I'm trying to identify and prevent unauthorized devices from connecting to my home Wi‑Fi. I can scan the local network from a terminal with `sudo arp-scan --localnet`, but I'm confused by the addresses I see and sometimes find that device addresses change because of privacy randomization. My modem/router interface is very limited, so I'm looking for the best practical approach. Should I use IP addresses, MAC addresses, or another method to whitelist trusted devices and keep intruders out—even if someone obtains the Wi‑Fi password?
3 Answers
For device whitelisting, you need to work with MAC addresses, not IP addresses. IP addresses are assigned by the network and can change, while a MAC address identifies a network interface. If your router supports it, add the MAC addresses of your trusted devices to an allowlist and optionally assign each one a DHCP reservation for a predictable local IP.
The scan is useful for discovering active devices, but it cannot reliably prove who is authorized. ARP and IP information only describe devices currently visible on the local network. If the modem’s interface lacks an allowlist or proper access controls, consider using a better router or access point, placing guests on a separate guest network, and disabling WPS. Enterprise features such as 802.1X or RADIUS are usually unnecessary for a typical home network.
Be careful with MAC filtering, though. Modern phones and laptops often use private or randomized MAC addresses, so the address can differ between networks or after settings change. Also, MAC allowlists are not strong security: someone who already knows the Wi‑Fi password can potentially copy an allowed MAC address. The stronger solution is to use WPA2 or WPA3 with a long unique password, change it if you suspect it was shared, and remove unknown devices from the router’s client list.
That helps clarify the difference. I was treating the addresses from the scan as permanent device identifiers.