How to Find Out Who's Connected to Your Wi-Fi Router: 7 Proven Methods

Have you noticed that your internet has become slower and your data is running out early? Perhaps your Wi-Fi router third-party devices connected without your knowledge. According to the research KasperskyEvery fifth router in Russia has vulnerabilities that allow attackers to access your network. But how can you accurately determine who's using your Wi-Fi and block access to unwanted guests?

In this article, we will look at all the current methods for checking connected devices - from standard tools in the router's web interface to specialized applications for Android And iOSYou'll learn how to distinguish legitimate gadgets from fake ones, why some devices may appear with unknown names, and what to do if you detect a suspicious connection. And also— How to identify "invisible" users who mask their online presence.

1. Checking via the router's web interface (universal method)

The most reliable way is to access your router's control panel. This method works on all models, from budget ones TP-Link TL-WR841N to the flagship ASUS RT-AX88UAll you need is a browser and access to your router.

Instructions:

• 🌐 Enter in the address bar of your browser 192.168.1.1 or 192.168.0.1 (less often - 192.168.100.1). The address is usually indicated on the router sticker.
• 🔑 Enter your login and password (by default it is often admin/admin or admin/password).
• 📊 Find the section with the device list. Depending on the firmware version, it may be called:
  • DHCP → DHCP Clients (TP-Link, Mercusys)
  • Local Network → Client List (Keenetic)
  • Network Map → Devices (ASUS)
  • Connected Devices (Xiaomi, Tenda)

The table will display all connected gadgets with the following information:

⚠️ Attention: If the list contains devices with names like Unknown, android-XXXX or unfamiliar MAC addresses are cause for concern. But first, check whether they belong to your guests or smart devices (e.g., Xiaomi Mi Home or Amazon Echo).

2. Using mobile applications (for Android and iOS)

If accessing your router settings is inconvenient, you can use specialized apps. They scan the network and display all connected devices directly on your smartphone screen.

Top 5 verified apps:

• 📱 Fing (Android/iOS) — identifies the device manufacturer by MAC address, shows open ports.
• 🛡️ WiFi Guard (Android) — compares current connections with the "white list" of your gadgets.
• 🔍 NetScan (iOS) - scans the network and saves connection history.
• 📊 IP Tools (Android) - in addition to the list of devices, it shows their connection speed.
• 🔒 GlassWire (Android/iOS) — monitors the traffic of each device in real time.

Example of work Fing:

1. Install the application and open it.
2. Click Scan — the program will automatically detect your network.
3. After 10-30 seconds, a list of devices will appear indicating:
   • Manufacturer (eg Apple, Samsung).
   • MAC addresses.
   • Time of last activity.

⚠️ Attention: Some applications (eg. WiFi Guard) require you to manually whitelist your devices. Without this, they will mark all devices as suspicious.

3. Windows Command Prompt (for advanced users)

If you prefer to work without a graphical interface, you can use the built-in tools. WindowsThis method does not require installation of additional software and works on all OS versions starting from Windows 7.

Instructions:

1. Open Command line as administrator (Win + X → Command Prompt (Administrator)).
2. Enter the command to view the ARP table:

   arp -a

   It will show all IP and MAC addresses of devices with which your PC has interacted.

3. For more detailed information, use:

   net view

   or for modern systems:

   Get-NetNeighbor | Format-Table -AutoSize

   (V PowerShell).

Explanation of findings:

• 🔹 Internet Address — The IP address of the device on your network.
• 🔹 Physical Address — MAC address.
• 🔹 Type — address type (dynamic or static).

⚠️ Attention: Team arp -a Shows only those devices your PC has interacted with in the last 2-15 minutes. For a complete list, it's best to use a network scanner, such as Advanced IP Scanner.

How to find out the manufacturer by MAC address?

The first 6 characters of the MAC address (OUI) indicate the manufacturer. For example:

- 00:1A:79 — Apple

- 00:0D:4B — MSI

- 78:31:C1 — Xiaomi

You can check on the website MAC Vendors or through the command getmac /v /fo list in Windows.

4. Traffic analysis using specialized software

If you need to not only see a list of devices but also understand how much traffic they consume, use network monitoring software. They will show which websites connected devices visit, how much data they transfer, and even identify hidden threats (for example, botnets or mining viruses).

Best programs for analysis:

Example of working with Wireshark:

1. Download and install the program from the official website.
2. Select a network interface (Wi-Fi or Ethernet).
3. Start packet capture (Start).
4. Enter in the filter wlan.addr == 00:1A:2B:3C:4D:5E (replace with the suspicious MAC address) to track the traffic of a specific device.

⚠️ Attention: Usage Wireshark On other people's networks (for example, in a cafe or office), it may violate security policies. At home, it's safe.

Make sure it doesn't belong to your household|Check the MAC address through the manufacturer's database|Scan it for viruses (if it's your PC)|Evaluate the amount of traffic it's consuming|Try disabling it temporarily and check the network speed-->

5. How to distinguish your devices from others

Often gadgets with unknown names appear in the list of connected devices, for example ESP_123456 or LEDE-APThese aren't necessarily malicious users—they could be:

• 📺 Smart TVs (Samsung Smart TV, LG WebOS).
• 💡 Smart bulbs (Xiaomi Yeelight, Philips Hue).
• 🔊 Speakers and headphones (JBL, Sonos).
• 🤖 Robot vacuum cleaners (Roborock, iRobot).
• 🖨️ Printers and MFPs (Canon, HP).

How to identify your gadgets:

1. Disconnect all known devices from Wi-Fi (or turn them off).
2. Refresh the list of connected clients in the router.
3. The remaining devices are either someone else's or "smart" technology that doesn't disconnect from the network.
4. Check the MAC addresses of the remaining gadgets through the manufacturer database (see spoiler above).

💡 Helpful tip: Take a photo or save the list of MAC addresses of your devices in a safe place (for example, in Google Keep). This will allow you to quickly compare your current connections with the reference list.

6. What to do if a suspicious device is detected

If you find an unfamiliar gadget online, follow these steps:

1. MAC address blocking:
   • Go to the router settings section Wireless → MAC Filtering.
   • Add the suspicious MAC address to the blacklist.
   • Save the settings and reboot the router.
2. Changing your Wi-Fi password:
   • Go to Wireless → Security.
   • Select encryption type WPA2-PSK or WPA3-PSK.
   • Create a complex password (at least 12 characters with numbers and special characters).
3. Disabling WPS:
   • WPS is vulnerable to brute-force attacks. Disable it. Wireless → WPS.

Hiding the SSID (not recommended as a primary measure):

• IN Wireless → Basic disable the option Enable SSID Broadcast.
• ⚠️ This won't protect you from experienced hackers, but it will reduce the number of accidental connections.

⚠️ Attention: If after blocking a suspicious device the network speed is not restored, it is possible that there is an issue with your network. DNS spoofing or ARP attackIn this case, resetting the router to factory settings and completely reconfiguring it will help.

7. How to identify "invisible" users (advanced methods)

Some attackers disguise their presence on the network by spoofing MAC addresses or using techniques ARP spoofingLet's look at how to detect them.

Method 1: Monitoring the ARP Table

Enter in the command line:

arp -a > arp1.txt
ping -n 10 192.168.1.255
arp -a > arp2.txt
fc arp1.txt arp2.txt

If new MAC addresses appear in the output, there are devices on the network that are not displayed in the standard router list.

Method 2: Analyze DHCP logs

Find the section in your router settings System Log or DHCP LogLook for records like this:

DHCP: Assign IP 192.168.1.103 to MAC 00:1A:2B:3C:4D:5E

Compare them with the list of current connections - discrepancies will indicate "ghost" devices.

Method 3: Port Scanner

Use Nmap to scan a local network:

nmap -sn 192.168.1.0/24

This command will show all active hosts, even those that are not displayed in the router's web interface.

⚠️ Attention: If you find a device on the network with a MAC address that matches the address of your router (for example, 00:0C:43:XX:XX:XX for some models ASUS), this could be a sign MITM attacks (Man in the middle) Reset your router immediately and set it up again.

Signs of a hacked router

- Unknown port forwarding rules (Port Forwarding).

- Changed DNS servers (not 8.8.8.8 or your provider).

- Unexpected firmware updates.

- Constant load on the router's processor (checked in System Status).

FAQ: Frequently asked questions about connected devices

Is it possible to find out which websites a suspicious device is visiting?
Yes, but for this you need:
1. Install alternative firmware on the router (DD-WRT, OpenWRT).
2. Or use the program Wireshark on a PC connected to the network.

⚠️ Without the user's consent, this may violate the law on personal data (Federal Law No. 152).

Why does my phone appear twice in the list of devices?

It's normal if:

• You are connected via both Wi-Fi and cable (for example, via USB-tethering).
• You have it turned on Wi-Fi Direct or Hotspot.
• The phone uses dual Wi-Fi (2.4 GHz + 5 GHz simultaneously).

How to block a device permanently?

Add its MAC address to the blacklist (MAC Filtering) And:

• Enable IP to MAC binding (Static DHCP).
• Disable the feature WPS.
• Update your router firmware to the latest version.

Can my neighbor connect to my Wi-Fi if I hide the SSID?

Yes. Hiding the SSID doesn't protect against experienced users—they can connect even if they know the network name and password. This prevents accidental connections, not targeted hacking.

How can I check if my router has been hacked?

Signs of hacking:

• Unknown rules in Port Forwarding.
• Changed DNS servers (not your provider's).
• Unexpected firmware updates.
• High load on the router's CPU (checked in System Status).

🔹 Solution: Reset your router to factory settings and update the firmware.