8 techniques to identify bad devices on your network
Eight checks, from ping and netstat to SNMP and device management, that find infected, misconfigured or out-of-compliance devices on your network.
A bad device is one you cannot trust on your network: infected with malware, misconfigured, out of compliance, or talking to an address it has no reason to talk to. The first symptom is often mundane, a laptop or phone that turns sluggish, and the cause often is not. Left connected, that device is a foothold for a breach.
You do not need a forensics lab to find one. Eight checks, mostly with tools already on the machine, will narrow it down.
What a bad device is, and how to find it
An infected or misbehaving device rarely announces itself. The tells are slow performance, pop-up ads, unexpected network traffic and settings that changed on their own. Start with a scan from a reputable antivirus tool, then work through the checks below to confirm what the scan missed.
1. Read the error log
The device's own logs are the first stop. They record crashes, failed services, rejected logins and hardware faults, with timestamps you can line up against when the trouble started.
Open the log in a text editor for a single machine. For a fleet, ship the logs to Kibana or Splunk and search across devices at once.
2. Check the network with ping
Ping sends ICMP echo requests to a host and waits for the replies. It tells you whether a device is reachable and how long the round trip takes.
Use it in two directions: from the suspect device to a known host, to confirm it has a working connection, and from another machine on the same LAN to the suspect's IP address, to confirm it answers.
Dropped or slow replies point to a network or device problem. On Windows, ping -t keeps the test running until you stop it, which catches intermittent drops.
3. Use telnet to test port connectivity
Telnet opens a plain TCP connection to a remote host, which makes it a quick way to see whether a port answers.
You need the device's IP address and the port you want to test. Then run telnet with both.
To check whether port 80 is open on a machine at 192.168.1.100, type telnet 192.168.1.100 80. A connection means the port is listening; a refusal or timeout means it is closed or filtered. An open port that has no business being open is one of the clearest signs of a compromised device.
4. Test SNMP access
Simple Network Management Protocol (SNMP) lets administrators query and manage network devices remotely. If a device is misbehaving, SNMP tells you whether it can be reached and what state it reports.
Run snmpwalk against the device's address to pull its status, including IP address and uptime. snmpget fetches a single value and snmptable a whole table of settings. On Windows, run them from Command Prompt; they are not built in, so install them first.
On macOS, open Terminal and run snmpwalk with the device name or address. The output is the same: address, uptime and the device's reported settings.
5. Use netstat to find suspicious connections
netstat lists every active socket on the system, incoming and outgoing, with the remote address and port. If a device is compromised, this is where the traffic shows up: a connection to an address you do not recognize, on a port that makes no sense for that machine's job.
Anything unexplained gets an antivirus scan straight away. The longer malware stays, the harder the cleanup.
6. Check for anomalies in device reporting
Some bad devices can be found without touching them, from what they report about themselves.
Devices and their management agents report status, and that reporting can be checked, by hand or automatically, against what you expect to see.
A power supply that reports as unplugged while it is plugged in and switched on is a simple example: the sensor or the firmware is wrong, and either way the device is not telling the truth. Catching that early is cheaper than finding out later.
The second check is performance against history. Compare today's load, traffic or error counts with the device's own baseline and investigate anything that stands out.
7. Keep up with security updates
The update prompts on a computer or phone are the patches against cyberattacks and malware. Turn on automatic updates so no device on the network sits unpatched because someone kept clicking "later". An unpatched device is the easiest one to turn into a bad one.
8. Find out-of-compliance devices with device management
A device management tool shows which devices on the network fail your security baseline, such as missing patches or settings outside policy, before the gap turns into an incident.
Use it to find the non-compliant devices, then fix them or take them off the network. It also means you hear about a problem device from the tool rather than from a breach.
Where to start
Run the netstat and update checks on anything that feels slow this week. Then put device management and log collection in place so the next bad device is found by a tool, not by a user.
A bad device with weak security is an open door to business systems, and it is cheaper to find it than to clean up after it.
The same idea applies at the login. A device that lies about what it is, or that has been seen in a credential stuffing run, should not get the same trust as a known one. That is what device scoring in account takeover protection does.