A sudden drop in internet speed or a blinking activity light on your router can be the first warning sign for any home network owner. In the digital age, access to your Wi-Fi β this isn't just a way to access the internet, but also a potential threat to personal data security. Uninvited guests can not only steal traffic but also attack connected devices using software vulnerabilities.
Understanding who is actually on your network is a basic digital hygiene skill. Many users aren't even aware that the password set when purchasing a router is often a default one and easily cracked by attackers. Checking the list of connected clients is the first step to securing your digital perimeter.
There are several effective methods for identifying illegal devices in your system. From a simple visual inspection of indicators to using specialized software, the choice of method depends on your technical expertise and the type of equipment you have. We'll review all available options so you can choose the most appropriate one for your situation.
Visual diagnostics and indirect signs of burglary
Before delving into the complex settings of the admin panel, it's worth paying attention to obvious signs that even an inexperienced user can spot. The first sign of the presence of unauthorized devices is often unstable internet connection. If connection speeds drop for no apparent reason, and the provider doesn't report maintenance, this is cause for concern.
Pay attention to the indicators on the front panel of the router. The light responsible for wireless communication (usually labeled as WLAN, Wireless (or an antenna icon) may be acting suspiciously. When you're not actively downloading files or watching videos on your devices, it may flash frequently and erratically, indicating that other clients are transmitting data.
It's also worth analyzing the behavior of your devices. If your smartphone or laptop suddenly heats up, drains quickly, or starts to lag when browsing the internet, it's possible your connection is overloaded with third-party traffic. Cryptocurrency mining or downloading large amounts of data without you noticing can put a significant strain on your hardware.
β οΈ Attention: Indirect signs don't guarantee a hack. Failures can be caused by interference from neighboring networks, physical wear and tear on the router, or issues on the provider's end. Only a client list check will provide a definitive answer.
For an initial assessment, you can temporarily disconnect all your devices from Wi-Fi and observe the router's indicators. If the activity light continues to flash rapidly, there are definitely active connections on the network that aren't coming from you.
Checking via the router's web interface
The most reliable and accurate way to find out who's using your Wi-Fi is to log into your router's control panel. This method doesn't require installing any additional software and provides comprehensive information about each connected client, including MAC addresses and connection type.
First, you need to find the IP address of the default gateway. On Windows devices, you can do this by opening the command prompt and entering the command ipconfigFind the line "Default Gateway" - most often this is the address 192.168.0.1 or 192.168.1.1Enter this address into the address bar of any browser.
After entering your login and password (often by default this is admin/admin(unless you've changed them) the main menu will open. Interfaces vary by manufacturer, but the logic remains the same. You need to find a section that might be called "Client List," "Status," "Wireless Statistics," or "DHCP Server List."
This section displays a table of all devices currently online or that have recently received an IP address. You'll see MAC addresses and possibly hostnames. By comparing this data with your existing devices, you can easily identify an intruder. An unknown device actively transmitting data is a clear sign of an intruder.
βοΈ Check via web interface
Using mobile apps for monitoring
Modern smartphones allow you to turn your device into a powerful network analysis tool. There are numerous apps that scan a Wi-Fi network and display a detailed list of all connected nodes. This is convenient because it doesn't require a computer.
One of the most popular tools is the application Fing. Once the scan starts, it not only shows IP and MAC addresses, but also tries to determine the manufacturer of the device (for example, Apple, Samsung, Intel). This makes identification much easier, as you can immediately see that an "Unknown Device" with an address starting with a certain prefix is ββactually your smart TV.
Other applications such as Network Scanner or WiFi Analyzer, offer similar functionality. They allow you to see the signal strength of each device, which helps you determine the physical location of the "intruder." If the signal from someone else's device is very strong, it means the intruder is very close, perhaps in a neighboring apartment.
Scanning occurs by sending requests to all nodes on the local network and analyzing the responses.
Why might the app not see all devices?
Some routers have a client isolation feature that prevents devices on the network from "seeing" each other. In this case, the mobile app will only show the router itself and your phone, even if there are other devices on the network. For a full check, it's best to use the web interface.
MAC address table analysis and device identification
The key to identifying intruders is knowing how to read MAC addresses. This is a unique identifier for a network interface, consisting of 12 hexadecimal digits (e.g., A1:B2:C3:D4:E5:F6). The first six characters (OUI) indicate the equipment manufacturer.
Knowing the manufacturer can help you quickly filter out your devices. For example, if you see a device from HuaweiIf you don't have a phone of this brand, it's worth considering. However, modern gadgets often use MAC address randomization to protect privacy, which can make identification more difficult.
Below is a table to help you decipher the main parts of a MAC address and understand what to look for when analyzing the list:
| Part of the address | Example | Meaning | What to look out for |
|---|---|---|---|
| First 3 bytes (OUI) | 00:1A:2B |
Manufacturer code | Does the brand match your devices? |
| Last 3 bytes | CC:DD:EE |
Unique device number | Does it change when reconnecting? |
| Address type | Global / Local | Factory or random | Randomized addresses may change |
| Status | Active / Idle | Online activity | High activity without your participation |
When reviewing your list, make a list of all your devices: smartphones, tablets, laptops, smart lamps, TVs, and game consoles. Users often forget about older gadgets that automatically connect to the network and are listed as "dead souls."
β οΈ Attention: Some operating systems (iOS, Android, Windows 10/11) use random MAC addresses by default when connecting to new networks. This means the same device may appear in the router's list as two different clients with different addresses.
PC Software: Advanced Analysis
For users who want to conduct a deep analysis of traffic and connections, there are powerful utilities for personal computers. Wireless Network Watcher NirSoft's Network Scanner is one of the best free tools for Windows. It scans the network and produces a table report that can be sorted by any parameter.
Another professional tool is Angry IP ScannerThis cross-platform utility allows you to scan not only your local network but also check for open ports. This is useful for assessing the vulnerability of connected devices. If you see an open port, 23 (Telnet) or 21 (FTP) on an unknown device is a serious security hole.
Using the command line can also give quick results. In Windows, you can use the command arp -aIt will display a table of IP addresses corresponding to physical MAC addresses cached by your system. It's less informative than specialized software, but it works without installing any additional programs.
For a more in-depth analysis of traffic in real time, specialists use sniffers, for example, WiresharkHowever, working with them requires a deep knowledge of network protocols. A typical user will only need to see a list of active hosts to determine if there are any "extra" ones.
Methods of protection and blocking uninvited guests
If the scan confirms your suspicions and you've detected someone else's device, you need to act immediately. The simplest, but not the most effective, method is to temporarily disable the Wi-Fi module through the admin panel. This will break the connection, but the attacker will be able to reconnect as soon as you enable the module.
The most effective way is MAC address filteringIn your router settings (Wireless MAC Filtering section), you can enable "Allow" mode and whitelist only the MAC addresses of your trusted devices. All others, even with the password, will be unable to connect. However, this method is labor-intensive: when you buy a new device, you'll have to manually add its address to the router settings.
The most reliable and secure option is to change your Wi-Fi network password. Go to your wireless security settings (Wireless Security) and set a new, complex password. Use encryption. WPA2-PSK or WPA3, avoiding the outdated and unsafe WEPAfter changing the password, all devices will be disabled, and you will have to re-enter the new key on each device.
It is also recommended to disable the function WPS (Wi-Fi Protected Setup). This technology, designed to simplify connection, has critical vulnerabilities that allow someone to brute-force a PIN and gain access to the network in a matter of hours, even without knowing the password.
What to do if a neighbor asks for a password?
The best way to give your neighbor internet access without revealing your main password is to enable a guest network. This feature is available in almost all modern routers. A guest network creates a separate SSID with its own password and typically restricts access to local resources (printers, NAS storage). You can change the guest network password or disable it at any time without affecting your main devices.
Can a hacker steal my passwords via Wi-Fi?
If the network is unsecured or uses weak encryption (WEP), it's theoretically possible to intercept traffic. However, modern websites use the HTTPS protocol, which encrypts data between the browser and the website. Even if an attacker intercepts packets, they won't be able to read your bank or email logins and passwords without performing complex MITM (Man-in-the-Middle) attacks, which require a high level of skill and specialized software.
Why does the router show more devices than I have?
This could be due to several factors. First, some smart devices (such as plugs and lamps) have two network interfaces or create virtual adapters. Second, as mentioned, MAC address randomization in smartphones can create the illusion of multiple devices. Third, the list may still contain "entries" of previously connected devices (DHCP leases) that are now offline. Always monitor the "Online" status or data transfer activity.
Does the number of connected devices affect the speed?
Yes, the Wi-Fi channel is shared among all active clients. If one user (yours or someone else's) starts downloading large files or watching 4K videos, the speed for everyone else will drop significantly. Furthermore, the router itself has a limit on the number of simultaneous connections it can handle. Overloading the router's processor with multiple devices leads to increased ping and packet loss.