Many people are familiar with the situation when the internet starts to slow down, and pages load with a noticeable delay. Often, the cause isn't issues with the provider or outdated equipment, but rather that unauthorized persons have gained access to your wireless network. Unauthorized connection This can happen if you use a weak password or have shared your access key with guests who forgot to change it.
Checking the list of active clients is the first thing to do if you suspect traffic theft. Modern routers, whether TP-Link, ASUS or KeeneticNetwork monitoring tools are available, but not all users know how to use them. In this article, we'll explore all methods for detecting uninvited guests, from standard web interfaces to specialized software.
It's important to understand that simply seeing a device is not enough—you need to be able to correctly identify it and, if necessary, block it. The most effective protection method is not only to change the password, but also to enable MAC address filtering in the router settings. Ignoring this can lead not only to a decrease in speed, but also to the leakage of personal data if an attacker gains access to local resources.
Symptoms of connecting foreign devices to the network
Before tinkering with your equipment settings, it's worth paying attention to indirect signs. A sharp drop in speed Internet connection is the most obvious indicator, especially if you observe it during hours when traffic is usually light. If 4K video content stops buffering, and online games show high ping, this is cause for concern.
Another warning sign is the wireless network (WLAN or WiFi) indicator on the router's body blinking, even when all your home devices are turned off or in sleep mode. The indicator light may be steady or rapidly pulsing, indicating active data exchange between the router and an unknown source.
Sometimes antivirus programs on computers may issue warnings about port scanning attempts or suspicious activity on the local network. This could mean that someone inside your network is trying to find vulnerabilities in your devices. Specialized software for traffic monitoring may also show abnormally high data consumption by unknown processes.
⚠️ Attention: Don't jump to conclusions when you see active traffic. Modern devices (smart plugs, TVs) Smart TV, phones) often update in the background or sync data with the cloud, which creates a load on the network even without your intervention.
Checking via the router's web interface
The most reliable way to find out who's connected to your WiFi is to log into your router's administrative panel. To do this, enter the gateway IP address (usually 192.168.0.1 or 192.168.1.1) into your browser's address bar. After entering your username and password (often admin/admin by default), you'll gain access to the management panel.
In the settings menu, you need to find a section that may have different names depending on the model. Look for the tabs Wireless, WLAN, Status or Client listThis is where you'll see a table of all the devices currently receiving an IP address from your router.
In the list, you will see the IP address, MAC address, and possibly the device name. The name can be descriptive, for example, iPhone-Ivan or LivingRoom-TV, but is often displayed simply as Unknown or a set of characters. To determine whether a device is yours or someone else's, compare the MAC addresses with those listed on the labels of your gadgets or in their settings.
Using mobile apps for scanning
If you have limited access to your computer or want to perform a scan on the go, mobile network scanning apps are a great solution. Programs like Fing, WiFi Analyzer or Network Scanner Allows you to instantly get a complete map of your connected devices. They work on both Android and iOS.
These utilities don't just display a list of IP addresses. They can also identify the network card manufacturer (for example, Apple, Samsung, Intel), which makes identification much easier. If you see a device from Huawei, and you don’t have appliances of this brand in your home – this is a clear sign of an intrusion.
Apps also often display the signal strength (RSSI) of each connected device. This is a useful feature: if the signal strength of the "left" device is very low (for example, -90 dBm), it means the source is far away, perhaps in your neighbor's apartment. If the signal is strong, the intruder is inside your apartment.
Device List Analysis: How to Distinguish Your Own from Others
The most challenging part of the process is navigating the connection list when there are so many gadgets in the house. Smart lamps, speakers, set-top boxes, and phones create a complex ecosystem. To avoid accidentally blocking your refrigerator, you need to know how to read the client table.
Pay attention to the connection type. The list may include devices connected via cable (LAN) and wirelessly (WiFi). If you're not using a wired connection and the list includes active LAN clients, this may indicate that someone has physically connected to your router or is using a WiFi bridge.
Below is a table to help you navigate the device types and their possible designations in the router's client list:
| Device type | Possible name (Hostname) | Manufacturer (Vendor) | Risk |
|---|---|---|---|
| Smartphone | Android, iPhone, Galaxy | Samsung, Apple, Xiaomi | Low (own) |
| Laptop/PC | DESKTOP-XXX, MacBook-Pro | Intel, Realtek, Dell | Low (own) |
| Smart technology | IPCAM, SmartPlug, TV | Tuya, Espressif, LG | Average (forgot?) |
| Unknown | Unknown, ESP_XXXX | Not defined | High (check!) |
If you find a device you can't identify, try temporarily disabling WiFi on all your devices. This should leave only the suspect device on the list, and you can safely examine its settings without fear of blocking the device you're trying to access.
Methods for blocking uninvited guests
Once you've identified the intruder, you need to disconnect them immediately. The simplest, but temporary, method is to change your WiFi password. This will disconnect all devices, and you'll have to reconnect them with the new key. This is guaranteed to kick out all intruders, but it takes time to reset.
A more professional approach is to use Blacklist (blacklist) or Whitelist (whitelist) in the router settings. You specify the intruder's MAC address in the blacklist, and the router permanently blocks their connection, even if the WiFi password remains the same.
Whitelist mode (MAC filtering) is a security "nuclear weapon." In this mode, the router allows connections ONLY to devices whose MAC addresses are manually added to the list. Even if someone learns your password, they won't be able to connect because their device isn't authorized.
☑️ WiFi Security Checklist
⚠️ Attention: Be extremely careful with MAC filtering (whitelisting). If you sell your phone or buy a new laptop, they won't be able to connect to the network until you physically access the router and whitelist their addresses.
Security settings to prevent reconnections
It's not enough to just throw out a neighbor; you need to close the door they entered through. Often the cause is the function WPS, which allows you to connect to the network with the press of a button or via a PIN code. This technology has vulnerabilities that allow password guessing. It is recommended to find the section in the settings WPS and set the value Disable or Off.
It's also worth checking the encryption type. Outdated standards WEP and even WPA (without the number 2) are hacked in a matter of minutes. Make sure that in the section Wireless Security encryption selected WPA2-PSK (AES) or modern WPA3, if your hardware supports it.
Don't forget about your router's administrator password. Many users leave the default password (admin/admin), which allows anyone connected to the WiFi network to access and change the settings. Change the password for accessing the web interface to a strong and unique one.
What should I do if my router won't let me change the settings?
If you can't access your router settings (the password doesn't work), the attacker may have already changed them. In this case, locate the Reset button on the router and press it for 10-15 seconds (the router must be turned on). This will reset the device to factory settings, allowing you to set it up again from scratch.
Frequently Asked Questions (FAQ)
Can my neighbor see my files if he is connected to WiFi?
By default, modern operating systems (Windows 10/11, macOS, Android) ask when connecting to a new network: "Do you want this computer to be discovered?" If you answer "No" (public network), your files are hidden. However, if you have an older OS or have a HomeGroup configured with shared access, theoretically you can access shared folders. It's best to change the password immediately.
Why does "Unknown" or "Non-associated" appear in the device list?
It's not always hackers. "Non-associated" often means that the device is trying to connect, but the process isn't complete yet (for example, you just entered the password on your phone). "Unknown" could be a device that isn't broadcasting its hostname or some specific smart device (sensors, relays). Check the MAC address: if it matches the sticker on your smart kettle, there's nothing to worry about.
Does having one of my neighbor's phones connected affect my internet speed?
Yes, it does. WiFi is a half-duplex channel, meaning devices take turns speaking. The more devices there are on the air, the more time the router spends coordinating, and the less airtime each one gets. Furthermore, if a neighbor starts downloading torrents or watching 4K video, they'll eat up a significant portion of your bandwidth, especially on 2.4 GHz channels.
How can I view the connection history if the device has already been disconnected?
Typical home routers rarely store detailed connection history (logs) after the device has been disconnected, as the device's memory is limited. In the logs (section System Log or Event log) you can see login attempts or authorization errors, but it's difficult to find a complete list of "who was here yesterday." Advanced systems (for example, based on Mikrotik or OpenWrt) or proxy servers.