Loading devShakib…
Your router lists twenty-three devices with names like android-4f2a. Sonar identifies each one, scans what it exposes, and tells you which are worth worrying…
Open your router's admin page and you will find a list of connected devices with names like android-4f2a91, ESP_8C3D, and four entries that just say unknown. Twenty-three things are on your network. You can confidently identify maybe eight of them.
That is the normal state of a home network, and it is worth fixing — not because somebody is definitely on your Wi-Fi, but because you cannot notice anything unusual on a network you have never actually looked at.
I built Sonar to look at mine.
Sonar does a ping sweep and ARP discovery, then resolves each result into something readable: IP, MAC, vendor, hostname, plus mDNS/Bonjour names and SSDP/UPnP details. It fingerprints device types — router, Mac, iPhone, printer, camera, NAS, TV, IoT — so the list reads as your house rather than a column of hex.
Randomised MACs get flagged as randomised rather than silently listed as unknown, which matters because modern phones rotate theirs and you would otherwise see a "new device" every few days and slowly learn to ignore alerts.
This is the part that changes how you feel about the list.
Run a port scan on a device and Sonar reads the service and version banner each open port advertises. Not "port 22 is open" — SSH-2.0-OpenSSH_6.6.0. That is a specific version, and you can look up whether it is one you want facing your LAN.
It flags the exposures that actually matter: Telnet, open SMB, unauthenticated VNC, exposed databases. When I first ran it on my own network the router was advertising an SSH build from several years ago, which I would never have discovered by looking at a list of names.
New devices raise an alert, presence is kept as history, and anything can be labelled and marked trusted — so the second time your neighbour's phone appears, you know it is your neighbour's phone.
The flags are only useful if you know what to do about them, so here is the short version for each.
Telnet (port 23). Sends everything, including passwords, in plain text. It has no legitimate place on a home network in 2026. If a device is offering it, that device is old, and its firmware almost certainly has known holes. Disable it in the device's settings, or replace the device.
Open SMB (445). Windows file sharing. Fine if it is your NAS and you set it up. Worth investigating if you did not, because SMB has been the delivery mechanism for some of the most damaging malware of the last decade.
Unauthenticated VNC (5900). Someone can see and control that screen with no password. This is almost always a misconfiguration — screen sharing enabled without a password set — and it is as bad as it sounds.
Exposed databases (3306, 5432, 27017…). A MySQL, Postgres or MongoDB listening on the LAN. Usually a development database somebody started and forgot, frequently with default credentials.
The point of the version banner is that it turns "port 22 is open" into something you can act on. SSH-2.0-OpenSSH_6.6.0 is a specific release with a specific CVE history, and thirty seconds of searching tells you whether it matters.
A number worth calibrating expectations about: the first scan will find fewer devices than you have.
Devices asleep do not answer. Devices on 5GHz when you are scanning from 2.4GHz may be on a different segment depending on your router. Guest networks are usually isolated by design. And phones with randomised MAC addresses appear as a new device each time they rotate, so the total tracked number drifts upward while online stays honest.
That is why presence history matters more than the instantaneous count. A device that appeared once at 3am and never again is more interesting than the count on any given afternoon.
This is the important section, because it is the question people ask about any network tool.
Sonar shows you who is on your network and what they expose, and controls your own machine and router. It does not intercept, capture or decode anyone else's traffic. No ARP spoofing, no MITM, no packet sniffing, no per-person browsing history.
That is wiretapping even on a network you pay for, and HTTPS would make the contents unreadable anyway. The tools that claim otherwise are selling you something that does not work and would be illegal if it did.
For household domain-level visibility there is an honest version, and Sonar supports it: point your router or devices at NextDNS or a self-hosted Pi-hole, and Sonar reads that resolver's query log — which device asked for which domain, when, allowed or blocked. That is consent-based, it is accurate, and it is the answer to the question people are really asking.
The distinction is not pedantic. Reading your own resolver's log is reading records you generated, on infrastructure you control, about queries that passed through it because you configured them to. Intercepting traffic is something else entirely, both technically and legally, and any tool that blurs the two is misleading you about what it does — usually while not working, since HTTPS makes the contents unreadable regardless.
Everything above assumes your own network. Port scanning is a normal administrative activity on infrastructure you control, and in many jurisdictions it is something else on infrastructure you do not.
Do not point this at a café's Wi-Fi, an office network you are a guest on, or a neighbour's SSID. Not because the tool prevents it — it does not — but because "I was curious" is not a defence anywhere.
Running it on mine the first time, in the spirit of not recommending something I have not used:
Six devices online out of a wider set tracked over time. The gateway advertising SSH-2.0-OpenSSH_6.6.0 — a build old enough to be worth reading about. Four entries that resolved only as randomised-MAC devices, which turned out to be phones and a tablet that had rotated since their last appearance. Gateway ping at 2.1ms, internet at 4.5ms, and a 24-hour latency chart that made an evening slowdown obvious in a way that "the internet feels slow" never does.
None of that is dramatic. That is rather the point: the value is not catching an intruder, it is knowing what normal looks like so that abnormal is visible.
Download Sonar — free, MIT licensed, macOS 14 or later. The full source is public, which for an app that scans your network and can change your DNS seems like the minimum.
It is not notarised — that needs a paid Apple account — so the first launch takes one extra click through System Settings ▸ Privacy & Security ▸ Open Anyway.