Your router lists twenty three devices with names like android 4f2a. Sonar identifies each one, scans what it exposes, and tells you which are worth worrying…
Open your router's admin page and you will find a list of connected devices with
names like android-4f2a91, ESP_8C3D, and four entries that just say
unknown. Twenty-three things are on your network. You can confidently identify
maybe eight of them.
That is the normal state of a home network, and it is worth fixing — not because
somebody is definitely on your Wi-Fi, but because you cannot notice anything
unusual on a network you have never actually looked at.
I built Sonar to look at mine.
Sonar does a ping sweep and ARP discovery, then resolves each result into
something readable: IP, MAC, vendor, hostname, plus mDNS/Bonjour names and
SSDP/UPnP details. It fingerprints device types — router, Mac, iPhone, printer,
camera, NAS, TV, IoT — so the list reads as your house rather than a column of
hex.
Randomised MACs get flagged as randomised rather than silently listed as
unknown, which matters because modern phones rotate theirs and you would
otherwise see a "new device" every few days and slowly learn to ignore alerts.
This is the part that changes how you feel about the list.
Run a port scan on a device and Sonar reads the service and version banner
each open port advertises. Not "port 22 is open" — SSH-2.0-OpenSSH_6.6.0. That
is a specific version, and you can look up whether it is one you want facing
your LAN.
It flags the exposures that actually matter: **Telnet, open SMB, unauthenticated
VNC, exposed databases**. When I first ran it on my own network the router was
advertising an SSH build from several years ago, which I would never have
discovered by looking at a list of names.
New devices raise an alert, presence is kept as history, and anything can be
labelled and marked trusted — so the second time your neighbour's phone appears,
you know it is your neighbour's phone.
The flags are only useful if you know what to do about them, so here is the short
version for each.
Telnet (port 23). Sends everything, including passwords, in plain text. It
has no legitimate place on a home network in 2026. If a device is offering it,
that device is old, and its firmware almost certainly has known holes. Disable
it in the device's settings, or replace the device.
Open SMB (445). Windows file sharing. Fine if it is your NAS and you set it
up. Worth investigating if you did not, because SMB has been the delivery
mechanism for some of the most damaging malware of the last decade.
Unauthenticated VNC (5900). Someone can see and control that screen with no
password. This is almost always a misconfiguration — screen sharing enabled
without a password set — and it is as bad as it sounds.
Exposed databases (3306, 5432, 27017…). A MySQL, Postgres or MongoDB
listening on the LAN. Usually a development database somebody started and forgot,
frequently with default credentials.
The point of the version banner is that it turns "port 22 is open" into something
you can act on. SSH-2.0-OpenSSH_6.6.0 is a specific release with a specific
CVE history, and thirty seconds of searching tells you whether it matters.
SNR, with a signal meter and RSSI history. A nearby-AP scan recommends the
least congested channel, which is usually the single change that fixes a
slow flat.
traceroute with geolocation, DNS lookup, WHOIS, public IP and ISP.
or your own Pi-hole, toggle the macOS firewall. System changes go through
macOS's own admin prompt; Sonar never sees your password.
"the internet feels slow" becomes "it has been slow every evening since
Tuesday".
A number worth calibrating expectations about: the first scan will find fewer
devices than you have.
Devices asleep do not answer. Devices on 5GHz when you are scanning from 2.4GHz
may be on a different segment depending on your router. Guest networks are
usually isolated by design. And phones with randomised MAC addresses appear as a
new device each time they rotate, so the total tracked number drifts upward
while online stays honest.
That is why presence history matters more than the instantaneous count. A device
that appeared once at 3am and never again is more interesting than the count on
any given afternoon.
This is the important section, because it is the question people ask about any
network tool.
Sonar shows you who is on your network and what they expose, and controls
your own machine and router. It does not intercept, capture or decode anyone
else's traffic. No ARP spoofing, no MITM, no packet sniffing, no per-person
browsing history.
That is wiretapping even on a network you pay for, and HTTPS would make the
contents unreadable anyway. The tools that claim otherwise are selling you
something that does not work and would be illegal if it did.
For household domain-level visibility there is an honest version, and Sonar
supports it: point your router or devices at NextDNS or a self-hosted
Pi-hole, and Sonar reads that resolver's query log — which device asked for
which domain, when, allowed or blocked. That is consent-based, it is accurate,
and it is the answer to the question people are really asking.
The distinction is not pedantic. Reading your own resolver's log is reading
records you generated, on infrastructure you control, about queries that passed
through it because you configured them to. Intercepting traffic is something else
entirely, both technically and legally, and any tool that blurs the two is
misleading you about what it does — usually while not working, since HTTPS makes
the contents unreadable regardless.
Everything above assumes your own network. Port scanning is a normal
administrative activity on infrastructure you control, and in many jurisdictions
it is something else on infrastructure you do not.
Do not point this at a café's Wi-Fi, an office network you are a guest on, or a
neighbour's SSID. Not because the tool prevents it — it does not — but because
"I was curious" is not a defence anywhere.
Running it on mine the first time, in the spirit of not recommending something I
have not used:
Six devices online out of a wider set tracked over time. The gateway advertising
SSH-2.0-OpenSSH_6.6.0 — a build old enough to be worth reading about. Four
entries that resolved only as randomised-MAC devices, which turned out to be
phones and a tablet that had rotated since their last appearance. Gateway ping at
2.1ms, internet at 4.5ms, and a 24-hour latency chart that made an evening
slowdown obvious in a way that "the internet feels slow" never does.
None of that is dramatic. That is rather the point: the value is not catching an
intruder, it is knowing what normal looks like so that abnormal is visible.
Download Sonar — free, MIT licensed, macOS 14 or later. The
full source is public, which for an app that scans your network and can change
your DNS seems like the minimum.
It is not notarised — that needs a paid Apple account — so the first launch takes
one extra click through System Settings ▸ Privacy & Security ▸ Open Anyway.