Many people are familiar with the situation when the internet suddenly slows down, or video calls are interrupted at the most inopportune moment. Often, such outages are caused not by equipment failure or provider issues, but by simple traffic theft. If you haven't set a strong password or it's been compromised, neighbors or passersby who are actively downloading files or watching high-definition videos could connect to your network.
The first thing you need to do to diagnose the problem is check the list of connected devicesThis action will allow you to instantly understand whether there are strangers on your local network. Modern routers provide detailed statistics, which show not only IP addresses but also MAC addresses, and sometimes even device names. In this article, we'll cover all the available methods for monitoring network activity.
It's important to understand that detecting an intruder is only half the solution. Once you spot an extra device, you need to take immediate action. perimeter protection your home network. Simply disabling a device through the admin panel is often temporary unless the encryption keys have been changed. We'll cover the steps for various hardware models and operating systems.
Visual diagnostics using router indicators
The easiest and fastest way to tell if someone is using your internet connection doesn't require going into complex settings. Look at the front panel of your router. There's an indicator there, usually labeled WLAN, Wi-Fi or depicted as an antenna. If all your devices are turned off or in airplane mode, and the light is actively blinking, this is a sure sign of external activity.
The frequency of the indicator blinking directly depends on the volume of data being transferred. If the light is steady or blinks rapidly while you're inactive, it means there's active packet exchange. This could be a system update on someone else's phone or downloading torrents. However, this method only provides indirect information and doesn't indicate how many devices are connected.
⚠️ Attention: On some router models, for example, older versions D-Link or TP-LinkThe Wi-Fi indicator may blink even when there's no active traffic, simply signaling the presence of a wireless network. Don't rely solely on the lights for definitive conclusions.
For a more accurate check, you can temporarily disable the wireless module. Press the button Wi-Fi On the router body (if equipped) or disable the radio interface through the manufacturer's app. If the activity indicators on the LAN ports continue to flash erratically after this, someone is connected to your router via a cable, which is an even more serious security issue.
Using mobile apps from manufacturers
Modern network equipment manufacturers have made network management as convenient as possible by moving key functions to mobile apps. This is the fastest way to view a list of clients. For routers Keenetic there is an application Keenetic, For TP-Link — Tether, and for ASUS — ASUS RouterSimply download the appropriate software to a smartphone connected to your network.
After logging into the app (a manufacturer account is often required), go to the section that may be called "Clients," "Devices," or "Network Map." This displays a graphical representation of all connected devices. You'll see their names (e.g., Ivan-iPhone or LivingRoom-TV), IP addresses and connection status (2.4 GHz or 5 GHz).
The advantage of mobile apps is the ability to instantly block. When you see an unfamiliar device, you can tap it and select "Block" or "Deny Access." The system will immediately terminate the connection to that MAC address. Some apps, such as Fritz!App WLAN, even show the signal strength, which helps to understand where the intruder is physically located.
Checking via the router's web interface
The classic and most detailed method of control is to log into the administrator's web interface. To do this, open any browser on your computer or phone and enter the router's IP address in the address bar. Most often, this is 192.168.0.1, 192.168.1.1 or a domain name, for example, router.asus.comThe default login and password are usually indicated on a sticker on the bottom of the device.
After logging in, navigation depends on the model. In the interfaces TP-Link you need to look for a section Wireless -> Wireless Statistics or DHCP -> DHCP Client ListIn routers ASUS The information is located on the main page in the "Clients" section, and in MikroTik — in the menu IP -> DHCP Server -> tab LeasesThis is where the truth about who is "eating" your traffic lies.
In the client table, you'll see columns for MAC addresses, IP addresses, and lease times. A MAC address is a unique identifier for a network card and consists of 12 hexadecimal characters (e.g., A1:B2:C3:D4:E5:F6). The first six characters often indicate the device manufacturer, which helps identify the gadget.
Below is a table of typical sections for popular brands where you can find customer information:
| Router brand | Path to the menu | Section title |
|---|---|---|
| TP-Link | Wireless / Wireless Statistics | Wireless network statistics |
| ASUS | Network Map / Clients | Client list |
| Keenetic | Client list | Active devices |
| D-Link | Advanced Settings / Status | DHCP Client List |
List analysis using specialized software
If logging into your router is impossible or the interface is too complex, you can use third-party network scanning programs. These programs run on any device connected to Wi-Fi and display all active nodes. One of the most popular utilities is Advanced IP Scanner for Windows. It scans a range of addresses and provides a complete picture of who is on the local network.
For Android and iOS users, the app is a great solution. FingIt not only displays a list of devices but also attempts to identify their type, operating system, and even manufacturer. This is extremely useful when an unknown MAC address appears in the list. The program can also generate a network graph and scan ports for vulnerabilities.
Using such programs has its own peculiarities. Since scanning originates from your device, the router sees this request as normal traffic. However, if AP Isolation is enabled on the router, the program may not see other devices. In home networks, this feature is usually disabled, so scanners work effectively.
⚠️ Attention: Antivirus programs may detect network scanners as suspicious activity. This is normal, as these utilities actively scan ports. Add trusted scanners to exceptions.
There are also console utilities for more advanced users. For example, on Linux or macOS, you can use the command arp -a in the terminal. It will display a table of IP and MAC addresses known to your computer. It's less informative than graphical interfaces, but it works quickly and doesn't require any additional software.
How to block an uninvited guest
Once you discover someone else's device, you should block it immediately. The most effective method is to use MAC filteringIn your router settings, find the "MAC Filtering" section. Copy the MAC address of the offending device from the client list and add it to the Blacklist. Once the settings are applied, access for this device will be completely blocked.
An alternative, but more radical method is to change your Wi-Fi network password. Go to your wireless settings (Wireless Settings) and change the security key. After this, all devices, including your own, will be disabled. You'll have to reconnect each device using the new password. This ensures that no old passwords are left with unauthorized users.
☑️ Network Security Checklist
Some modern routers allow you to block devices directly from the client list, without manually creating filtering rules. In the interface Keenetic or MikroTik You can simply click the lock or cross icon next to the device name. This will automatically create a blocking rule. Remember that a clever attacker can spoof a MAC address, so changing the password remains the most secure method.
Prevention and strengthening of network security
To prevent this from happening again, it's essential to ensure maximum security. First, make sure you're using a modern encryption protocol. In your wireless network settings (Wireless Security) select the mode WPA2-PSK or WPA3Avoid using outdated and easily hacked protocols. WEP, which does not provide real security.
Your passphrase should be complex. Use a combination of uppercase and lowercase letters, numbers, and special characters. The password should be at least 12 characters long. Avoid obvious combinations like your date of birth or phone number. A good password is a random string of characters that is difficult to brute-force.
What is WPS and why should it be disabled?
WPS (Wi-Fi Protected Setup) is a technology that allows you to connect to a network by pressing a button or entering a PIN. However, this feature has vulnerabilities that allow hackers to quickly recover the PIN and gain access to the password. It is recommended to completely disable WPS in your router settings.
It's also worth considering the guest network feature. If you frequently have friends over, create a separate guest Wi-Fi zone for them with speed limits and isolation from your main network. This will allow them to use the internet but won't allow them to access your personal files, printers, or NAS storage.
Finally, it's worth noting that network control is the responsibility of the equipment owner. Regularly monitoring connections not only helps save bandwidth but also maintains the privacy of your data. Remember that an open network can allow attackers to intercept passwords for websites that don't use a secure connection.
What should I do if I can't access my router settings?
If the default login and password (admin/admin) don't work, they may have been changed previously. Try finding the sticker on the bottom of the device—it may contain unique information. If you've lost the password, you'll have to perform a reset using the button on the device, but this will delete all provider settings.
Can my neighbor see my files via Wi-Fi?
If you don't have a guest network configured and network discovery enabled, this is theoretically possible. However, using strong WPA2/WPA3 encryption and a complex password will prevent access to local resources without knowing the password.
Does the number of connected devices affect the speed?
Yes, the bandwidth is shared among all active users. If one user is downloading files at maximum speed, everyone else's internet will be slow, regardless of their ISP plan.
How often should I change my Wi-Fi password?
It's recommended to change your password every 3-6 months or immediately after granting access to guests. It's also essential to change it if you notice suspicious activity or unexplained slow network performance.