response: addresses can change, and a block doesn't replace secure Wi-Fi and router administration. If you've explained the record, keep a short inventory note. If you haven't, keep your observations and seek appropriate local administration help. Be clear about what the router list actually proved.