I Scanned My Home Network. Then I Found Devices I Forgot Existed.

I thought I knew everything connected to my home network.

My laptop was there. My phone was there. A couple of IoT devices were there. My Raspberry Pi was there.

Nothing particularly exciting.

So I opened my terminal, ran a basic network discovery scan, leaned back in my chair and waited for the results.

A few seconds later, I looked at the output.

Then I looked around my room.

Then back at the terminal.

There were devices on my network that I had completely forgotten about.

And that's when I realized something slightly uncomfortable:

I wasn't looking at my network the way an attacker would.

Who Am I?

I'm Satyam Pathania, a self-taught cybersecurity researcher, technical writer and builder interested in offensive security, networking, hardware, IoT and everything that makes computers do things they probably shouldn't.

A lot of my cybersecurity journey has involved learning by actually building things and then asking uncomfortable questions about them.

What is running?

Why is it running?

Who can access it?

What happens if I change this?

And, occasionally:

"Why did I connect this thing to my network in the first place?"

That last question became particularly relevant during this experiment.

The Scan Was Supposed to Be Boring

I wasn't trying to exploit anything.

I wasn't looking for some Hollywood-style vulnerability where I could type three commands and suddenly become the owner of the entire network.

I simply wanted to map my own network.

That's an important distinction.

Before testing security, you need to know what you're actually testing.

So I started with host discovery.

On a network I own, something as simple as:

nmap -sn 192.168.1.0/24

nmap -sn 192.168.1.0/24

can help identify hosts that appear to be active.

The exact subnet depends on how your network is configured, so don't blindly copy mine. The important part is understanding the purpose of the scan.

You're asking:

"Which devices are currently visible on this network?"

And that's where things got interesting.

There Were More Devices Than I Expected

The first few results were exactly what I expected.

My laptop

My phone

The router

Then another device appeared

I recognized it eventually

Then another one

I had completely forgotten about that one.

Then another.

At this point, my network inventory was starting to look less like a carefully managed environment and more like an archaeological excavation.

There is something humbling about discovering that the device you haven't touched in eighteen months is still happily connected to your network.

It doesn't care that you've forgotten it.

It doesn't care that you haven't updated it.

It is simply sitting there, waiting for someone to remember it exists.

Or for someone else to notice it exists.

This Is Why Asset Discovery Matters

This sounds simple, but it's one of the fundamental concepts in cybersecurity:

You can't properly secure what you don't know exists.

Security teams spend enormous amounts of time maintaining asset inventories for exactly this reason.

A company might have hundreds or thousands of servers, laptops, cloud resources, applications, containers, APIs and third-party services.

If one forgotten system remains exposed, it can become an entry point.

Your home network obviously isn't a multinational enterprise, but the principle is identical.

If you have twenty connected devices but only actively maintain five of them, the other fifteen haven't magically stopped being part of your attack surface.

They've simply become less visible to you.

And from a security perspective, forgotten can be worse than known….

Then I Asked a More Important Question

Finding the devices was useful.

But simply knowing that an IP address exists doesn't tell you much.

So I started asking:

What is each device actually doing?

That's where service enumeration becomes useful.

A device might expose services over different ports. Depending on the system, you might encounter things such as SSH, HTTP, HTTPS, DNS or other network services.

For a device you own, you could perform a more detailed scan to understand what's exposed:-

nmap -sV 192.168.1.10

nmap -sV 192.168.1.10

Again, the IP address is just an example.

The interesting part is -sV.

Instead of simply asking whether ports are open, you're asking Nmap to attempt to identify the services and versions behind them.

Now the question becomes much more useful.

Instead of:

"There is something on 192.168.1.10."

you can start asking:

"Why is this device running an HTTP service?"

"Does it need SSH?"

"Is this service supposed to be accessible from other devices?"

"Is the software current?

That's where network reconnaissance starts becoming actual security analysis.

An Open Port Isn't a Vulnerability

This is worth emphasizing because it's one of the first misconceptions beginners encounter.

You scan something.

You see:

22/tcp open ssh
80/tcp open http

22/tcp open ssh
80/tcp open http

And your brain immediately goes:

"I FOUND SOMETHING"

Technically, you found something.

But you haven't necessarily found a vulnerability.

An open port simply means that a service is listening there.

SSH on port 22 isn't inherently vulnerable.

HTTP on port 80 isn't inherently vulnerable.

You need context.

Why is it running?

Who can reach it?

Does it require authentication?

Is the software vulnerable?

Is exploitation possible?

What would the impact actually be?

This is one of the differences between scanning and security research.

Scanning gives you observations.

Security research tries to understand what those observations mean.

The Forgotten IoT Problem

One category stood out to me more than the others: IoT

We tend to think of computers as computers and everything else as "devices."

That's a dangerous distinction.

A smart camera is a computer.

A smart speaker is a computer.

A smart plug is a computer.

A development board connected to Wi-Fi is a computer.

They might have significantly fewer resources than your laptop, but they're still running software, communicating over networks and handling data.

And because they're often designed for convenience, they can easily become forgotten parts of a network.

You install a smart device because it makes something easier.

You configure it once.

Then six months later, you don't remember what firmware it's running, whether it still needs internet access or whether the manufacturer even supports it anymore.

That's a security problem worth thinking about.

The Device Nobody Remembers Is the Interesting One

There's a broader lesson here that applies far beyond home networks.

Attackers don't care about your asset inventory.

They don't care that the development server was supposed to be decommissioned.

They don't care that nobody uses the old admin panel anymore.

They don't care that someone installed a test application "temporarily" three years ago.

If it's reachable and vulnerable, it matters.

That's why attack surface management is so important.

The goal isn't simply to identify the systems you intentionally operate.

It's to discover what actually exists.

There's a difference.

Your documentation might say you have ten devices.

Reality might say you have fourteen.

Security should care about the fourteen.

I Started Thinking About My Network Differently

After doing this, I stopped thinking about my home network as a single thing.

I started thinking about it as a collection of relationships.

My laptop can communicate with this device.

This IoT device can reach the internet.

That Raspberry Pi exposes SSH.

The router controls traffic between everything.

The guest network separates certain devices from others.

Suddenly, the network becomes a map rather than a password.

And that's the mindset I want beginners to develop.

Don't just learn:

nmap
Burp Suite
Wireshark
Metasploit

nmap
Burp Suite
Wireshark
Metasploit

Learn to ask what you're trying to discover with them.

A tool is only useful when you understand the question you're asking.

So What Did I Actually Fix?

I didn't start deleting devices just because I didn't recognize them.

First, I identified what they were.

Then I asked whether they still needed network access.

For devices I no longer used, removing them made sense.

For devices I did use, I checked whether their software and firmware were current and whether they exposed services they didn't need.

I also reviewed the router configuration, checked connected clients periodically and separated less-trusted IoT devices where practical.

None of this is particularly glamorous.

There was no dramatic "I hacked myself" moment.

And honestly, that's the point.

Good cybersecurity is often incredibly boring.

It's inventory.

It's updates.

It's configuration.

It's monitoring.

It's asking the same questions repeatedly because environments change.

The boring stuff is often what keeps the exciting stuff from happening.

The Lesson I Took Away

The most interesting discovery wasn't actually the forgotten devices.

It was how easy it was for me to forget them.

I work with cybersecurity.

I know what an attack surface is.

I know why asset inventory matters.

And still, my own home network had things I wasn't actively thinking about.

That made me wonder how many people have devices sitting on their networks that they haven't thought about since the day they plugged them in.

Your network doesn't shrink just because you stop looking at it.

If anything, your understanding of it does.

So if you're learning network security, ethical hacking or penetration testing, don't immediately start looking for some complicated exploit.

Start with something you own.

Map it.

Identify the devices.

Understand the services.

Figure out why they're there.

Then decide what should and shouldn't be exposed.

That's how you start thinking like a security researcher.

Not by asking:

"What can I hack?"

But by asking:

"What am I looking at?"

And then:

"Why is it there?"

Those two questions will take you surprisingly far

If You're Building in Cybersecurity, Let's Talk

I'm Satyam Pathania, a cybersecurity researcher and technical content writer working across cybersecurity, offensive security, hardware, IoT and emerging technologies.

I work with cybersecurity startups, security platforms and technology brands on technical articles, product-led content, research-backed thought leadership, security explainers and long-term content partnerships.

If you're building a security product and need someone who can understand the technical material and turn it into content that actual practitioners want to read, I'm open to collaborations and monthly retainers.

Satyam Pathania — 0xdiddy

Buy Me a Coffee

If this article helped you learn something new, you can support my work here:

Buy Me a Coffee: https://www.buymeacoffee.com/satyampathania

Your support helps fund more labs, hardware, security experiments and the questionable amount of time I spend staring at terminal output.

And if you're not buying coffee, sharing the article with someone who has seventeen devices connected to their Wi-Fi and knows the name of exactly four of them is perfectly acceptable.

network security, network scanning, Nmap tutorial, Nmap network discovery, cybersecurity for beginners, ethical hacking, penetration testing, asset discovery, attack surface management, IoT security, home network security, network reconnaissance, port scanning, cybersecurity lab, Wi-Fi security.