When the internet slows down and pages load slowly, users often panic. Many immediately blame the internet provider or bad weather, forgetting about a more prosaic cause: unauthorized access to the wireless network. If neighbors or more experienced attackers crack your password, they can use your connection to download large files, which critically reduces your available speed.
However, a slow internet connection isn't the only or most alarming symptom. A far more dangerous situation is when someone has connected to your network with the intent of stealing personal data or installing malware. Checking connected devices This should become a regular procedure, similar to changing passwords on social media. Modern routers have powerful monitoring tools, but most people simply don't know where to look.
In this article, we'll take a detailed look at all the available methods for detecting "parasites" on your network. We'll cover both built-in router features and third-party utilities, and discuss methods that allow you to not only see the device but also instantly block its access. Understanding How does MAC addressing work? and IP in the local network will help you feel more confident in the digital space.
Symptoms of an unauthorized connection to the router
The first sign that your Wi-Fi is no longer private is an unexplained drop in speed. If you're paying for 100 Mbps but are actually getting 10-15 Mbps even when you're not actively downloading, you should be wary. It's especially suspicious if the activity lights on your router are flashing wildly, even though you're simply reading a text message or are away from home.
Another warning sign may be strange messages from your antivirus or firewall about connection attempts from the local network. Sometimes, the operating system may report an IP address conflict, which occurs when two devices attempt to occupy the same network space. This often happens if an attacker uses a static address already occupied by your printer or TV.
⚠️ Attention: Don't ignore sudden changes to your router settings if you notice that the administrator password or network name (SSID) has changed without your intervention. This is a clear sign that someone has gained complete control of your equipment.
The list of the main signs of an invasion is as follows:
- 📉 A sharp and constant decrease in internet speed for no apparent reason.
- 💡 The WLAN/Wi-Fi indicator on the router body blinks frequently when you are away.
- 🔒 Block access to router settings or change the administrator password.
- 📱 Unknown devices appear in the list of devices available for printing or media servers.
Using the router's built-in web interface
The most reliable and accurate way to find out who's using your Wi-Fi is to look directly into the "brains" of your router. Almost all modern models, whether TP-Link, ASUS, Keenetic or Mikrotik, have a built-in client list display feature. To do this, you'll need access to the control panel, which is usually done through a browser.
To access the settings, open any browser and enter your gateway's IP address in the address bar. Most often, this is 192.168.0.1 or 192.168.1.1The exact address, login, and default password are always indicated on a sticker located on the bottom or back of the device. If you've changed this information previously and have forgotten it, you may need to reset the router to factory settings.
After successful authorization, you need to find the section responsible for the wireless network or connection status. Depending on the model and firmware version, this section may have different names. Look for tabs with names like "Wireless," "WLAN," "Status," or "Network Map." This is where you'll find a list of all active connections.
Below is a table with sample section names for popular brands:
| Router brand | Section name in the menu | Path to the client list |
|---|---|---|
| TP-Link | Wireless | Wireless Statistics / DHCP Client List |
| ASUS | Network map | Click on the "Clients" square |
| Keenetic | Client list | Home / My Networks and Wi-Fi |
| D-Link | Status | Local Area Network / DHCP |
Analyzing the list of connected devices
Once in the desired section, you'll see a table or list containing information about all devices currently connected to the network. Typically, three key parameters are displayed here: MAC address, IP address, and device name (Hostname). The MAC address is a unique identifier for a network card, assigned by the manufacturer and unchanged throughout the life of the device (without special manipulation).
The hardest part for a beginner is figuring out which device is which. The router doesn't always correctly identify the device name, so instead of "iPhone-Ivan," you might see a string of characters like "Unknown" or simply the technical name of the chip. Identifying the gadgets will require some detective skills: turn off Wi-Fi on your phone and see which device has disappeared from the list, then check your laptop, TV, and smart plugs.
⚠️ Attention: Pay attention to the number of connections. If you have a smartphone, laptop, and TV set-top box in your home, and the list includes 10 devices, this is a clear sign of hacking. Some smart devices can create virtual adapters, but the number rarely exceeds 2-3 per device.
Pay special attention to devices with a "Static" IP address. Legitimate devices most often receive addresses dynamically via DHCP. If you see a device with a manually assigned IP address that you don't recognize, it could be a sign of an advanced user attempting to gain a foothold on the network.
☑️ Checking the client list
Specialized programs for network scanning
If logging into your router settings seems too complicated or the device's interface has been truncated by your ISP, third-party scanner programs can help. These utilities automatically scan your local network and provide detailed information about all detected nodes. One of the most popular and free tools is Fing, available for both mobile platforms and PCs.
Apps like Wireless Network Watcher or Angry IP Scanner They work on a similar principle. They send requests to all possible addresses in the subnet and wait for a response. Unlike a router, such programs can often identify the device manufacturer by the first digits of the MAC address, which greatly simplifies identification. For example, you'll immediately see that an unknown device is manufactured by Sony or Xiaomi.
Using scanners also allows you to see devices that are in sleep mode but still associated with an access point. However, it's important to remember that these programs only view the network from your device's perspective. If your router is configured for client isolation, the scanner may not see other devices, even though they are technically connected to the Wi-Fi network.
Is it possible to hide from scanners?
Yes, there are methods of hiding, such as using random MAC addresses (a feature available in iOS and Android) or deep traffic encryption, but it is practically impossible for the average user to completely disappear from the active router's ARP neighbor table.
Methods for blocking uninvited guests
Once you've identified the intruder, the question arises of eliminating them. The simplest, but less effective, method is to change the Wi-Fi password. This will disconnect all users, including your own devices, which will have to be reconnected. This is a "nuclear" option, guaranteed to reset everyone, but it requires time to reconfigure all the smart devices in the house.
A more precise and professional method is MAC address filteringThe router settings include a "MAC Filter" or "Blacklist/Whitelist" feature. Simply add the intruder's address to the blacklist, and the router will reject any connection attempts from that address at the driver level, even if the password is known. This eliminates the need to change the password or interrupt legitimate user sessions.
In some modern systems, such as Keenetic or firmware Asuswrt-MerlinA "Guest Network" feature with isolation has been implemented. If you suspect someone may have discovered your password but don't want to change the master key, you can temporarily enable guest access and move suspicious devices there, restricting their access to your personal files and printers.
Setting up maximum Wi-Fi network security
To eliminate the problem of "how to check who's connected to Wi-Fi," you need to build effective perimeter security. First and foremost, abandon outdated encryption standards. WEP and even WPAThe only relevant standard today is WPA2-Personal (AES) or new WPA3, if your hardware supports it. Old encryption methods break in minutes.
Password length and complexity are critical. An 8-character password can be brute-forced in a few hours. Use passphrases that are 12-15 characters long and include mixed-case letters, numbers, and special characters. It's also a good idea to disable the "Unlock" feature. WPS (Wi-Fi Protected Setup), as it is one of the biggest security holes in home routers, allowing the password to be bypassed via a PIN code.
⚠️ Attention: Interfaces and function names may vary depending on your router's firmware version. Manufacturers regularly update their software, changing the layout of menu elements. Always consult the official documentation for your specific model.
Don't forget to update your router firmware. Manufacturers regularly patch vulnerabilities that allow hackers to access your client list or change security settings. Automatic updates are the best protection against known exploits.
Frequently Asked Questions (FAQ)
Can my neighbor see my files if he is connected to Wi-Fi?
By default, home networks often have network discovery and file sharing enabled. If you don't have a guest network or client isolation configured, an attacker could theoretically attempt to access shared folders. However, if your devices have complex Windows/macOS login passwords and closed ports, direct access to the file system will be difficult, but the risk of traffic interception (if the site doesn't use HTTPS) remains.
Will hiding the network name (SSID) from strangers help?
Hiding your SSID (Broadcast SSID = Disable) only creates an illusion of security. The network will disappear from the list of available networks when searching on your phone, but anyone can see it using special packet sniffers. Furthermore, your devices will constantly send out requests to search for the hidden network, which can even drain your battery and make it easier to track your location.
What should I do if I can't access my router settings?
If standard addresses 192.168.0.1 or 192.168.1.1 If the router doesn't open, check that the correct gateway IP address is specified in your PC's network connection settings. If access is blocked by a changed administrator password, the only solution is to reset the router to factory settings using the Reset on the body (hold for 10-15 seconds when the power is on).
Does the number of connected devices affect the speed?
Yes, the Wi-Fi channel is shared among all active users. If 5-10 additional devices are connected to your network and actively consuming bandwidth (torrenting, 4K streaming), the speed on your devices will drop proportionally. Even if a "neighbor" is simply connected, they're taking up airtime, reducing the overall efficiency of the wireless connection.