See Who Is Connected to Your Network Using arp and netstat
Internet feels slow and you suspect an unknown device is using your WiFi — or an office PC is talking to something it should not. Two built-in commands show what your PC can see on the network, and what it is connected to.
✍️ Technical Anshu🪟 Windows 10 / 11⏱️ 4 minute check
🎥 This command is part of the 60 Windows Commands video — watch the full toolkit in action
Let us be precise about what these commands do, because their names promise more than they deliver. arp -a lists the devices your PC has recently talked to on the local network, with their IP and MAC addresses. netstat lists your PC’s own connections — which servers it is talking to and which program owns each connection. Used together, they answer most "who is on my network" and "what is my PC doing" questions in minutes, with honest limits explained at the end.
👆 Each row is a device your PC has exchanged traffic with recently — the .1 address is almost always the router itself. Addresses shown are from an example network.
1
Build the Device List — arp -a
Open Command Prompt and first run ipconfig — note your IPv4 Address and Default Gateway
Run ping 192.168.1.255 once (your network’s broadcast address — replace with your subnet, for example 192.168.0.255). It may look like it fails; it still wakes up replies that fill the ARP table
Now run arp -a — every row is a device on your local network segment that your PC has heard from
The gateway address (usually ending in .1) is your router. The row ending in .255 with MAC ff-ff-ff-ff-ff-ff is the broadcast entry, not a device
Count the real rows and compare with the devices you own — phones, laptops, TV, printer, smart devices add up faster than people expect
2
Identify a Stranger — MAC Address Clues
An IP address tells you where a device sits; the MAC address hints at what it is:
The first three pairs of the MAC (like 8c-3b-ad) identify the manufacturer of the network chip — search that prefix online as an "MAC OUI lookup" to learn the maker
Modern phones use randomised MAC addresses on WiFi — a phone may appear as an unknown device with an unlisted prefix. Check your phone’s WiFi settings: it shows the MAC it uses for your network
Temporarily switch off your own devices one by one and re-run arp -a after a few minutes — entries that vanish belonged to them
3
See Your Own Connections — netstat -ano
netstat answers the other question: what is this PC connected to right now?
Run netstat -ano — the Foreign Address column lists the servers, State shows ESTABLISHED for live connections, and the last column is the PID (process ID)
Find who owns a suspicious PID: tasklist | findstr 1234 — replace 1234 with the PID from netstat
Simpler view with program names (needs Administrator): netstat -abno
A healthy idle PC shows a modest list — browsers, Windows update services, your apps. Pages of ESTABLISHED connections to unknown addresses from one unknown process deserve a malware scan
🔴 The honest limit: arp only shows devices your PC has recently exchanged traffic with on its own subnet — it is not a complete WiFi user list. The complete, live list of everyone connected lives in your router’s admin page (usually under Connected Devices or DHCP Clients). Use arp as the quick check; use the router page as the final proof, and change the WiFi password there if a true stranger remains.
🎥 Watch the Complete Video
arp and netstat are two of the network commands in the toolkit — the video shows the full network section step-by-step.
The ARP table only holds devices your PC has communicated with recently on the same subnet, and old entries expire. A device that has been silent may not appear. For the complete list of connected devices, open your router admin page and check its connected devices or DHCP client list.
Can netstat tell me who is using my WiFi?
Not directly. netstat shows your own PC’s connections to servers, with the owning program’s process ID — it says nothing about other devices on the network. Use arp -a for a quick local device view and the router page for the full WiFi list.
I found an unknown device — what should I do first?
First confirm it is not yours: phones with randomised MAC addresses, smart TVs, printers and family devices are the usual suspects behind unknown entries. If it truly is a stranger, change the WiFi password on the router — that disconnects everyone, and only your devices rejoin with the new password.
This guide is based on the Technical Anshu 60 Windows Commands video • Stuck on any step? Ask in the video comments — you will get a reply there 🙏