How to check and block unauthorized Wi-Fi connections

Has your Wi-Fi suddenly become slower than usual? Are pages taking longer to load, and are videos constantly freezing? Perhaps unauthorized devices have connected to your network—your neighbors, random passersby, or even hackers exploiting router vulnerabilities. According to Kaspersky LabOne in five home routers in Russia has weak security settings, making them an easy target for unauthorized access.

In this article you will learn how check the list of connected devices, identify other people's gadgets among them and block them foreverWe will examine both software methods (via the router's web interface or mobile apps) and advanced methods, such as analysis ARP tables or traffic monitoring using WiresharkWe'll also find out why even a "hidden" network doesn't guarantee security and how to properly configure encryption to prevent repeat hacks.

1. Signs of an unauthorized Wi-Fi connection

Before rushing to check your router, pay attention to indirect signs that may indicate a traffic leak:

• 📉 A sharp drop in speed — especially in the evening, when neighbors are actively using the Internet.
• 🔄 The router is overheating — increased load on the processor due to unnecessary connections leads to heating of the case.
• 🔌 The WAN/Wi-Fi indicator blinks faster - Even when you are not using the network, the light actively signals data transfer.
• 📱 Unknown devices on the network — for example, in the list of connected gadgets appear Android_1234 or iPhone-5s-789, which you don't have.

One of the most obvious signs is traffic limit exceeded (if you have a limited plan). For example, you usually use 10 GB per month, but suddenly 50 GB "disappeared" in a week. You can check your current usage in your provider's personal account or through the mobile app (for Rostelecom, Beeline, MTS and other operators have such tools).

⚠️ Attention: Some viruses on connected devices (for example, Android botnets) can disguise their traffic as legitimate. If speeds haven't returned after blocking all unauthorized devices, check your devices for malware.

2. Checking connected devices via the router's web interface

The most reliable way to identify "outsiders" is to access your router's control panel. To do this:

1. Open your browser and enter your router's IP address in the address bar. This is usually 192.168.0.1 or 192.168.1.1 (The exact address is indicated on the sticker on the back of the device).
2. Enter your login and password (by default it is often admin/admin, but it’s better to use your own data).
3. Go to the section with the list of connected devices. The path may vary depending on your router model:
   • 🔹 TP-Link: Wireless Mode → Wireless Mode Statistics
   • 🔹 ASUS: Network Map → Clients
   • 🔹 Keenetic: Devices → Device List
   • 🔹 Zyxel: Network → Active Devices

The list will show all devices connected to your network—both via cable and Wi-Fi. Please note:

• 🆔 MAC addresses (unique device identifier, such as 00:1A:2B:3C:4D:5E).
• 📱 Device names (sometimes they give out a model, for example iPad-Pro-11).
• 🕒 Connection time - If the device appears at night when you are sleeping, it is suspicious.

Copy its MAC address|Check if it is connected to your guest networks|Block it in your router settings|Change your Wi-Fi password-->

⚠️ Attention: Some routers (eg. MikroTik) may show devices in the list that were previously connected but are now disconnected. To see only active connections, look for the column Status or Online.

3. How to distinguish your device from someone else's

It's not always easy to determine which device on the list is yours and which isn't. Here are a few ways:

• 📋 Compare MAC AddressesYou can find out the MAC address of your phone, laptop, or tablet like this:
  • 📱 Android: Settings → About phone → General information → Wi-Fi MAC address
  • 🍎 iPhone/iPad: Settings → General → About → Wi-Fi Address
  • 💻 Windows: run the command ipconfig /all V Command line and find the line Physical address.
• 🔍 Check device namesModern gadgets are often displayed with self-explanatory names (for example, Galaxy-S22-Ultra or MacBook-Pro-14). If there is a list android_dd8f3a or unknown_device - this is a reason to be wary.
• 🕵️ Turn off all your devices and see which connections remain. To do this, you can temporarily disable Wi-Fi on all devices or turn off the router for 5 minutes (then turn it on and quickly check the list).

If you live in an apartment building, there's a good chance your neighbors accidentally connected to your network because their router was broken and your Wi-Fi was passwordless or simply encrypted (WEP). According to statistics, 30% of home networks in Russia use passwords like "12345678" or "qwerty," which can be cracked in seconds.

4. Advanced Verification Methods: ARP Table and Wireshark

If your router's web interface doesn't show a full list of devices (or you suspect a hacker is disguising themselves), you can use more in-depth network analysis methods.

Method 1: View the ARP table

ARP table (Address Resolution Protocol) contains the IP and MAC addresses of all devices on the local network. To view it:

• 🖥️ On Windows: open Command line and enter:

  arp -a

  In the results, look for unknown IPs (for example, 192.168.1.100) and the MAC addresses associated with them.

• 🐧 On Linux/macOS: execute:

  arp -n

  Flag -n will show addresses in numerical format without accessing DNS.

Method 2: Monitoring traffic in Wireshark

Wireshark — is a professional network packet analyzer. It allows you to not only see all connected devices but also analyze their traffic consumption. Instructions:

1. Download Wireshark With official website and install.
2. Launch the program, select the network interface (Wi-Fi adapter) and click Start.
3. Enter in the filter wlan.addr == [your_MAC]to filter out your devices.
4. Look for suspicious activity, such as large numbers of packets sent to unknown IP addresses or ports.

Method 3: Network Scanner (Mobile Apps)

For a quick check, you can use the following applications:

• 📱 Fing (Android/iOS) - shows all devices on the network, their MAC, manufacturer and open ports.
• 📱 Network Analyzer — allows you to carry out ping- scan and detect hidden gadgets.
• 📱 WiFi Guard — specializes in searching for unauthorized connections.

These programs are convenient because they don't require access to the router—all you need to do is connect to the same Wi-Fi network as the suspicious device.

5. How to block someone else's device on the network

If you find an "intruder," you need to disable it immediately. Here's how:

Method 1: Blocking by MAC address

Most routers allow you to create a MAC address blacklist. Here are instructions for popular models:

• 🔧 TP-Link:
  1. Go to Wireless Mode → MAC Filtering.
  2. Select Disable station with the specified MAC.
  3. Add the address to the list and save the settings.

🔧 ASUS:

1. Open Local Network → DHCP Server.
2. In the section Reservation list Find the MAC address of someone else's device and set its status Blocked.

Method 2: Change your Wi-Fi password

The most radical but effective way is change the network passwordAfter this, all devices will disconnect, and only those you share the new password with will be able to connect. Recommendations:

• 🔐 Use a password that is long at least 12 characters with letters, numbers and special characters (for example, Wifi@Home_2026!Kot).
• 🚫 Do not use personal information (dates of birth, pet names).
• 🔄 Change your password every 3-6 months.

Method 3: Disabling WPS

WPS Wi-Fi Protected Setup (Wi-Fi Protected Setup) is a feature for quickly connecting devices using a PIN code. It's convenient, but extremely insecure: bruteforcing the PIN code takes several hours. Disable WPS in the router settings (usually in the section Wireless Mode → WPS).

6. How to protect your Wi-Fi from repeated hacks

Blocking other people's devices is a half-measure. To prevent new connections, you need to strengthen network security:

• 🔒 Use WPA3 encryption (or at least WPA2-PSK). WEP And WPA hacked in minutes.
• 📛 Hide your SSID (network name). This isn't a panacea, but it will reduce the number of accidental connections. The option is called Hide SSID or Hide SSID.
• 🛡️ Enable guest network For friends. It's isolated from the main network and has a separate password.
• 🔄 Update your router firmwareManufacturers regularly patch vulnerabilities (for example, in 2023, a critical flaw was found in routers) TP-Link Archer C50).
• 🚪 Disable remote access to the router control panel (optional) Remote Management).

If your router supports VLAN (virtual networks), you can separate traffic into groups—for example, for smart devices, guests, and primary devices. This will make it more difficult for hackers, even if they connect to the network.

⚠️ Attention: Some providers (eg Rostelecom or Dom.ru) block access to router settings if it's rented. In this case, contact support and ask them to update the firmware or change the password.

7. What to do if the hacker is already online

If you suspect that not just a neighbor, but an intruder has connected to your network (for example, traffic is going to suspicious IPs or ports), proceed as follows:

1. 🛑 Disconnect your internet immediately (You can remove the cable from the router or disable WAN in the settings).
2. 🔍 Check your router for backdoorsSome viruses (eg. VPNFilter) change DNS servers. In the router settings, make sure the DNS is specified as 8.8.8.8 (Google) or 1.1.1.1 (Cloudflare).
3. 🔄 Reset your router to factory settings (button Reset on the back panel). Then set it up again with a new password.
4. 📋 Check connected devices for viruses. Use antivirus software (Kaspersky Internet Security, Dr.Web) or utilities like Malwarebytes.

If problems persist after resetting the router, it may be compromised at the firmware level. In this case:

• Update your firmware to the latest version from OpenWRT (alternative OS for routers).
• Buy a new router (if your model is outdated and no longer supported by the manufacturer).

Signs that your router has been hacked

- Unknown rules have appeared in the settings Port Forwarding.

- Traffic goes to IP in China, USA or other countries (checked in Wireshark).

- The router spontaneously reboots or changes settings.

- Devices with MAC addresses starting with appear on the network. 00:0C:29 or 00:1C:14 (often used by bots).

FAQ: Frequently Asked Questions about Wi-Fi Security

❓ Is it possible to find out who is connected to my Wi-Fi?

It's impossible to accurately determine the identity of a device's owner using its MAC address or IP address. However, it is possible:

• Find out the device manufacturer by the first 3 bytes of MAC (for example, 00:1A:79 - This Zyxel).
• See which provider the IP address belongs to (via the service WHOIS).
• If you suspect a neighbor, temporarily turn off Wi-Fi and observe their reaction.

❓ Why does my device show up on the network as "unknown"?

This can happen for several reasons:

• The device does not broadcast its name (for example, some smart bulbs or cameras).
• The display of names is disabled in the router settings (option Hide Hostnames).
• The device uses a random MAC address (function MAC Randomization V Android 10+ And iOS 14+).

To fix this, try reconnecting the device or manually assigning it a name in the router settings.

❓ Can a hacker connect to my Wi-Fi if the password is complex?

Yes, even with a strong password attacks are possible:

• 🔓 Firmware vulnerabilities - for example, a gap Kr00k allowed encryption to be bypassed WPA2 on some routers.
• 🕵️ Phishing — an attacker can create a fake network with a name similar to yours and intercept your password.
• 📡 Evil Twin Attack - a hacker clones your network and forces devices to connect to it.

Protection: Update your firmware regularly, disable WPS and use VPN for critical operations (e.g. internet banking).

❓ How do I check my Wi-Fi for viruses?

The network itself cannot be "infected", but viruses can be:

• 🖥️ On connected devices (check with antivirus software).
• 🔧 In the router firmware (update it or reflash it to OpenWRT).
• 🌐 On fake DNS servers (check your router settings to make sure reliable DNS servers are specified, like 8.8.8.8).

If traffic is going to suspicious sites, use Wireshark or GlassWire for analysis.

❓ Should I use MAC address filtering?

MAC filtering is weak protection because:

• 🔄 MAC address is easy to forge (spoof).
• 📱 Modern devices (Android 10+, iOS 14+) randomly change MAC when connecting.
• 🔧 When adding a new gadget, you will have to manually update the list of allowed addresses.

Better to focus on strong password, WPA3 And regular updates.