A sudden drop in internet speed or unstable network performance are often the first signs that an uninvited guest has connected to your Wi-Fi. Equipment owners MikroTik They offer powerful traffic monitoring tools, but beginners can find it difficult to navigate the plethora of features. Unlike simple home routers, where the client list is located on the main page, these require a more in-depth approach.
The network administrator needs to understand that wireless network security It starts with monitoring active connections. If you suspect your neighbors are using your bandwidth, you can't ignore it—it's not just a loss of traffic, but also a potential threat to your data. Modern models, such as MikroTik hAP or RB-series, allow you to track each device in detail.
In this article we will take a detailed look at How to accurately identify MAC addresses connected devices and separate them from the router's system services. We'll cover both the WinBox graphical interface and the command line so you can choose the most convenient network auditing method right now.
Using the WinBox utility for monitoring
The most convenient and professional way to manage your equipment MikroTik is the use of a proprietary utility WinBoxIt provides more detailed information than the web interface and works faster. First, download the program from the official website and connect to the router via MAC address or IP.
After authorization, go to the menu WirelessHere you will see a list of all wireless interfaces. Double-click on the desired interface (usually it is called wlan1 or wifi1) to open the properties window. In the window that opens, find the button Registration Table — it contains a list of all authorized clients.
The registration table displays MAC addresses, connection uptime, signal, and data transfer rate. You can sort the list by signal strength (Rx Signal) to determine how far away the device is. If the signal level is very low (for example, -90 dBm), the device is most likely located outside the apartment.
Pay attention to the column AuthorizedIf there's a check mark, the device has successfully authenticated. An unchecked check mark may indicate a connection attempt or problems with the encryption key. Regularly checking this table is the best habit for maintaining order on your network.
Analysis via web interface (QuickSet and RouterOS)
If installing additional software is not possible, you can use the built-in web interface. Open a browser and enter the router's IP address (by default 192.168.88.1). After logging in RouterOS You will be greeted by an interface, the appearance of which depends on the installed firmware version and the selected profile.
In new versions RouterOS v7 with interface QuickSet Information is often displayed on the main dashboard. Look for the "Wireless Clients" or "Connected Devices" widget. However, for complete technical information, it's best to switch to the classic view by clicking the "Advanced Mode" button or selecting the corresponding menu item.
Web interface navigation may differ from WinBox. You need to find the section Wireless in the left menu, then double-click on the interface and select the tab RegistrationA similar table is displayed here, but without the deep real-time filtering capabilities found in the desktop version.
⚠️ Note: The web interface may not update in real time. Click the "Refresh" button or refresh your browser to see the latest list of connections, especially if the device has just been disconnected.
For users who prefer minimalism, there's also a simplified interface, but it hides many important details, such as noise levels and specific encryption protocols. Therefore, for troubleshooting problems It is recommended to use the full interface, even if it looks more complicated.
Checking via DHCP Leases
An alternative and very effective way to see everyone who is on the network is to look at the address lease table DHCP ServerThis method is good because it shows not only wireless but also wired connections, giving a complete picture of the router's load.
To do this, go to the menu IP → DHCP Server and open the tab LeasesHere you'll see a list of all IP addresses assigned to devices by the router. The "Bound" status means the device is active and has a valid address lease.
The advantage of this method is that it often displays Host Name devices (for example, "iPhone-Oleg" or "Samsung-TV"), making it easier to identify the owner. In the Wireless table, you only see MAC addresses, making it difficult to guess whose phone is connected.
| Parameter | Description | Where to watch |
|---|---|---|
| MAC Address | Unique identifier of the network card | Wireless / DHCP |
| Address | The assigned IP address | DHCP Leases |
| Signal Strength | Signal strength (WiFi only) | Registration Table |
| Uptime | Continuous connection time | Registration Table |
If you see a device with a "Waiting" status or an unknown MAC address that isn't on your list of trusted devices, this is cause for concern. You can also see the lease expiration time in the DHCP table (Expires After), which helps you understand how long the device will stay online.
☑️ Network security check
Identifying devices by MAC address
The hardest part of an audit is figuring out who owns what. MAC addressAddresses consist of 12 hexadecimal characters, where the first six characters (OUI) identify the network equipment manufacturer. Knowing the manufacturer allows you to narrow your search.
For example, if the address starts with 00:1A:2B, it could be Apple, and if with B8:27:EB - most likely it is Raspberry Pi or a chip-based device BroadcomThere are online OUI databases where you can enter the first three blocks of your address.
However, modern devices often use the function Randomized MAC Address (MAC address randomization) to protect privacy. This allows the phone to pretend to be a random device each time it connects to a new network, making it difficult to identify the manufacturer.
What is MAC address randomization?
This is a security feature in iOS and Android that generates a random MAC address instead of the actual hardware address when connecting to Wi-Fi. This prevents user tracking but complicates MAC filtering on the router.
For accurate identification, it is best to physically disconnect suspicious devices from the network (turn off Wi-Fi on the phone) and see if the entry in the table disappears. Registration TableThis is the most reliable method and does not require complex calculations.
Blocking unwanted clients
If you find a device that should not have access to the network, you should block it immediately. MikroTik this is done through Access List. Go to the menu Wireless → tab Access List.
Create a new rule by clicking the button +In the field MAC Address Enter the address of the offender. In the field Comment You can write "Blocked Neighbor." The most important thing is to check the box. Disabled (if you want to temporarily block) or, more correctly, configure the rule so that it blocks the connection.
In current versions of RouterOS, the Access List logic functions as an allow/deny list. To block a specific MAC address, create a rule with that address and set the action to "reject," or simply don't create an allow rule if you have a "deny by default" policy.
⚠️ Important: When setting up an Access List, be careful not to accidentally block your own devices. Always double-check the MAC address before applying rules.
Changing your Wi-Fi password is also an effective method. After changing the WPA2 key, all devices will be disconnected, and you'll have to re-enter the password on all trusted devices. This is a radical, but 100% effective method.
Setting up notifications and logging
Advanced users can log connection events. You can configure your router to send you an email or Telegram message every time a new connection is established. This requires setting up scripts in the section System → Scripts.
The script can track the appearance of new entries in Wireless LogTo do this, go to the logging settings (System → Logging) You need to enable wireless network logging. This will allow you to retrospectively analyze who connected and when, even if you weren't at your computer at the time.
However, it's worth remembering that storing detailed logs takes up disk space or router memory. For home networks MikroTik with a small amount of memory (RAM) Excessive logging can lead to buffer overflows and loss of other important system messages.
Use this feature wisely, setting filters only for critical events, such as multiple failed login attempts that may indicate password compromise.
Frequently Asked Questions (FAQ)
Why do I see devices named "unknown" in the connections list?
This happens if the device doesn't broadcast its hostname or if the router can't resolve the name via DNS. This is often the case for IoT devices (light bulbs, sockets) or gadgets with network discovery disabled.
Can my neighbor see my password if I haven't changed it from the factory default?
Yes, factory passwords are often published in open sources. If you use a default password, anyone within range can easily find it online and connect to your network.
Does the number of connected devices affect internet speed?
Absolutely. The Wi-Fi channel is shared among all active users. If your neighbor is downloading torrents, your browsing speed may drop to a crawl, even if your ISP plan allows for higher speeds.
How often should I change my MikroTik Wi-Fi password?
It's recommended to change your password if you suspect a hack or if you've shared it with guests who no longer need access. For a home network with a secure, complex password, frequent password changes aren't necessary if you control the client list.