A sudden drop in internet speed or a blinking wireless indicator on your router are often the first signs that someone else has connected to your Wi-Fi network. A neighbor who has "borrowed" your password or an attacker using your traffic for illegal purposes can significantly slow down your entire home network. It's important to understand that even if you changed your password a year ago, modern technology allows hackers to brute-force access keys or intercept them through vulnerabilities in encryption protocols.
Self-diagnosis doesn't require in-depth knowledge of networking technologies, but it does require attention and consistency. In this article, we'll cover all available methods: from using mobile apps to deeply configuring the router itself. You'll learn not only how to identify uninvited guests but also how to block their access and prevent future intrusions.
Before we get into the technical details, it's worth noting that detection speed depends on your hardware model. Older routers may not display the names of connected devices, showing only the MAC address character set, while modern ones TP-Link, ASUS or Keenetic have user-friendly interfaces with clear gadget names. Be prepared to assume the role of network administrator for your home.
⚠️ Important: If you find a device you can't identify, don't rush to change the password. First, try disabling the internet connection on that device through the router settings and see whose phone or laptop stops working.
Analysis of indicators and primary diagnostics
The simplest, though not the most accurate, way to suspect something is wrong is to monitor the physical indicators on the router's body. The light responsible for wireless data transmission (usually marked with an antenna symbol or the words "WLAN/Wi-Fi") should blink in sync with your activity. If you've turned off all your devices and the indicator continues to blink frequently and erratically, this is a sure sign of background network activity.
However, relying solely on lights isn't an option, as modern routers can flicker due to background system updates or service packets. A more reliable initial test is a speed test. Run a speed test on your device when no one in your family is using the internet. If the provider's advertised speed is significantly lower than the actual speed, and you're confident there are no technical issues with the service provider, it means the channel is being overloaded by an external load.
For a more accurate diagnosis, you can use specialized utilities on your computer that scan the local network. Programs such as Advanced IP Scanner or Wireless Network Watcher, can display a list of all active hosts in seconds. This is faster than digging into your router's settings and provides instant results.
- 📶 Pay attention to the frequency of the Wi-Fi indicator blinking when personal gadgets are turned off.
- 💻 Use Speedtest to measure your actual speed and compare it with your provider's plan.
- 🔍 Scan your network with utilities like Fing or Advanced IP Scanner for a quick list of devices.
Checking connected devices via the router's web interface
The most reliable way to find out who's using your Wi-Fi is to log into your router's admin panel. This is where the ultimate authority is: the DHCP client table or the Wireless Clients list. To log in, you'll need the gateway IP address, which is usually the default. 192.168.0.1 or 192.168.1.1, as well as the administrator login and password.
Interfaces vary from manufacturer to manufacturer, but the search logic is the same. You need to find the section related to the wireless network (Wireless) or network status (Status). In modern models ASUS This is often the Network Map tab, where all connected nodes are visually displayed. TP-Link The section you're looking for may be called "Wireless Statistics" or "DHCP Client List." In routers Keenetic You should look in the "Client List" section on the main page or in the Wi-Fi menu.
The list will show MAC addresses and possibly device names. If you see an unfamiliar MAC address, compare it with the addresses of your devices. You can find your phone's MAC address in the settings: "About phone" -> "General information." If the router list includes a device that doesn't belong to you or your household, it means unauthorized access is available.
☑️ Browser verification algorithm
Keep in mind that some smart devices may have strange names, such as "Espressif" or "Tuya," which are common for light bulbs and outlets. Don't block them immediately without understanding the problem. It's best to temporarily unplug the router and plug it back in, observing which device in the list disappears last or appears first.
Using mobile apps for monitoring
In the age of smartphones, there's no need to turn on your computer every time you check your network. Router manufacturers and independent developers have created powerful apps that allow you to manage your network directly from your phone. Official apps, such as Tether (for TP-Link), ASUS Router or My.Keenetic, provide complete control: you can see the names of devices, their traffic consumption rates, and instantly block access with one click.
If there's no official app or it's inconvenient, universal scanners come to the rescue. The leader in this niche is the app FingIt not only displays a list of all devices on the network but also identifies their type (TV, phone, printer), manufacturer, and operating system. This significantly simplifies identification: instead of a simple MAC address, you'll see "Samsung TV" or "Unknown Device."
Using mobile internet (3G/4G), you won't see devices inside your local network unless your router is configured specifically for remote access, which is rare.
⚠️ Note: The app and web interfaces are constantly being updated. If you can't find the button you need, check the official instructions on your router manufacturer's website, as the menu layout may vary between firmware versions.
Why does the app show "Unknown"?
Apps often fail to identify the device manufacturer if the MAC address doesn't have a standard prefix or if the device uses MAC address randomization to protect privacy (a feature found in iOS and Android). In this case, consider the connection time and the amount of data consumed.
Table: Comparison of detection methods
To help you choose the right monitoring method, we've prepared a comparison chart. It will help you understand the pros and cons of each method depending on your situation and technical savvy.
| Method | Data accuracy | Complexity | Necessary conditions |
|---|---|---|---|
| Router web interface | 100% (Official data) | Average | Administrator password, browser |
| Mobile application (Fing, etc.) | High | Low | Smartphone, Wi-Fi connection |
| Command Prompt (CMD) | Medium (IP/MAC only) | High | PC, basic knowledge of commands |
| Monitoring indicators | Low (only the fact of activity) | Low | Visual access to the router |
As the table shows, the golden mean is using mobile scanner apps, which combine simplicity and high information content. However, taking more drastic measures, such as completely blocking by MAC address, will still require accessing the router settings.
Using the Command Prompt for Advanced Users
For those who prefer tools without a graphical interface or don't have access to the router's web interface, there's a method for checking via the Windows command line. This method allows you to view the ARP (Address Resolution Protocol) table, which stores the mappings between IP addresses and physical MAC addresses of devices with which your computer has recently communicated.
To use this method, open the command prompt. Press the key combination Win + R, enter cmd and press Enter. In the black window that opens, enter the command arp -aYou'll see a list of IP addresses and their corresponding MAC addresses. However, there's a catch: you'll only see devices with which your PC has directly communicated or that are on the same subnet and active.
C:\Users\User>arp -aInterface: 192.168.1.5 --- 0x3
Internet Address Physical Address Type
192.168.1.1 00-1a-2b-3c-4d-5e dynamic
192.168.1.15 a1-b2-c3-d4-e5-f6 dynamic
192.168.1.255 ff-ff-ff-ff-ff-ff static
This method is good for a quick check, but it won't provide a complete picture if your computer simply doesn't "see" some devices on the local network. Therefore, for a full audit, it's better to use specialized software or a web interface.
How to block an intruder and protect your network
Once you've identified the intruder, you need to block them immediately. The most effective method is MAC address filtering. In your router settings, find the "Wireless MAC Filtering" section. Add the intruder's MAC address to the blacklist (Deny/Block). After that, even with the password, the device won't be able to connect.
However, blocking is a temporary measure. An attacker can simply spoof their device's MAC address to one allowed on your network. The only 100% solution is to completely change the Wi-Fi network passwordWhen you change your password, all devices will be disabled, and you'll have to re-enter the new key on all your devices. This is inconvenient, but necessary for security.
Also check what encryption protocol is being used. If you have WEP or WPA/TKIP, change them immediately to WPA2-PSK (AES) or WPA3Old protocols can be cracked in minutes using automated scripts. Make sure WPS (Wi-Fi Protected Setup) is disabled, as it often presents a security hole that allows passwords to be bypassed.
- 🔒 Change the router administrator password from the factory default (admin/admin) to a complex and unique one.
- 🚫 Disable the WPS function in your wireless network settings.
- 🛡️ Use WPA2-AES or WPA3 encryption, abandoning the legacy WEP.
⚠️ Note: After changing your Wi-Fi password, all your devices (TVs, phones, smart speakers) will lose their connection. Be prepared to reconfigure each one with the new password.
Frequently Asked Questions (FAQ)
Can my neighbor find out my password if I'm on WPA2?
Theoretically, WPA2 can be cracked by brute-force if the password is simple (for example, a date of birth or 12345678). A complex password consisting of letters, numbers, and special characters longer than 12 characters is virtually impossible to crack by brute-force in a reasonable amount of time. However, the password can be stolen if it was saved on a guest device that was subsequently hacked, or through a WPS vulnerability.
Why is there "Unknown" or "Non-Associated" in the device list?
The "Non-Associated" status usually means the device was once connected but is now out of range or turned off, but its entry remains in the DHCP cache. "Unknown" most often means the router can't determine the manufacturer by its MAC address. This is normal for many Chinese smart home gadgets or new phone models.
Does my ISP see who is connected to my Wi-Fi?
Your ISP sees all traffic passing through your router, but it doesn't see the internal structure of your local network (which devices within your home are communicating with each other). However, it does see the number of simultaneous connections and traffic volume. If you violate your contract (for example, by sharing internet for commercial purposes or downloading illegal content), your ISP may be able to detect it, but the specific MAC addresses of your phones are generally of no interest to them and are not directly visible without deep packet analysis.
What should I do if my speed hasn't increased after changing my password?
If you've changed your password and blocked all unknown users, but your speed remains low, the problem may not be Wi-Fi hijacking. Check your ISP cable; it may be damaged. Try rebooting your router. Speed may also drop due to router overheating, outdated firmware, or interference from neighboring networks on the same frequency. In this case, changing the Wi-Fi channel in the router settings may help.