How to view Wi-Fi history on a Keenetic router: all methods

Monitoring connected devices and analyzing activity on your home network is a key aspect of cybersecurity. Routers Keenetic (including models Extra, Giga, Ultra (and others) provide tools for monitoring connection history, but not all users know where to find this data. Unlike enterprise solutions, home routers don't store a full traffic history, but they do allow you to track active and recently connected devices, as well as security events.

In this article we will look at, what information exactly can be extracted from Keenetic, how do the capabilities of different firmware differ (NDMS And KeeneticOS), and why data may sometimes be missing. We'll also explain how to correctly interpret the event log and what to do if the history is suddenly cleared.

⚠️ Important: Functionality depends on the firmware version and router model. For example, older devices on NDMS (before 2018) do not support extended connection logging. Check the software version in System → Updates.

1. What Wi-Fi history can I view on Keenetic?

Routers Keenetic do not lead full internet traffic log (as corporate firewalls do), but they record three types of data:

• 📱 List of connected devices — active and recently disabled gadgets (MAC addresses, IP, host names).
• 📜 System Event Log — records of connections/disconnections, authentication failures, settings changes.
• 🔍 Traffic statistics — the volume of downloaded/sent data by devices (only in firmware) KeeneticOS 3.x and newer).

For example, if you suspect that someone has connected to your network, you can find login attempts from an unknown source in the log. MAC addresses or frequent authentication errors. However, The router does not save the history of visited websites or specific user actions - for this you need specialized programs (for example, Pi-hole or OpenWRT with module nlbwmon).

⚠️ Attention: Connection data is stored in the router's RAM and is reset upon reboot. To preserve the history for a long time, configure logging to be sent to an external server (available in KeeneticOS through System → Logs → Settings).

2. Method 1: View active and recently connected devices

The fastest way to see what devices are using your Wi-Fi is to go to the section My Network. Displayed here:

• 🖥️ Connected via cable (LAN).
• 📶 Connected via Wi-Fi (indicating the standard: 2.4 GHz or 5 GHz).
• 🔄 Devices that have been online in the last week (tab "Recently connected").

Step-by-step instructions:

1. Open the router's web interface at http://192.168.1.1 (or my.keenetic.net).
2. Log in (default logins: admin/admin or admin/empty password).
3. Go to My Network → Devices.
4. Click on the tab All devices or "Recently connected".

Make sure you know all the MAC addresses.

Please note devices with non-standard names (e.g. "android_123456")

Check the last connection time for each gadget

Mark devices with unusually high traffic (if statistics are available)

-->

🔎 How to recognize other people's devices? Focus on:

• 🆔 MAC address — the first 6 characters indicate the manufacturer (for example, B8:27:EB — Raspberry Pi, 3C:5A:B4 — Google). Check unknown addresses using services like MAC Vendors Lookup.
• 📅 Connection time — If the device appears at night or in your absence, this is a reason to be wary.
• 📊 Traffic - abnormally high data consumption may indicate a virus or password leak.

Once a week

Only if I notice problems with the internet

Never checked

Other-->

3. Method 2: Analyze the event log

Event Log (System → Logs) contains records about:

• 🔑 Successful and unsuccessful attempts to connect to Wi-Fi.
• ⚡ Changes to router settings (for example, changing the password).
• ⚠️ Critical errors (overheating, DHCP failures).

How to read logs:

1. Go to System → Logs → Event Log.
2. Filter entries by type "Wi-Fi" or "Authentication".
3. Please note the lines with:

[Wi-Fi] The device with MAC address XX:XX:XX:XX:XX:XX has connected to the network "MyWiFi_5G"
[Authentication] Connection attempt failed from XX:XX:XX:XX:XX:XX (incorrect password)

⚠️ Attention: Logs in Keenetic are stored for a limited time (from a few hours to a day, depending on the model). To preserve them for a long time, set up export to email or an external server. System → Logs → Settings.

4. Method 3: Traffic statistics by device

In the firmware KeeneticOS 3.x and newer, detailed traffic statistics are available. It shows:

• 📈 Total volume of downloaded/uploaded data each device.
• 🕒 Traffic distribution by time (peak activity hours).
• 🌍 Top visited domains (only for devices using router DNS).

How to enable and view statistics:

1. Go to Statistics → Traffic.
2. Activate the option Enable statistics collection (if it is disabled).
3. Select the period (day/week/month) and device for analysis.

📊 Example of data interpretation:

• If smart speaker It consumes 500 MB per day, and usually - 50 MB, it may have been hacked for cryptocurrency mining.
• Activity children's tablet at night may indicate bypassing parental controls.
• A sharp jump in traffic on TV often associated with automatic firmware updates.

Why might statistics not be displayed?

Statistics are collected only for devices that receive an IP from a DHCP router (if the device has a static IP, data may be missing).

In old firmware (NDMS) this feature is missing - requires an update to KeeneticOS.

If the router is overloaded, the traffic history is reset (data is stored in RAM).

5. How to save your connection history for a long time

By default Keenetic Doesn't archive logs or statistics. To save data:

• 📧 Export to email:
1. Go to System → Logs → Settings.
2. Turn on Send logs by email.
3. Specify the recipient's address and sending frequency (for example, once a day).
• 🖥️ Saving to an external server (for advanced users):
1. Set up syslog-server (for example, on Raspberry Pi or in the cloud).
2. IN System → Logs → Settings Specify the server IP address and port 514.

📱 Mobile application Keenetic:

1. Install the app from App Store or Google Play.
2. Enable notifications about new connections in settings.

🔧 Alternative option: Use third-party network monitoring programs, such as:

• Wireshark - for deep traffic analysis (requires skills).
• GlassWire — visualization of device activity in real time.
• Fing — network scanning and notifications about new devices.

6. Common problems and solutions

Problem 1: There are no connection entries in the log.

Solution:

• Check if log collection is enabled in System → Logs → Settings.
• Update your router firmware (older versions may not save logs).
• Make sure that the device was connected to this particular router (and not to a repeater or Mesh node).

Problem 2: History is cleared after reboot.

Solution: Set up automatic log export (see section 5). In the firmware KeeneticOS 3.6+ There is an option to save logs to a USB drive (connect the flash drive to the router and activate the function in the settings).

Problem 3: Not all devices are displayed in traffic statistics.

Solution:

• Make sure that the device receives an IP from the DHCP router (and does not have a static IP).
• Check if statistics collection is disabled in Statistics → Settings.
• Restart your router and device, the data should appear within 5-10 minutes.

7. Security: What to do if a suspicious device is detected

If you find an unknown device in the list of connected devices or logs MAC address, follow the algorithm:

1. Block your device:

Go to My Network → Devices, find the suspicious gadget and click "Block"Alternatively, add his MAC to the blacklist in Wi-Fi → MAC Address Filter.

2. Change your Wi-Fi password:

Use a complex password (example: K3!nEt1c_R0ut3r_2026). Change it to Wi-Fi → Access Point → Security Settings.

3. Enable additional security measures:
• 🔒 Turn it off WPS (vulnerable to hacking).
• 🛡️ Activate MAC address filtering (allow only known devices to connect).
• 🌐 Change the security standard with WPA2 on WPA3 (available in KeeneticOS 3.5+).

Check your router for hacking:

Go to System → Users and make sure that it is only your account (admin). If unknown users appear, perform a factory reset (System → Configuration → Reset).

⚠️ Attention: If a suspicious device continues to appear on the network after blocking it, your router may be compromised. In this case:

1. Reset to factory settings.
2. Update your firmware to the latest version.
3. Change your admin panel password (do not use admin/admin).

FAQ: Answers to Frequently Asked Questions

Is it possible to view the history of visited websites on Keenetic?

No, routers Keenetic They don't keep a log of visited websites. This requires:

• Specialized firmware (eg. OpenWRT with module nlbwmon).
• Third-party DNS servers (eg. NextDNS or AdGuard Home).
• Parental control programs (eg Kaspersky Safe Kids).

Limited information can be obtained through DNS query statistics in Statistics → DNS (available in KeeneticOS 3.x).

How to find out what device is hidden behind a MAC address?

Use services to determine the manufacturer by MAC:

• MAC Vendors Lookup — will show the brand of the device.
• Arul John’s MAC Address Lookup — more detailed information.

If the MAC address belongs to Apple, Samsung or Xiaomi, but the device is unfamiliar to you, this is a reason to check the network for "guests".

How long are logs stored in Keenetic?

The storage period depends on the router model and load:

• Budget models (For example, Keenetic Lite): 1–12 hours.
• Flagships (For example, Keenetic Ultra): up to 24–48 hours.
• When exporting to email/server: unlimited.

To increase the retention period, disable unnecessary log entries (for example, Informational messages) V System → Logs → Settings.

Is it possible to restore history after resetting the router?
No, when resetting the settings (System → Configuration → Reset) all logs and statistics are permanently deleted. To avoid data loss:
• Export logs to email regularly.
• Use external monitoring systems (eg. PRTG Network Monitor).
• Save screenshots or text copies of critical entries.
Why are unknown domains shown in traffic statistics?
This is normal - many devices access:
• Cloud services (For example, googleapis.com for Android).
• Update servers (For example, update.microsoft.com).
• Advertising networks (For example, doubleclick.net).

If you are confused by specific domains, check them through VirusTotal or URLScan.