Raspberry Pi Wi-Fi Scanner: See Known Devices

Yes, you can use a Raspberry Pi as a Wi-Fi scanner to see which known devices are currently on your network. By running a simple Python script or using tools like arp-scan or nmap, your Pi can list every device connected to your router, compare it against a list of known MAC addresses, and flag any unrecognized ones. This guide explains how to set that up, what the results mean, and how to troubleshoot common issues.

How Wi-Fi Device Detection Works

When a device (phone, laptop, smart bulb, etc.) joins a Wi-Fi network, it gets an IP address from the router, usually via DHCP. The router keeps a table mapping IP addresses to MAC addresses (the unique hardware identifier burned into each network interface). A Raspberry Pi on the same network can query this table or actively probe the network to discover all active devices.

There are two main approaches:

• Passive scanning: The Pi reads the router’s ARP (Address Resolution Protocol) cache or DHCP lease file. This is fast and light but only shows devices the router has recently communicated with.
• Active scanning: The Pi sends out ARP requests or pings to every possible IP address in the subnet. This forces all active devices to respond, giving a complete snapshot. Tools like arp-scan and nmap do this.

Once you have the list of active MAC addresses, you compare it to a pre-approved list. If a MAC address isn’t in your known list, it’s likely an unknown or guest device.

What You Need to Get Started

To build a Wi-Fi scanner with a Raspberry Pi, you’ll need:

• A Raspberry Pi (any model with network access; a Pi Zero W or newer works fine)
• A microSD card with Raspberry Pi OS (or any Linux distribution)
• Power supply and, if needed, a Wi-Fi dongle (built-in Wi-Fi is standard on most models)
• Access to your router’s admin page (to find the subnet, e.g., 192.168.1.0/24)
• Basic familiarity with the command line

The Pi can be headless (no monitor) if you enable SSH. You’ll run commands from your main computer.

Step-by-Step: Scanning with arp-scan

The quickest way to see all devices on your network is with arp-scan. Here’s how to set it up:

1. Install arp-scan: Open a terminal on the Pi (or SSH into it) and run sudo apt update && sudo apt install arp-scan.
2. Find your subnet: Run ip route | grep default to see your gateway IP (e.g., 192.168.1.1). Your subnet is usually the first three octets with a 0/24 (e.g., 192.168.1.0/24).
3. Run the scan: Execute sudo arp-scan --localnet (or specify the subnet manually). You’ll get a list of IP addresses, MAC addresses, and manufacturer names.
4. Save the output: Redirect to a file with sudo arp-scan --localnet > scan.txt so you can analyze it.

For a more detailed scan, use nmap: sudo nmap -sn 192.168.1.0/24. The -sn flag does a ping scan (no port scan), which is enough to list live hosts.

Building a Known-Device List

To automatically flag unknown devices, you need a list of the MAC addresses you trust. Here’s a simple way to create one:

• After your first scan, identify each device by its IP and MAC. You can check your router’s DHCP client list for names.
• Create a text file (e.g., known_devices.txt) and paste each known MAC address, one per line, in lowercase with colons (e.g., aa:bb:cc:dd:ee:ff).
• Write a small Python script that reads the scan output, extracts MACs, and compares them to your list. If a MAC isn’t in the list, print a warning.

Here’s a minimal Python example (run after saving the arp-scan output to scan.txt):

import re

with open('known_devices.txt') as f:
    known = set(line.strip().lower() for line in f)

with open('scan.txt') as f:
    for line in f:
        match = re.search(r'([0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2})', line)
        if match:
            mac = match.group(1).lower()
            if mac not in known:
                print(f"UNKNOWN: {line.strip()}")
            else:
                print(f"KNOWN: {line.strip()}")

This script will output each device with a KNOWN or UNKNOWN tag. You can extend it to send notifications (e.g., via email or a push service) when an unknown device appears.

Common Problems and How to Fix Them

You might run into a few issues:

• No results or incomplete list: Some devices (like phones with MAC randomization) may not respond to pings. Try using sudo arp-scan --localnet --retry=3 to send more probes. Also, ensure your Pi is on the same subnet as the devices you want to see.
• Permission errors: arp-scan needs root privileges to send raw packets. Always use sudo.
• MAC randomization: Modern smartphones often randomize their MAC address when connecting to Wi-Fi, especially on guest networks. This means a known device might appear as unknown. To avoid this, you can disable MAC randomization on your devices (in Wi-Fi settings) or whitelist the device’s IP range instead.
• Wireless vs. wired: If your Pi is connected via Ethernet, it can still scan wireless devices because they’re all on the same LAN. If the Pi is on Wi-Fi, it will only see devices on that same Wi-Fi network (not separate guest networks).

Comparing Tools: arp-scan vs. nmap vs. Router Apps

You have several options for scanning:

• arp-scan: Fast, lightweight, and specifically designed for this task. It gives you MAC addresses and vendor names. Best for quick checks.
• nmap: More powerful and flexible. Can do port scans and OS detection, but for simple device discovery, nmap -sn is enough. Slightly slower due to its thoroughness.
• Router’s built-in app: Many routers have a companion app that shows connected devices. This is easy but often lacks MAC filtering or notification features. Also, it only shows devices on that router, not on other access points you might have.

For a dedicated monitoring solution, you could set up a cron job to run the scan every few minutes and log results, giving you a history of when devices appear and disappear.

Costs and Alternatives

The main cost is the Raspberry Pi itself (around $35 for a Pi 4 or $15 for a Pi Zero W). You may also need a microSD card and power supply. If you already have a Pi for other projects, the incremental cost is zero.

Alternatives to a Raspberry Pi include:

• Using your router’s logs: Some routers can export DHCP lease logs, which you can parse with a script on any computer.
• Fing app: A free mobile app that scans your network and shows devices. It’s convenient but not automatable like a Pi.
• Old laptop with Linux: If you have a spare laptop, you can install Linux and run the same tools.

The Raspberry Pi approach is ideal for continuous, automated monitoring because it’s low-power, always-on, and programmable.

Safety and Privacy Considerations

Scanning your own network is legal and safe, but keep these points in mind:

• Don’t scan networks you don’t own: Active scanning can be considered intrusive or illegal on other people’s networks.
• MAC addresses are not secrets: They can be spoofed, so a device with a known MAC isn’t necessarily trusted. Use this as a convenience tool, not a security boundary.
• Protect your Pi: If your Pi is accessible from the internet, change the default password and disable SSH password authentication if possible. Otherwise, someone could compromise it and use it to scan your network.

Also note that some devices (like IoT items) may sleep and not respond to scans, so they might not appear until they wake up.

Frequently Asked Questions

Can I use my Raspberry Pi to see when a new device joins?

Yes. By running a scan periodically (e.g., every minute) and comparing the list to your known list, you can detect new MAC addresses. You can even set up a notification script that sends an alert when an unknown device appears.

Why does my phone show a different MAC address each time?

Modern phones use MAC randomization to protect your privacy. They generate a random MAC address for each Wi-Fi network, and sometimes change it periodically. To make your phone appear consistently, disable MAC randomization in the Wi-Fi settings for your home network (often labeled “Use device MAC” or “Private Wi-Fi address”).

Do I need a monitor for the Raspberry Pi?

No. You can set up the Pi headless by enabling SSH and connecting via your computer’s terminal. This is often easier and cheaper, as you don’t need a separate screen and keyboard.

Can this scanner detect devices on a guest network?

Only if your Pi is also connected to that guest network. Guest networks are usually isolated from the main network, so a Pi on the main network won’t see guest devices. You would need a second Pi or a network configuration that allows cross-network visibility.

Is arp-scan better than nmap for this task?

For simply listing devices, arp-scan is faster and simpler. nmap offers more features (like OS detection) but is overkill for basic device discovery. If you want to also check open ports, nmap is the better choice.

What if my router uses a different subnet, like 10.0.0.0/24?

You can specify the subnet manually. For example, sudo arp-scan 10.0.0.0/24. Check your router’s IP to determine the correct subnet. The --localnet flag usually auto-detects it, but if not, this manual method works.

Related

• Direct Mail Automation Platforms: Selection Guide
• Call Pickup Service: What It Means & How It Works
• Pixel Webcam vs Dedicated Webcam: Which Should You Use?