Where to find connected devices in OPNsense

Open your OPNsense dashboard and go to Interfaces > Diagnostics > ARP Table. This page shows every device currently talking to your router, including its IP address, MAC address, and the interface it connected through. The ARP table updates in real time, so you'll see devices appear as they join your network and disappear when they leave.

For a cleaner view focused on active connections, go to System > Monitoring > Services and look at the DHCP server status. This shows devices that got an IP address from your router's DHCP pool — the automatic assignment system most home devices use. Devices with static IP addresses (ones you assigned manually) won't appear here, but they will show up in the ARP table.

A third option is Status > System Logs > DHCP, which keeps a running record of every device that requested an IP address, when it connected, and what address it received. This is useful for spotting devices that connected in the past but aren't online right now.

Key Takeaways

  • The ARP Table under Interfaces > Diagnostics shows every device connected to your network in real time, with its IP and MAC address.
  • The DHCP server status shows only devices using automatic IP assignment, so manually configured devices won't appear there.
  • DHCP logs record the history of connections, letting you see devices that connected earlier but are offline now.
  • MAC addresses in the ARP table let you identify devices by their hardware address, which is more reliable than IP addresses that change.
  • Unknown devices in your ARP table are a sign to check your network security — they may indicate an unauthorized connection.

Understanding what the ARP table actually shows

The ARP table lists devices by their MAC address — a unique identifier burned into every network card. Unlike IP addresses, which your router assigns and can change, a MAC address stays the same. When you see a device in the ARP table, you're seeing its permanent hardware identity.

The "Interface" column tells you which port or connection type the device is using — usually your LAN (wired) or one of your wireless networks. If you have multiple SSIDs or VLANs set up, this column shows which one each device is on. The "Hostname" column may be blank or show a name, depending on whether the device announced itself to your router.

Devices stay in the ARP table only while they're actively communicating. A phone that's asleep or a computer that's powered off won't appear, even if it connected earlier. This is why the ARP table shows your current network state, not a permanent record.

How to identify devices by their MAC address

If a device shows up in the ARP table but you don't recognize it, write down its MAC address and search for it online. Websites like macvendorlookup.com or maclookup.app can tell you the manufacturer based on the first half of the MAC address. A MAC starting with 00:1A:2B might belong to Apple, for example, which narrows down what kind of device it is.

You can also cross-reference MAC addresses with your router's DHCP lease list. Go to Services > DHCP > [Your LAN Interface] and look at the "Leases" tab. This shows which MAC addresses your router has assigned IP addresses to, along with the hostname the device reported. If a device's MAC appears in the ARP table but not in the leases, it's using a static IP or connected through a different method.

For wireless devices, check your SSID settings under Interfaces > Wireless. Some routers let you view connected clients per SSID, though OPNsense's interface for this is less detailed than the ARP table. The ARP table remains your most complete view.

Spotting unauthorized or suspicious devices

Unknown devices in your ARP table are worth investigating. Start by counting how many devices you expect to see — your computers, phones, tablets, smart home devices, printers, and anything else you own. If the count is higher, or if you see a MAC address you don't recognize, that's a sign to dig deeper.

Check the manufacturer of the unknown MAC address using the lookup tools mentioned above. A device labeled as a printer manufacturer when you don't own a printer, or a device on your network that you've never heard of, warrants attention. Write down the IP address and MAC address, then check your firewall logs to see what traffic it's sending.

Go to System > Logs > Firewall and search for the device's IP address. If it's trying to reach the internet or other devices on your network, the logs will show it. Blocked traffic appears here too — if your firewall is already stopping the device, you're protected, but you should still figure out what it is and remove it if you didn't authorize it.

Using MAC filtering to control what connects

Once you know all the MAC addresses of devices you want to allow, you can set up MAC filtering to block everything else. This is most useful on wireless networks, where unauthorized devices are easier to add. Go to Interfaces > Wireless > [Your SSID] and look for "MAC address filtering" or "ACL" (access control list) options.

Create a whitelist of MAC addresses you trust. Only devices matching those addresses can connect to that SSID, even if they know the password. This prevents a neighbor or visitor from connecting an unknown device, and it stops any device that somehow got on your network from staying connected if you restart the router.

MAC filtering is not a replacement for a strong password — someone with physical access to your router can still change the settings. But combined with a good password and regular monitoring of your ARP table, it adds a layer of control over who's on your network.

Checking for devices that shouldn't be there

Run through your ARP table once a week and compare it to what you expect. Look for devices with hostnames you don't recognize, or devices that appear only at certain times. A device that shows up at 2 a.m. and disappears by morning might be a neighbor's device picking up your signal, or it might be something more serious.

If you find a device you don't recognize, first try to identify it using the MAC address lookup. If it's a common device like a printer or smart speaker, check whether someone in your household added it without telling you. If you're certain it's not yours, change your WiFi password when ready — this forces all devices to reconnect and gives you a chance to see what comes back.

After changing your password, watch the ARP table for the next hour. Legitimate devices will reconnect as people use them. If the unknown device reappears without anyone entering a new password, it means someone has physical access to your router or knows your password. In that case, reset your router to factory settings, set a new password, and consider whether your network security has been compromised elsewhere.

Setting up alerts for new devices

OPNsense doesn't have a built-in notification system for new devices, but you can monitor manually by checking the ARP table and DHCP logs regularly. Some users set up scripts using OPNsense's API to log device connections to a file, then review that file weekly. This is more advanced and requires some comfort with command-line tools.

A simpler approach is to take a screenshot of your ARP table once a week and compare it to the previous week. Note any new MAC addresses, any devices that disappeared, and any changes in IP addresses. Over time, you'll recognize the normal pattern of your network and spot anomalies quickly.

If you're concerned about security, also check your firewall logs weekly. Go to System > Logs > Firewall and look for blocked connections from unknown IPs. A device that's trying to reach your network but being blocked is less of a threat than one that's already connected, but it's still worth noting.

Frequently Asked Questions

Why do some devices show up in the ARP table but not in DHCP leases?

Those devices are using static IP addresses — ones you assigned manually instead of letting your router assign them automatically. They're still connected and communicating, but they didn't ask your DHCP server for an address. Check your static IP assignments under Interfaces > [Your LAN] to see if you set them up, or ask the device owner if they configured it that way.

Can I see what websites a device is visiting from the ARP table?

No, the ARP table only shows that a device is connected and its IP address. To see what traffic a device is sending, you need to check the firewall logs or set up packet capture. Go to System > Logs > Firewall to see blocked and allowed traffic, but this won't show you the content of encrypted connections like HTTPS websites.

What does it mean if a device has a constantly changing IP address?

Your DHCP server is assigning it a new address each time it reconnects. This is normal for devices that go to sleep or move between networks. If you want a device to keep the same IP, you can assign it a static address under Services > DHCP > [Your LAN] > Reservations, which ties that MAC address to a specific IP.

Is it safe to block a device using MAC filtering if I don't know what it is?

Yes, blocking it won't harm your router or other devices. If the unknown device is something you need, the owner will notice it's not connecting and can tell you what it is. If nobody complains, you've successfully removed an unauthorized device. You can always remove the MAC filter rule later if you change your mind.

How often should I check my ARP table for security?

Once a week is reasonable for a home network. If you're concerned about unauthorized access, check it more often — daily for the first week after a password change, then weekly after that. Most home networks are stable, so you'll quickly learn what devices normally appear and spot anything new.