Example implementations relate to changing a status of a device responsive to detecting an anomaly. A traffic pattern of a device may be monitored across a network. It may be determined that the monitored traffic pattern deviates from an expected traffic pattern of the group of devices by a threshold. Responsive to determining that the devices deviates from the expected traffic pattern, packet data transmitted by the device may be inspected. It may be determined that the inspected packet data transmitted by the device is anomalous. The status of the device may be changed responsive to determining that the packet data transmitted by the device is anomalous.