A familiar phone, computer, or printer can look like a new device in your router's list overnight. Its hostname might switch from a room label to a vendor-style name, disappear, or pick up a suffix such as -2. That's worth checking, especially if you use the list to keep an inventory. On its own, though, it doesn't mean a stranger has joined your network.
DHCP lists pull together information supplied by different systems at different times. A connected device can have no name, and a name can linger after the device has left. Before you change passwords, block an address, or edit a reservation, work out which lease record changed and what it belongs to. The checks below follow a cautious order that works across many router interfaces.
The lease behind the display name
DHCP supplies network configuration; dynamically assigned IP addresses usually have a limited lease period. The protocol includes a client identifier option, and the client can supply a host name option too. Your router might display one of those values, get a label from DNS, keep a name it saw earlier, or make its own guess. So a column called “device name” isn't a universal identity field. RFC 2131 describes the DHCP exchange and its options.
While connected to your own network, open the router's active-client or DHCP-lease view. Record the full local IP address, the hardware address the router shows, and the network name or interface. Include the lease start or expiry time if it's available. Keep a private note or screenshot to compare later; don't post your full device list publicly. Having these details together makes a hostname change easier to assess.
Start with one question: has the label on an existing lease changed, or are you looking at a second lease? If the address and hardware address match a device you recognize, the changed label is usually a naming issue first. If the address, hardware address, connection type, and lease timing all differ, leave the entry unclassified and work through the checks below.
The device's own network settings
On a computer, phone, or tablet you can access, open the settings for the Wi-Fi network it's currently using. Compare its local address and Wi-Fi address with the router entry. The device's marketing name isn't enough to go on. Your router might show a host name set by the operating system that's different from the device name you see as a user.
Modern operating systems can use a separate, private Wi-Fi address for each network. Apple documents that its devices can use a private address that may rotate for a network under certain conditions. This helps protect against tracking across networks, but it can also give a familiar device a different DHCP lease. Apple's private Wi-Fi address guidance explains where to check this setting. A new private address doesn't prove that a client is unauthorized.
If you've recently restored, renamed, or updated a device, note that next to the lease. Do the same if it moved from Ethernet to Wi-Fi or connected to a guest network. Any of these changes can affect what the router displays without changing who owns the device. Don't turn off private addressing just to tidy up the list. First decide whether a local service actually needs a stable address.
Missing or stale names
Some DHCP clients don't send a hostname. Others use a temporary name during setup, send one only on certain interfaces, or change it after receiving a lease. Router firmware handles names differently too. It might keep the last label after a device disconnects, combine a DHCP value with a reverse-DNS lookup, or replace punctuation and non-Latin characters. A blank name can mean “no name was supplied,” not “unknown device.”
DHCP privacy behavior is another reason not to read too much into a label. RFC 7844 describes DHCP options and identifiers that can expose a client to correlation, and discusses limiting unnecessary identifying information. A client designed with privacy in mind may deliberately send less stable identifying data. That doesn't tell you whether a particular entry is safe. It explains why names and identifiers aren't conclusive evidence.
Check whether your router separates active clients from historical leases. An old row may remain after a device goes offline. Use the router's documented refresh function and compare the result with the device's own settings. Do not treat lease expiry or a remaining entry as proof that a device is offline or online. Don't repeatedly release leases for devices you don't control: that can interrupt work, cameras, or smart-home equipment.
A controlled comparison for an unclear entry
Test one device at a time, and only on a network you own or administer. Briefly turn Wi-Fi off in the device's settings and verify that it is disconnected, then refresh the router's active list. Reconnect it and watch for an entry to appear or change. Give the router enough time to update its table. This links one physical device to one observed lease; it doesn't identify everything on the network.
For important devices such as a NAS, printer, alarm component, or home-automation bridge, start with a check that causes little disruption before changing any settings. Compare the device's own administration page or documented status indicator with the router record. Don't reboot critical equipment just to resolve a hostname question. The service can be working normally even if the router gives it an unhelpful label.
For a broader comparison on your local network, an inventory tool can help organize the addresses, hardware addresses, manufacturer hints, and services you observe. DeviceShelf is one option for an authorized local scan, but treat its classification as a clue to check against the device and router records, not a guarantee of identity or security. Client isolation, sleeping devices, firewalls, and private addresses can all limit what a scan sees.
Address reservations
A DHCP reservation can make sense when a device you manage needs a predictable local address, for example for a printer queue, a NAS service, or a documented automation. Create the reservation in the router's DHCP settings, using the hardware address or client identity specified in its documentation. Don't pick an arbitrary unused address outside the router's rules. A hostname changing once isn't, by itself, a reason to create a reservation.
After creating one, reconnect only the device you manage and check that it gets the expected address. Then check that the service works from another authorized device. Leave automatic addressing enabled on the device unless its manufacturer specifically requires a different setup. A reservation maps the address on the router; it doesn't prove that the hostname will stay the same or that the device is permanently present.
Record what each reservation is for, which device it belongs to, and the date you verified it. Those notes make an unfamiliar entry easier to investigate later and help prevent an old reservation from being mistaken for a live client.
Stronger evidence for a security review
If you still don't recognize an entry after comparing its current address, connection type, and lease timing with the devices in your household, it's a reason for a focused security review. Check the Wi-Fi security mode and remove old guest-network access if appropriate. Review who has the password, and update the router's firmware through its official administration path. Schedule the update for a time when a network interruption is acceptable, follow the manufacturer’s instructions, and do not interrupt power during installation. Don't copy credentials into a support post or share screenshots that reveal public addresses, serial numbers, or full MAC addresses.
Changing the Wi-Fi password is reasonable when you have evidence of unauthorized access or can't account for credentials. But it causes disruption: every legitimate device has to reconnect. A changed DHCP hostname alone usually doesn't warrant that. Often, the useful conclusion is narrower: one router label changed, while the lease and the device's own settings still matched.