How do you detect a fake network device?
That unfamiliar printer in your Network folder can be an attacker-named lure. Here’s how to make a fake device give itself away.
You detect a fake network device by asking for something that doesn’t exist and seeing who answers. The Windows Network folder is filled by WS-Discovery — your PC multicasts “who’s a printer?” on port 3702 and real devices reply. Probe for a made-up device type no real product implements, and every honest device stays silent. A catch-all rogue answers anyway — and that reply is the whole giveaway.
Ask for a device that can’t exist. Only a liar will answer.
Where fake devices come from
Most icons in the Explorer Network folder arrive through WS-Discovery (WSD) — a SOAP-over-UDP protocol on port 3702. It’s a different protocol from SSDP, which powers UPnP and smart-home gear; WSD is the one behind printers, scanners, NAS boxes, and the Network tab you actually click through.
A rogue WS-Discovery device is a catch-all responder: it answers every Probe it hears, so whatever your PC is looking for, it claims to be. It then plants itself in your Network folder under an attacker-chosen name, with a metadata URL that leads somewhere it shouldn’t.
What a fake device looks like
- A device you can’t physically point to — a printer or NAS in the Network folder that isn’t in your house.
- A too-perfect name — a familiar-sounding brand or “Front Desk” label meant to feel routine.
- A prompt to “open” or “sign in” to a device you never set up.
- A duplicate of a real device you own, sitting right beside the genuine one.
The catch: a good responder is quiet and specific, and a rogue is loud and eager — but from the icon alone you can’t tell them apart. That’s why the reliable test isn’t looking, it’s probing.
Ask for a device that can’t exist
The dependable method sends a WS-Discovery Probe for a random, made-up device type in a made-up namespace. No real printer, PC, or NAS implements it, so every compliant device ignores it. A catch-all rogue answers everything — including your nonsense — so any reply is a rogue by construction. It’s false-positive-proof.
A rogue responder, in concept, does exactly the thing that betrays it:
# Conceptual: the rogue answers ANY Type - including one you invented
on Probe(any_device_type):
reply(name = "Office Scanner", xaddr = "http://attacker/meta")
You can watch the same traffic by hand on Windows. Eyeball the Network folder, then capture the SOAP-over-UDP chatter on port 3702 with the built-in pktmon tool:
# 1. Open the Network folder and check every device you don't recognise explorer.exe shell:NetworkPlacesFolder # 2. Capture WS-Discovery traffic (port 3702) - elevated prompt, Win 10/11 pktmon filter add WSD -p 3702 pktmon start --etw -m real-time # ...watch the live output, then Ctrl-C and clean up: pktmon stop pktmon filter remove
Why the Network folder fools people
By the time a device shows up in Explorer, Windows has already vouched for it — it looks as native as your real printer. There’s no name to trust or distrust: WSD lets a device call itself anything, and the harm hides in a metadata URL you never see until you click. It might open a fake printer login, or point at a UNC path that leaks your login hash the moment your PC connects.
Eyeballing the folder catches the obvious impostors and misses the careful ones — a rogue that clones a device you already own sits quietly beside the real thing. The probe test doesn’t care what the device calls itself; it only cares that it answered a question it never should have.
Catching it automatically
WifiThreatWatch sends the nonsense-Type WS-Discovery canary for you and flags any device that answers — naming the rogue responder before you ever click its icon. Because a real device can’t match a made-up type, there’s nothing to second-guess: a reply is a rogue. Detection is free.
Go deeper: how we detect rogue WS-Discovery devices · the SSDP cousin of this attack · the threats library
Fake network devices: quick answers
How do I know if a device in my Network folder is fake?
Trust your own inventory, not the label. Open the Windows Network folder (explorer.exe shell:NetworkPlacesFolder) and check every icon against devices you actually own. A printer, NAS, or PC you cannot physically point to is a red flag — a rogue WS-Discovery responder can name itself anything, including a copy of a device you do have.
What is WS-Discovery and how is it different from SSDP?
WS-Discovery (WSD) is the SOAP-over-UDP protocol, on port 3702, that populates the Windows Explorer Network tab — printers, scanners, NAS boxes, other PCs. SSDP is a different protocol behind UPnP media and smart-home discovery. They look similar and both use multicast, but WSD is the one that fills the Network folder you click through, which is why a rogue WSD device is so convincing.
What can a fake network device actually do to me?
The device itself is just bait — the harm is in the metadata URL it hands your PC. That link can open a phishing page dressed as a printer login, point at a booby-trapped UNC path that makes Windows leak your login hash the moment it connects, or push a malware download. You do not need to type anything; sometimes just opening the device is enough.
Why does a nonsense probe catch a fake device with no false positives?
A real device answers WS-Discovery only for its own device type. If you probe for a random, made-up type in a made-up namespace that no real product implements, every honest device stays silent. A catch-all rogue answers everything, so it answers your gibberish too. Any reply at all is a rogue by construction — there is no legitimate device that could match.
Can I just turn WS-Discovery off?
You can, but you lose the Network folder and automatic printer and NAS discovery, which is why most people leave it on. Detection is the better trade: keep discovery working, and get flagged only when something answers a probe no real device should. That way a fake device stands out instead of hiding among your real ones.