A sudden drop in internet speed or unstable home network performance are often the first warning signs. You're paying for a 100 Mbps plan, but 4K video stutters and pages take forever to load. In such situations, the first suspicion is: has someone else connected to your Wi-Fi?
Neighbors who have forgotten their passwords or intruders using brute-force tools can quietly "trail" your connection. This not only slows down your connection but also compromises the security of personal data transmitted over the network.
Fortunately, modern routers provide convenient tools for monitoring activity. In this article, we'll explore detailed methods for accurately determining how many and which devices are currently using your hotspot, as well as how to quickly disable uninvited guests.
Symptoms of unauthorized connection and detection methods
Before messing with your router settings, it's worth paying attention to indirect signs. If your internet speed drops sharply in the evening when all your neighbors are online, that's no reason to panic. However, if lag persists even at night or when your own devices are turned off, the situation requires investigation.
One of the most reliable diagnostic methods is to monitor the indicators on the device. Many models have a WLAN or Wi-Fi light that flashes when data is being transferred. If all your devices are turned off or in airplane mode, and the indicator continues to flash rapidly and actively, it means something else is consuming your bandwidth.
For a more in-depth analysis, you can use specialized software that scans your local network. Such programs display not only IP addresses but also the MAC addresses of all visible nodes, allowing you to identify hidden connections that aren't visible in the standard list.
β οΈ Attention: Don't rely solely on the device names in the connection list. Attackers often change them. MAC address their network card with a name similar to a legitimate device (e.g. "iPhone-User") to remain undetected.
It is also worth considering that some "smart" devices, such as IoT sensors Devices like TVs and tablets can consume background traffic for updates, creating the illusion of unauthorized activity. Therefore, visual inspection via the web interface remains the gold standard for diagnostics.
Checking connections via the router's web interface
The most accurate and reliable method is to log into the router's admin panel. This displays a real picture of what's happening on the network. First, you need to find out the gateway's IP address. Most often, this is 192.168.0.1 or 192.168.1.1, but it may differ depending on the model.
Enter the address in your browser's address bar and log in. Default logins and passwords are usually found on a sticker on the bottom of the device (often admin/admin). After logging in, look for a section with a name like "Status," "Wireless," "WLAN," or "Client List."
In this section, you'll see a table with all active connections. MAC addresses, IP addresses, connection times, and, sometimes, hostnames are displayed. By comparing the number of rows in the table with the number of devices you have, you can easily identify any that are redundant.
βοΈ Check via web-interface
If the device list seems suspicious or you see unfamiliar names, don't panic. Some devices may appear with technical names that you don't immediately recognize. For example, a smart light bulb might be called "TPLINK_SMART_01."
Using mobile applications from manufacturers
Modern network equipment manufacturers have long since abandoned complex browser-based configurations, offering user-friendly mobile apps. For routers TP-Link this application Tether, For ASUS β ASUS Router, and for Keenetic β Keenetic.
These utilities allow you to monitor your network directly from your smartphone. The main menu usually features a "Clients" or "Devices" widget, which displays the number of connected devices in real time. You can tap on any device to see detailed information.
- π± Instant access: Login with fingerprint or FaceID without entering passwords.
- π« Blocking: Ability to turn off the device with one touch ("Lock" or "Pause").
- π Statistics: View the amount of traffic consumed by each device.
Apps also often feature a "Guest Network" feature, which allows you to separate your friends' traffic from your main connection. This is a great way to protect your data without giving guests full access to your local network.
Third-party programs for scanning the network on a PC
If you don't have access to your router or its interface is too complex, you can use a computer to scan the network. There are many free utilities that display all active nodes on a local network. One of the most popular is Wireless Network Watcher or Advanced IP Scanner.
After running the scan, the program will display a list of all devices that responded to the query. You'll see the IP address, MAC address, and network card manufacturer. This helps identify the device: if you see the manufacturer "Samsung" or "Apple" and you don't have any of these devices, that's a cause for concern.
It's important to understand the difference between an active connection and simply being visible on the network. Some programs may show devices that were recently online but are now disconnected. Always pay attention to the "Active" status or the last response time.
| Program | Platform | Complexity | Functional |
|---|---|---|---|
| Advanced IP Scanner | Windows | Low | Fast scanning, access to folders |
| Fing | Android / iOS | Low | Device type detection, speed test |
| Wireshark | All OS | High | Deep Packet Analysis for Pros |
| Angry IP Scanner | Cross-platform | Average | Port scanning, data export |
The use of such utilities is useful because they frequently update the databases of network card manufacturers, helping to understand what kind of "faceless" MAC address hides, for example, a game console or media player.
MAC address analysis and device identification
The key identifier of any device on the network is MAC addressThis is a unique 12-digit code embedded in the network card. The first six characters of this code identify the hardware manufacturer (OUI), making it much easier to find the "intruder."
For example, if the code starts with 00:1A:2B, you can enter this data into the online OUI calculator and find out that this is the company's device SonyIf you don't have this brand's equipment, it means someone is using your Wi-Fi.
However, modern operating systems such as iOS And AndroidBy default, the "Private Wi-Fi Address" (Randomized MAC) feature is used. This means the phone will generate a random MAC address for each new network to hide its actual hardware.
β οΈ Attention: Due to MAC address randomization, identifying the manufacturer from the first digits may not be possible. You may see a generic name like "Unknown" or "Generic" in the list.
In such cases, focus on quantity. If you have 5 gadgets and there are 7 on the list, then two are redundant. Disconnect your devices one by one and see which addresses disappear from the list to create a mapping.
What is MAC filtering?
This security method involves the router only allowing devices with pre-approved MAC addresses onto the network. Even with the password, someone else's phone won't be able to connect unless it's on the "whitelist." However, this is inconvenient for frequent visitors.
Protective measures and shutting down uninvited guests
If you discover a rogue device, you need to act quickly. The easiest way is to change your Wi-Fi network password. After doing this, all devices will be disconnected, and you'll have to re-enter the new password on your devices. This is guaranteed to kick out the "freeloaders."
A more flexible method is to use the Blacklist in your router settings. Find the intruder's MAC address in the client list and add it to the blacklist. The router will then ignore any connection requests from that address.
It's also worth reviewing your security settings. Make sure you're using an encryption protocol. WPA2-PSK or WPA3Old protocols WEP or WPA They can be hacked in minutes even by beginners using simple scripts.
- π Complex password: Use a combination of letters, numbers, and symbols with a minimum length of 12 characters.
- π‘ Disabling WPS: The quick connect feature often has vulnerabilities, so it's best to disable it in the settings.
- π Hiding SSID: You can hide the network name so it won't be visible in normal searches (but this doesn't provide 100% protection).
Regularly checking your connection list should become a habit, especially if you live in a densely populated apartment building where your router's signal is well-received even outdoors.
Frequently Asked Questions (FAQ)
Can my neighbor see what websites I visit if he's connected to my Wi-Fi?
Simply connecting to your Wi-Fi doesn't automatically grant access to your browser history or traffic content if the connections are secure (HTTPS). However, a tech-savvy attacker on the same network could attempt to use packet sniffers to intercept data. Therefore, the presence of an intruder always poses a risk of data leakage.
Why do I see "Unknown Device" in the list of devices?
This is normal. Many electronics manufacturers (vacuum cleaners, lamps, sockets) use cheap network modules that don't broadcast their network ID. Devices with MAC address randomization enabled may also display this way. Consider the number of such devices and their activity.
Does the number of connected devices affect internet speed?
Yes, it does. The Wi-Fi channel is shared among all active users. If one of the connected devices (yours or someone else's) starts downloading large files or watching 4K video, the speed on other devices will inevitably drop, as the router's bandwidth is limited.
How often should I change my Wi-Fi password?
For security purposes, we recommend changing your password every 3-6 months, or immediately if you suspect a hack or have shared your password with third parties (for example, repairmen or guests who have already left).