We’re shipping rogue device detection.
Every serious attack starts the same way: with a device on your network that shouldn’t be there. Now you see it the moment it joins.
Our third detector is the one that watches the network itself: rogue device detection. It surfaces every device on your subnet, names it by manufacturer, and flags any MAC address it has never seen before the instant it appears — on Windows, free.
You can’t defend against a device you can’t see. Most people have no idea what’s on their network.
The foothold most attacks start from
A rogue device is any device on your network you didn’t put there — a neighbor who guessed your password, a compromised IoT gadget, or an attacker who’s gained a foothold on your LAN. Once something hostile is on the network, it can map every other device, hunt for weak spots, and position itself to run ARP spoofing or pivot deeper.
A concurrent sweep of your whole subnet
Your router’s admin page shows an incomplete, stale list, and a device that stays quiet can sit unnoticed for a long time. So instead of reading a cache, the detector ping-sweeps your entire subnet concurrently — dozens of pings at once, a full sweep in seconds — to force every device to reveal itself, even ones your PC has never talked to. It keeps a map of every IP-to-MAC pairing and a set of known devices, and flags any MAC it hasn’t seen before.
On the very first run it quietly seeds the baseline, so it doesn’t flood you by labeling every existing device as new.
You decide what belongs — until it attacks
A new device isn’t automatically an alarm — a friend’s phone is usually harmless. So a rogue device is surfaced with its IP, manufacturer, and first-seen time, and you make the call. But if that device starts behaving like an attacker — poisoning ARP, impersonating the gateway — the detection escalates to critical, and Active Defense is one tap away.
Detection is free
Rogue device detection ships in the free version and always will. Seeing what’s on your network — and being told the moment something new appears — is exactly the kind of visibility that shouldn’t be paywalled.
Read more: how we detect rogue devices · what are rogue devices? · is someone on my WiFi?