How to Check Who's Connected to Your Wi-Fi: A Complete Guide

Slow internet speeds, intermittent connection drops, and unexplained increases in bandwidth usage are classic signs that someone may be accessing your network. In an age where home Wi-Fi is used not only for surfing but also for network management, smart homeWith the rise of video surveillance and work, perimeter security is becoming a critical issue. Many users are unaware that their passwords may have been compromised or shared with guests.

There are several effective ways to identify an intruder, from using specialized mobile apps to in-depth analysis of logs in the router's administrative panel. Timely diagnosis Not only can you restore lost speed, but you can also prevent the theft of personal data circulating within your local network. In this article, we'll examine all available methods, from simple to complex, and learn how to reliably protect your network perimeter.

Before taking drastic measures like changing passwords or setting filters, it's important to conduct a thorough investigation. Don't panic: often, an "unknown device" turns out to be a forgotten gadget, smart plug, or TV running in the background. However, ignore any suspicious activity. absolutely not allowed.

Indirect signs of unauthorized access

Connection quality is often the first sign of problems. If you live in an apartment building where the airwaves are clogged with dozens of neighboring networks, some interference is normal. But if your speed drops to its lowest when your neighbors are asleep or away, and your traffic is minimal, you should be wary. Unstable ping in games or constant buffering of high-definition video may indicate that someone is actively downloading torrents or watching streams through your access point.

Pay attention to the indicators on the router body. The light responsible for wireless data transmission (usually marked as WLAN, Wi-Fi (or depicted as an antenna) may behave strangely. In normal mode, it blinks when packets are actively being transmitted. If all your devices are asleep or turned off, and the indicator blinking madly, which means that there is an active exchange of data.

⚠️ Please note: Not all modern routers have detailed activity indicators on the case. Some models Tenda or Keenetic can display the connection status, but not the traffic intensity for each client separately via LEDs.

Another sign is the inability to access your router's settings. If you're trying to access the admin panel at 192.168.0.1 or 192.168.1.1, and the page does not load, although the Internet is working, this may mean that the attacker has occupied the control port or arranged ARP spoofingYou should also be wary of the appearance of unknown device names in the list of printers or media servers available for printing on your local network.

Analyzing connected devices via the router's web interface

The most reliable and accurate way to find out who's using your Wi-Fi is to look inside your router. The web interface provides comprehensive information about each client, including MAC address, IP address, connection type (wired or wireless), and activity time. This method doesn't require any third-party software and works on any device, whether a computer or smartphone.

First, you need to log in to your control panel. Open your browser and enter your gateway's IP address in the address bar. Most often, this is 192.168.0.1 or 192.168.1.1, however, providers like Rostelecom or MGTS The addresses may differ. The default login and password are often indicated on a sticker on the bottom of the device (e.g. admin/admin), if you haven't changed them before.

Once you log in, look for a section that may have different names depending on the model and firmware. TP-Link it's usually a tab Wireless → Wireless Statistics or DHCP → DHCP Client List. U Asus And Keenetic The list of clients is often displayed on the main dashboard screen or is located in a section Net / My networksYou need a list that displays current connections.

In the list that opens, you'll see a table with devices. Your task is to identify each one. Modern routers often automatically retrieve device names (for example, iPhone-Alex or Samsung-TV), but if you see abbreviations or unclear names, you'll have to check the MAC addresses. Compare the number of devices in the list with the actual number of gadgets in your home.

What should I do if the interface is in Chinese or English?

If you can't find the sections you need due to the language, use an online translator with image recognition (such as Google Translate). Take a screenshot of the router's screen and upload it to the translator. You can also try searching for your router model on the 4PDA forum or the manufacturer's official website, which have interface screenshots in Russian.

Using mobile apps to scan the network

If accessing your router settings via a browser seems complicated or inconvenient on your phone, specialized scanner apps will come to the rescue. They automatically detect all devices on the local network and perform Whois queries MAC addresses are used to identify the manufacturer and allow for quick assessment. This is an excellent tool for express diagnostics.

One of the most popular and functional tools is the application Fing (available for Android and iOS). Once launched, it scans the network and displays a list of all connected devices. The app can recognize the device type (camera, TV, smartphone) and even the operating system. Another option is WiFi Analyzer, which is more focused on channel analysis, but also shows a list of clients.

The advantage of mobile scanners is their clarity. They often mark unknown devices in red or with an exclamation point. Furthermore, such programs allow for Speedtest Right inside the app to check if someone is throttling your speed right now. However, keep in mind that apps only work within your local network and can't block the offender without access to the router.

⚠️ Please note: Free versions of popular scanners may contain ads or limit the number of scans per day. For a one-time "who's connected" check, the free version's functionality is usually more than sufficient; don't rush to upgrade to a premium subscription.

It's important to understand that mobile apps see the network the same way your phone does. If your smartphone is connected to a guest network, it won't see devices on the main network. Therefore, for a full scan, make sure you're connected to the main SSID. Also, some Android antivirus programs may block app access to the ARP table list, considering it suspicious activity, so you may need to grant special permissions.

PC Software: Deep Scan

For users of computers running Windows or macOS, there are more powerful tools that allow you to not only view the list, but also analyze the traffic. Wireless Network Watcher from NirSoft is a lightweight, portable utility that instantly downloads a list of all devices. It requires no installation and runs even on low-end machines.

More advanced users can use console utilities. For example, in the Windows command line (called via Win + R and input cmd) you can enter the command arp -aIt will display a table of IP addresses and physical MAC addresses of all devices with which your computer has recently communicated. This is raw data, requiring MAC address reading skills, but it is highly reliable.

C:\Users\User>arp -a

Interface: 192.168.1.5 --- 0xb
Internet Address Physical Address Type
192.168.1.1 00-1a-2b-3c-4d-5e dynamic
192.168.1.15 a1-b2-c3-d4-e5-f6 dynamic
192.168.1.25 11-22-33-44-55-66 dynamic

Another powerful tool is Advanced IP ScannerIt scans the network, identifies open ports and shared folders, and allows you to quickly access the device's web interface. This is useful if you want to check if someone has opened access to their files on your network. The program automatically identifies network card manufacturers based on the first three bytes of the MAC address, making identification easy.

Using a PC for scanning is especially effective, as computers typically have a stable wired or powerful wireless connection, allowing the scanner to scan the network faster and more completely than a mobile device. Furthermore, a large monitor screen makes it easier to compare long lists of MAC addresses.

Identifying devices by MAC address

When you have a list of strange addresses like A4:5E:60:C2:11:22, the question arises: what is it? A MAC address is a unique identifier for a network interface assigned by the manufacturer. The first three pairs of characters (OUI - Organizationally Unique Identifier) ​​indicate who manufactured the device.

There are many online services for checking MAC addresses (for example, macvendors.com or wireshark.com). By entering the first 6 characters there, you can find out that the device belongs to the company Sony, Apple or HuaweiIf you see a device from a security system manufacturer, but you don’t have any cameras, or the device is from Xiaomi, even though you don't have their technology, it's a cause for concern.

However, it is worth considering the nuance: modern smartphones (iOS 14+, Android 10+) use the function when connecting to new networks MAC address randomizationThis means your iPhone may present itself to the router under a new, random address each time for privacy reasons. In the router's client list, this may appear as a new, untrusted device, even though it's actually your phone.

To avoid confusion, it's best to disable the "Private Wi-Fi Address" feature for your home network in the Wi-Fi settings on your personal devices (smartphones, laptops). This will force the device to use a real, permanent MAC address, so you'll always recognize your devices in the list.

How to block an intruder and protect your network

If you've identified an intruder, you need to act quickly. The easiest, but time-consuming, way is to change your Wi-Fi password. When changing the password all devices will be disconnected, and you will have to reconnect your gadgets with a new key. This is guaranteed to throw