Internet instability is often frustrating, but few people consider that the cause may not be hardware failure, but rather someone else's. If you notice 4K video loading with buffering, or online games lagging for no apparent reason, it's worth checking your list of connected devices. router It can simultaneously service dozens of gadgets, and it only takes a couple of minutes for an attacker to quietly connect to an open or weak network.
Understanding how to see who is using your WiFi is essential not only for restoring speed, but also for ensuring cybersecurityAn outsider on a local network can access shared folders, printers, and, in some cases, intercept transmitted data. In this article, we'll explore all the symptoms of an intrusion, diagnostic methods through the admin panel and mobile apps, and methods for reliably protecting the perimeter of your home network.
Indirect signs of unauthorized access
The first sign of trouble is often abnormal behavior of network equipment. When a new client connects to the access point, the router redistributes bandwidth. If you have a limited-speed plan or the network is overloaded, this will be immediately noticeable. However, it's important to keep in mind that a drop in speed can also be caused by technical issues with your provider, so you shouldn't rely on just one symptom.
Pay attention to the indicators on the router body. Light WLAN The wireless network icon usually flashes when data is being transferred. If all your devices are turned off or in sleep mode, and the indicator continues to flash rapidly and erratically, this is a sure sign of active background activity. Someone is downloading files, watching videos, or using your connection for other purposes.
⚠️ Caution: Don't confuse background updates of your smartphone's operating systems with malicious activity. Windows and Android often download updates automatically, which can also cause indicator lights to flash.
Another sign may be an inability to access the router settings. Some advanced users who have gained access to the network may try changing the administrator password to gain control of the system. If your default password no longer works, a factory reset doesn't help, or the settings keep changing, this is a critical situation that requires immediate attention.
- 📉 A sharp drop in internet speed when there are no active downloads on your end.
- 💡 The Wi-Fi indicator blinks rapidly when all your devices are turned off.
- 🔒 Block access to the router's web interface or change the administrator password.
- 📱 Unknown devices appearing in Bluetooth or local area network (SMB) lists.
Checking via the router's web interface
The most reliable and accurate way to find out who's connected to your Wi-Fi is to delve into the "brains" of your router. The web interface contains complete information about all active DHCP clientsTo do this, you will need the default gateway address, which is usually indicated on a sticker on the bottom of the device (often 192.168.0.1 or 192.168.1.1), and a login and password.
After authorization, you need to find the section related to the wireless network. Depending on the model and firmware (TP-Link, ASUS, D-Link, Keenetic), this section may have different names. Look for tabs such as "Wireless," "Status," "Client List," or "Network Map." This displays the MAC addresses of all devices currently connected to the network.
To determine which device is yours and which is not, check the MAC addresses. Each network adapter has a unique identifier. You can find the MAC address of your phone in Settings (About Phone -> Status) or your computer (command ipconfig /all (in the command line). All other addresses on the list are potential violators.
Some modern routers not only allow you to view the list but also instantly block access to an unwanted guest directly from the interface by adding their MAC address to the "Blacklist." This action will immediately terminate the connection, even if the attacker knows the password.
Using specialized programs
If you find accessing your router settings difficult or the interface too confusing, you can use third-party software. There are PC utilities and smartphone apps that scan your local network and display a clear list of all active nodes. Such programs are often called "network scanners."
One of the most popular programs for Windows is Wireless Network Watcher from NirSoft. It requires no installation, works quickly, and displays the IP address, MAC address, network equipment manufacturer, and device name. The Android equivalent is the app Fing, which allows you to conduct a deep network analysis directly from your phone while connected to Wi-Fi.
The advantage of such snails is their level of detail. They can show not only the connection itself, but also open ports and the operating system of the connected device. This helps us understand who exactly is using the network: whether it's neighbors with smartphones or someone running a brute-force password script from a laptop.
⚠️ Warning: Download network scanners only from the official websites of their developers. There are many counterfeit versions online, which may themselves be malware.
When using mobile apps, make sure your smartphone is connected to the specific Wi-Fi network you want to scan. Scanners operate within the local network and cannot "see" clients of another router over the internet unless you have access to its admin panel.
Analysis of device indicators and logs
A more in-depth level of diagnostics involves working with the router's system logs. Unlike the list of current clients, logs show the history of events. Here you can see the time at which new devices connected, even if they have now disconnected. This is useful for identifying "night guests."
To access the logs, go to the section System Tools -> System LogThe entries may look like technical text, but keywords will help you navigate. Look for entries with the words "Associated," "Joined," or "DHCP Ack." Next to them, you'll see the MAC address of the device that successfully authenticated to the network.
If you see multiple login attempts from different MAC addresses within a short period of time, this may indicate the presence of brute-force attacks attempting to guess your password. In this case, a standard password change may not help unless the encryption algorithm has been modified.
What is WPS and why should it be disabled?
WPS (Wi-Fi Protected Setup) is a simplified connection technology. It has a vulnerability that allows someone to brute-force the PIN code within a few hours. If your logs show numerous WPS requests, disable this feature in your router settings immediately.
It's also worth paying attention to the router's processor load. In advanced models (for example, MikroTik or Ubiquiti) you can see the CPU load graph. Sharp spikes in load without any active user activity often indicate that someone is using your channel for mining or setting up a botnet.
Comparison of intruder detection methods
Different verification methods have their advantages and disadvantages. The choice depends on your technical expertise and the urgency of the situation. Below is a table to help you understand the effectiveness of each approach.
| Verification method | Data accuracy | Complexity | Necessary rights |
|---|---|---|---|
| Router web interface | 100% (First-hand data) | Average | Administrator password |
| Network scanners (Fing, WNWatcher) | High (Visible active nodes) | Low | Wi-Fi access |
| Analysis of indicators | Low (Only the fact of activity) | Very low | Physical access |
| System logs | High (Connection History) | High | Administrator password |
A combination of methods provides the most complete picture. For example, if you notice blinking lights, you can check the network using the app on your phone, and then use the web interface to block or change settings. This approach ensures you don't miss any details and can respond quickly to changes.
It's important to understand that software scanners only show what your network adapter sees. If an attacker uses stealth techniques (MAC address spoofing or stealth scanning), simple utilities may miss them. In this case, only log analysis on the router's end can save the day.
Measures to protect and block connections
Once you've detected an intruder, you need to immediately block their access. The simplest, but not the most reliable, way is to change the Wi-Fi password. This will disconnect all users, and you'll have to reconnect your devices. However, if the password was guessed automatically, simply changing it to a similar one won't help.
It's more effective to use MAC address filtering. In your router settings (Wireless -> MAC Filter) You can enable the "Whitelist" mode (Allow listed only). In this case, only devices whose MAC addresses you manually enter into the table will be able to connect to the network. All others, even with the password, will be denied access.
☑️ Action plan if a hack is detected
Don't forget to check the encryption type. It's an outdated standard. WEP breaks in minutes. Make sure you have it installed. WPA2-PSK (AES) or the newest WPA3Also, change the password for logging into the router itself (admin), as standard passwords like "admin/admin" are known to all hackers.
⚠️ Note: Router interfaces are constantly updated by manufacturers. The layout of menu items may differ from those described. Always consult the instructions for your specific model.
Regularly updating your router firmware is another important step. Manufacturers patch vulnerabilities in new software versions. If your router supports automatic updates, enable this feature. This will protect your network from known exploits that could be used for unauthorized access.
Frequently Asked Questions (FAQ)
Can my neighbor see my files via Wi-Fi?
If you have "Network discovery" and file sharing enabled in your Windows or macOS settings and your network profile is set to "Private" or "Home," your neighbor can theoretically see your shared folders. However, without your account password, they won't be able to open protected files. It's recommended to set your Wi-Fi profile to "Public."
What should I do if I changed my password and my speed hasn't increased?
The problem may not be with strangers, but rather with channel congestion from neighboring routers or a malfunctioning ISP. Try changing the Wi-Fi channel in your router settings (select 1, 6, or 11 for 2.4 GHz) or rebooting your modem. Also, check your connection cable.
Is it dangerous to leave a guest network on?
A guest network isolates guests from your main local network, which is safe for your files. However, it still uses your internet bandwidth. If you give your guests a password, they may consume bandwidth. It's best to enable the guest network only when guests arrive and disable it afterwards.
How do I find out my device's MAC address?
On Windows, open the command prompt and type ipconfig /all, find the line "Physical Address". On Android: Settings -> About phone -> StatusOn iOS: Settings -> General -> About (Wi-Fi address).