NetSamurai finds the devices on your Wi-Fi, checks them for risky services and known vulnerabilities, including flaws on CISA's Known Exploited Vulnerabilities list, then explains each finding with fix steps. Scanning, Quick checks and every finding are free; Pro is a one-time purchase for deeper and batch checks, history and reports.
Discover the devices on your Wi-Fi
Tap Scan and NetSamurai looks for every device that answers on the Wi-Fi network your iPhone or iPad is connected to. It builds a readable list with the clues it can gather: the names devices announce on the network (Bonjour and UPnP), the maker, the address and the services they offer.
- Mark devices as yours and give them names, so the unfamiliar ones stand out.
- New devices are flagged when they weren't in the previous scan.
- Link entries that turn out to be the same device.
- Networks are remembered separately, so home and office lists don't mix.
- Large networks: a scan covers up to 256 addresses. On bigger networks NetSamurai picks the block around your own address; with Pro you choose the block.
Check devices for weaknesses
Finding a device doesn't check it. A check is a separate step that connects to a device's ports and reads what each service answers. It runs one device at a time and never logs in.
| Check | Ports | Plan |
|---|---|---|
| Quick check | 16 common ports | Free |
| Extended check | About 80 ports | Pro |
| Full check | All 65,535 ports on one device | Pro |
| Custom check | Ports you pick, saved as a profile | Pro |
| Batch checks | Remaining, selected or all devices, one after another | Pro |
Each result says how complete it was: Checked (covered the common services), Partly checked (something timed out or didn't answer, so check again), Custom check (only the ports you chose) or Not checked.
What the checks look for
When a device offers a service, NetSamurai reads what it answers and looks for the weaknesses that turn up most in homes. Each finding has a severity, the evidence behind it and what the check can't tell.
- Risky services left on, such as old remote logins and file sharing a device no longer needs.
- Logins and files sent without encryption, and outdated encryption versions.
- Certificate problems on a device's secure pages.
- Router settings that let devices open themselves to the internet.
- Known vulnerabilities: software versions and device models are matched against reviewed CVEs and CISA's Known Exploited Vulnerabilities catalog. A match is reported as "potentially affected", because a version or model name can't show a backported fix.
Findings for flaws on CISA's list show the date CISA added them, whether CISA knows of ransomware use, and the EPSS score, an estimate from FIRST of how likely a flaw is to be exploited in the next 30 days.
Investigate unfamiliar devices
An unnamed device is usually something ordinary: a smart plug, a TV, a phone using a private Wi-Fi address. The Identify this device screen collects what NetSamurai knows, including maker, announced names, open services, when it was first and last seen, and gives practical steps to find it, such as matching it in your router's device list. Read the full guide: how to identify an unknown device on your Wi-Fi.
Fix and recheck
The Security tab lists findings worst first, with critical and known exploited issues at the top. Each finding explains:
- What was observed, with the technical evidence one tap away
- Why it matters, in plain language
- What is still unknown, such as whether a patch was backported
- How to fix it, step by step, with guidance for common makers
After you change a device's settings, check it again. A finding that no longer appears is marked as resolved.
What changed, new-device alerts and Shortcuts
Compare scans and checks to see new and returning devices, ports that opened or closed, and findings that appeared or were resolved. Comparisons say when different scopes or incomplete results limit what can be concluded. With Pro, save a baseline, a state you know is good, and compare later scans with it.
- New-device alerts (optional) notify you about devices that weren't in the previous scan and that you haven't marked as yours.
- Shortcuts: add an automation such as "When I join my Wi-Fi" with the action Check for New Devices.
- Background checks run only on networks you allow. iOS decides when they run, often hours apart, so they are not a live alarm.
Network tools
- Fix a connection problem: a troubleshooter that tests your router, DNS and internet connection in turn and says which step failed.
- Ping a device or website to see if something is answering.
- Port check: one TCP connection attempt to one port on a device on your Wi-Fi.
- DNS lookup of a name's records, using your network's DNS server.
- Reports (Pro): share a network report as PDF, CSV and JSON.
Free and Pro
NetSamurai is free to download, with no ads. Pro is a single one-time in-app purchase, with no subscription, at the price shown in the App Store. Restore it on your other devices with Restore Purchases.
| Feature | Free | Pro |
|---|---|---|
| Scan your Wi-Fi, name and mark devices | Yes | Yes |
| Quick check (16 ports), one device at a time | Yes | Yes |
| Every finding with explanation and fix | Yes | Yes |
| Rechecks and what changed | Yes | Yes |
| New-device alerts and Shortcuts action | Yes | Yes |
| Troubleshooter, ping, port check, DNS lookup | Yes | Yes |
| Vulnerability-data updates (KEV, EPSS) | Yes | Yes |
| History kept | 20 scans per network, 5 checks per device | Up to 100 scans and 20 checks |
| Batch checks | – | Yes |
| Extended, full and custom checks; saved port profiles | – | Yes |
| Choose which addresses to scan | – | Yes |
| Browse other saved networks | – | Yes |
| Saved baselines | – | Yes |
| Owner and room tags | – | Yes |
| PDF, CSV and JSON reports | – | Yes |
Requirements and limits
- iPhone or iPad with iOS or iPadOS 17.0 or later. Certificate expiry checks need iOS 18 or later.
- A connection to an IPv4 Wi-Fi network, and Local Network access allowed in iOS Settings.
- Scan only networks you own or have permission to assess. NetSamurai asks you to agree to this before the first scan.
- Sleeping, isolated or silent devices can be missed, and devices on a guest network or behind client isolation may not be visible.
- NetSamurai doesn't inspect traffic, detect malware, block devices, identify people or check your network from the internet. No issues found means none within the checks performed.
Frequently asked questions
How many ports does a NetSamurai check look at?
A Quick check, which is free, looks at 16 common ports per device. With Pro, an Extended check looks at about 80 ports, a Full check tries all 65,535 ports on one device, and a Custom check uses the ports you pick, which you can save as a profile.
Does NetSamurai try to log in to my devices?
No. Every check is read-only. NetSamurai reads what a service answers, such as a greeting, a protocol reply or the first web page, and never tries passwords, default credentials or exploits.
What does potentially affected mean?
It means the version or model NetSamurai read falls in a range a CVE affects, but the evidence can't prove the device is unpatched. Vendors often backport fixes without changing the version number, and settings or modules can rule a flaw out. Treat it as a strong reason to update the device or check with its maker.
How current is the vulnerability data?
The rules built into version 1.0 were reviewed on 26 October 2026, with CISA's Known Exploited Vulnerabilities list dated 23 October 2026. Tap Check for updates in Settings, or turn on the daily check, to download the latest KEV list from CISA and EPSS scores from FIRST for the CVEs the app has rules for. New rules arrive with app updates.
Check your own network
NetSamurai is free on iPhone and iPad. No account, no analytics.