Administering a wireless network is impossible without a clear understanding of who is on the air. Router owners Mikrotik Often, users need to check the current status of connections, identify unknown devices, or analyze channel load. Standard client monitoring methods in RouterOS provide deep technical data that goes far beyond a simple list of IP addresses.
Monitoring system in RouterOS Allows you to see not only MAC addresses but also signal strength, connection speed, and encryption type for each node. This is critical for diagnosing coverage issues or detecting unauthorized access attempts. Unlike consumer routers, the administrator has access to raw radio channel statistics in real time.
There are several ways to obtain this information: through a graphical interface WinBox, web console WebFig or command line TerminalEach method has its advantages depending on the task: a quick check or a thorough security audit. The choice of tool depends on the specialist's level of training and the availability of a graphical interface.
Using the WinBox interface for monitoring
The most popular tool for working with equipment Mikrotik the utility remains WinBoxIt provides native connectivity and the most comprehensive access to system functions. To view the client list, open the menu. Wireless and go to the tab Interfaces.
After selecting the desired interface (usually it is wlan1 or wifi1 in new models) you should press the button Connect or double-click on the interface. This will open the properties window, where we're interested in the tab RegistrationThis is where a table of all authorized devices that are currently connected to the access point is displayed.
This window displays key parameters: MAC address, IP address, connection uptime and, most importantly, the indicator Rx/Tx RateThis data allows you to instantly assess connection quality. If you see low data transfer speeds on a client with a good signal, this may indicate interference or driver issues on the user's end.
- 📡 Signal Strength: shows the received signal level in dBm (the closer to 0, the better, for example -40 is better than -80).
- 🔒 Encryption: Displays the encryption method used by a particular client (TKIP, CCMP, AES).
- ⏱ Uptime: the time elapsed since the device was successfully authorized on the network.
- 📶 Channel Width: the width of the channel on which the client operates (20MHz, 40MHz, 80MHz).
⚠️ Attention: The Registration tab only shows active connections. If a device is in sleep mode or has lost connection, it will disappear from this list, even if its IP address is reserved in DHCP.
For a more detailed analysis, you can use the sorting function by clicking on the column header. For example, sorting by column Signal This will help you quickly locate devices located at the edge of your coverage area. This is useful when planning the placement of additional access points or repeaters.
Monitoring via the WebFig web interface
Web interface WebFig is a built-in alternative to WinBox and is accessible through any browser. It's especially convenient when installing specialized software isn't possible or access from a mobile device is required. The operating logic is similar, but the data visualization is adapted to web standards.
To see the list of clients, go to the menu Wireless in the left navigation panel. Select the appropriate wireless network interface. In the window that opens, you will see a list of registered stations. In newer versions RouterOS v7 The interface has become more informative and responsive.
One of WebFig's useful features is the ability to quickly block a client directly from the list. By clicking the block icon next to the MAC address, the administrator can instantly terminate the connection and add the device to the list. Access List with a ban rule. This is an effective method for dealing with uninvited guests without having to delve into the settings.
The interface also allows you to filter the displayed data. You can adjust the visibility of columns, displaying only those relevant to the current diagnostic session. This makes it easier to understand the information on low-resolution screens or when working from a distance.
Terminal Commands for Advanced Users
For process automation and work via SSH or console port, it is indispensable TerminalThe command line provides the most flexible tools for filtering and displaying data. The basic command for viewing connections is simple but contains all the necessary information.
To get a list of all registered clients on the interface wlan1 use the following construction:
/interface wireless registration-table printHowever, the standard output can be too verbose. To get only MAC addresses and signal levels, filtering out unnecessary information, use the command with parameters. where and field selection. This allows you to create scripts for logging or integration with external monitoring systems (Zabbix, Grafana).
Example command to output a short report:
/interface wireless registration-table print where interface=wlan1It is also useful to use the command monitor for monitoring a specific interface in real time. It displays the number of registered clients, noise level, and channel load without the need for constant table updates.
- 📝 Print: Basic command to print a static list of current connections.
- 🔍 Find: Search for a specific device by MAC address or comment in the table.
- 🚫 Remove: command to forcefully disconnect a client (kick) by its ID in the table.
- 📊 Monitor: Real-time mode for tracking radio broadcast statistics.
⚠️ Attention: When using the delete commands (
remove) Be extremely careful. You can accidentally disable your own control device if you don't check the MAC address before executing the command.
DHCP Leases Analysis as an Alternative Method
Often, an administrator needs to know not only about those currently transmitting data, but also about all devices that have received an IP address. For this, a table is used. DHCP LeasesThis method is less accurate in terms of WiFi connection status (a client may have an IP address but not yet connected to WiFi, or, conversely, may have a static IP address), but it provides a general picture of the network.
Go to the menu IP → DHCP Server and open the tab LeasesHere you will see a list of all issued addresses. Status bound means the lease is active. To determine which device is wireless, you can use MAC address prefixes (OUI) or static entries.
An important feature is the ability to create a static entry (Make Static) directly from this table. By fixing the address, you ensure that the device always receives the same IP address, simplifying firewall and port forwarding configuration.
| Parameter | Description | Where to watch |
|---|---|---|
| MAC Address | Physical address of the network card | Wireless / DHCP |
| Address | The assigned IP address | DHCP Leases |
| Client ID | Client ID (often hostname) | DHCP Leases |
| Expires After | Time until IP lease expiration | DHCP Leases |
Using DHCP in conjunction with Wireless tables allows for cross-checking of data. If a device is listed in DHCP but not in Wireless Registration, it may be connected via cable or in sleep mode.
☑️ Network security check
Setting up an Access List to control access
Simply looking at a list of clients is not enough - they need to be managed. The tool Access List on the menu Wireless Allows you to create rules that apply to devices before or during their connection. This is a powerful filtering mechanism that works faster than firewall rules.
You can create a rule that denies connections to any devices whose MAC addresses are not whitelisted. To do this, create an action entry. reject or disconnect, where the MAC address field specifies a pattern or a specific address, and the priority is configured accordingly.
Access List also allows you to assign specific security profiles or limit the speed (Rate Limit) for specific user groups. For example, guests can be automatically assigned a profile with limited access to local network resources.
When adding a new rule, the system checks them in order from top to bottom. The first match determines the fate of the connection. Therefore, the order of rules is critical value: Allow rules for trusted devices should be placed above general deny rules.
What is Privilege Level in Access List?
Privilege Level determines the client's access rights. Devices with the 'read' level can only obtain an IP address but cannot initiate connections to certain router services, which is useful for guest networks.
Diagnosing connection problems
If the expected devices are missing from the client list or there are persistent disconnections, troubleshooting is necessary. Log analysis should always be the first step. Go to System → Log and filter messages by topic wireless.
Here you can see the reasons for authorization refusals: incorrect password, incompatible encryption protocols, or association table overflow. A common issue is clients using outdated security standards that conflict with modern access point settings.
It's also worth checking your frequency plan settings. If the channel is overloaded with neighboring networks, devices may constantly reconnect in search of a better signal. Using the tool Scan in the Wireless menu will help you find a free frequency.
- 🔎 Log Analysis: Search for "association failed" or "disconnected" errors.
- 📡 Channel Utilization: Checking the airtime congestion of neighboring networks.
- 🔋 Power Settings: Check if there is a limitation on the transmit power (Tx Power).
- 🔄 Reboot: In rare cases, rebooting the radio module without rebooting the entire router helps.
⚠️ Attention: Interfaces and menu names may differ slightly depending on the version. RouterOS (v6 or v7) and the type of hardware board installed (Chipset). Always check the official documentation for your specific hardware.
Frequently Asked Questions (FAQ)
Why can't I see connected devices in the Registration tab?
You're most likely looking at the wrong interface or it's disabled. Make sure the wireless module is active (green LED) and you've selected the correct SSID in the interface list. Also, check to see if the SSID is hidden, although this won't affect the display in Registration if the client is already connected.
Is it possible to see the WiFi password of a connected client?
No, Mikrotik (Like any other equipment) does not store or display client passwords in cleartext. Passwords are used only during the handshake to encrypt traffic. Hashes may be displayed in logs, but it is impossible to recover the original password from them.
How to block a specific user by MAC address?
The fastest way is to find it in the list Wireless → Registration, right-click (or the corresponding button in WebFig) and select "Make Static" with the "Disabled" checkbox checked or add it to Access List with the "Reject" action.
Does the number of connected clients affect internet speed?
Yes, each active client shares the radio bandwidth. Furthermore, a large number of clients (even sleeping ones) creates a load on the router's processor due to processing service packets (beacon frames), which can reduce overall network performance.