Slow internet speeds and intermittent connection interruptions are often the first warning signs that an unauthorized user has connected to your home network. Equipment owners TP-Link Often, users encounter situations where, even after changing their password, access to channel resources remains open to unwanted visitors. This isn't just inconvenient, but also a direct threat to the security of your personal data stored on connected devices.
Modern routers offer extensive functionality for monitoring network activity, but not all users know where to look for this information. Administrative panel A router's security tool contains comprehensive information about every connected device, including its MAC address and current data transfer rate. Understanding how these tools work allows you to quickly identify intruders and block their access.
In this article, we'll detail the steps for different firmware versions, review specialized network scanning software, and provide recommendations for strengthening perimeter security. You'll learn how to distinguish system devices from untrusted smartphones and understand which settings should be changed first to prevent repeat intrusions.
Analysis of connected devices via a web interface
The most reliable and accurate way to get a complete picture of what's happening on your network is to access your router settings through a browser. The web interface provides access to sections often hidden in mobile apps or simplified versions of the software. To get started, open any browser and enter the gateway IP address in the address bar, which is the default for most models. TP-Link makes up 192.168.0.1 or 192.168.1.1.
After entering your login credentials (administrator login and password), the main control panel will open. The interface may vary depending on the color scheme: classic green and gray or a modern blue and white design. In newer firmware versions, information is often displayed on the main screen as a graphical network map, visually displaying the number of active clients.
⚠️ Note: If the standard addresses do not open the login page, check the sticker on the bottom of the router or use the command
cmdAndipconfigin Windows to find out the exact address of the default gateway.
Find the section that may be called Wireless, Wi-Fi or Wireless modeLook for the subsection inside it. Wireless Statistics (Statistics) or Connected Devices (Connected devices). This is where you'll find a list of all the devices currently consuming your bandwidth. Note the columns with MAC addresses—these are unique identifiers for network interfaces.
Using the Tether app for monitoring
For users who prefer to manage their network from their smartphone, the company TP-Link developed a special application TetherThis tool allows you to perform basic diagnostics and view a client list directly from your mobile device, which is especially convenient when you don't have a computer nearby. The app automatically detects the router on your local network and prompts you to access its settings.
After logging in, the main screen displays a network diagram showing the number of connected devices. Tapping this section takes you to a detailed list. Here, each device is assigned a name (which can often be edited for convenience) and its IP address is listed. The app also allows you to quickly block access to uninvited guests with the click of a button.
However, it's worth keeping in mind that the mobile app's functionality may be limited compared to the full web version. For example, detailed connection logs or complex MAC address filtering may be unavailable or hidden in a menu. For in-depth analysis, it's still recommended to use a computer.
⚠️ Note: The Tether app's functionality and menu layout may change after updating your router firmware or the app itself. Always check the current interface in your software version.
Decoding MAC addresses and identifying guests
The most difficult part of monitoring is understanding which device each MAC address in the list belongs to. A MAC address consists of 12 hexadecimal characters separated by colons, for example: 00:1A:2B:3C:4D:5EThe first six characters (the first three bytes) are called the OUI (Organizationally Unique Identifier) and identify the manufacturer of the network equipment.
Using online services or OUI tables, you can determine the brand of the device. If you see an address starting with a prefix belonging to Apple, and you don't have equipment of this brand, this is a clear sign of an intrusion. Similarly, prefixes Samsung, Xiaomi or Intel (for computers) will help you create a picture of your home gadget zoo.
To simplify the task, you can use the following table of common manufacturer prefixes:
| MAC Prefix (OUI) | Probable manufacturer | Device type |
|---|---|---|
| 00:1B:63 | Sony Corporation | Game consoles, TV |
| F8:1A:67 | Philips Lighting | Smart home (Hue) |
| 3C:5A:B4 | Google Inc. | Android smartphones, Chromecast |
| 00:26:2D | Apple, Inc. | iPhone, iPad, Mac |
| B8:27:EB | Raspberry Pi Foundation | Single-board computers |
By comparing known devices with the data in the table and the router list, you can easily identify "extra" connections. If the list contains a device with the name TP-LINK_Extender, it may be a repeater and not someone else's phone, so it is important to analyze the context.
Third-party network scanning programs
If your router's built-in tools don't seem informative enough, specialized local network scanning utilities can come to the rescue. Programs like Advanced IP Scanner or Wireless Network Watcher are able to show not only IP and MAC, but also open ports, the computer name on the network, and even the network card manufacturer in greater detail.
These programs don't require you to know your router password; your computer must be connected to the same Wi-Fi network. Scanning takes a few seconds and produces a list of all active hosts. This is a great way to double-check the data retrieved from the admin panel. TP-Link.
Third-party software security
While using trusted network scanners is safe, only download programs from the developers' official websites to avoid introducing viruses disguised as useful software.
Particular attention should be paid to mobile scanners such as FingThey often display more detailed information about the device, including the model and operating system, than the router itself. This helps identify the device, even if its network name is renamed to something obscure like Android_1234.
Setting up filtering and blocking access
Once the intruder has been located, it must be neutralized. The most effective method is to use MAC address filteringIn the router settings TP-Link This section is usually located in the menu Wireless -> Wireless MAC FilteringHere you can create a rule that allows access only to a specific list of devices or, conversely, denies access to specific addresses.
To block, select the option Deny (Deny) and add the intruder's MAC address to the list. After saving the settings and rebooting the router, access for this device will be completely blocked, even if it knows the correct Wi-Fi password. This is more secure than simply changing the password, as an attacker can use software to intercept the new password, but changing their physical MAC address will be more difficult (though still possible).
☑️ Action plan if you discover an intruder
An alternative, but more radical method is to change the Wi-Fi password and encryption type. It is recommended to set it to the standard WPA2-PSK or WPA3 and create a complex key containing mixed-case letters and numbers. After changing the password, all devices will be disabled, and you'll only have to reconnect your own devices.
Prevention and strengthening of network security
To prevent a repeat of the "neighbor's Wi-Fi" situation, it's important to follow basic digital hygiene rules. First and foremost, disable the feature. WPS in the router settings. This technology, designed to simplify connection, has known vulnerabilities that allow someone to brute-force the PIN code and gain network access in minutes.
Update your router's firmware regularly. TP-LinkManufacturers constantly release patches to close security holes. Older versions of software may contain a vulnerability that allows hackers to gain complete control of the router, bypassing the Wi-Fi password.
⚠️ Warning: Never use the factory passwords to access your router's admin panel (admin/admin). Attackers check them first. Change your admin password to something unique and complex.
It also makes sense to hide your network name (SSID) if you want maximum privacy. This way, your network won't appear in the general list of available Wi-Fi hotspots, and you can only connect to it by manually entering the name and password. This creates an additional barrier to unauthorized users and simple scanners.
Frequently Asked Questions (FAQ)
Can my neighbor hack my WPA2 password?
Theoretically, yes, if the password is simple and consists of dictionary words. Modern video cards can try millions of combinations per second. However, if the password is long (more than 12 characters) and contains special characters, cracking it would take hundreds of years, making the attack pointless.
Why are there unknown names in the device list?
These are often your own devices, displayed under technical names (for example, the network card name or Android system name). Check the MAC addresses of your devices in their settings and compare them with the list in the router to mark them.
Will a hacker change his MAC address if I block him?
Yes, an experienced user can clone the MAC address of your authorized device (e.g., a TV) onto their laptop. This will cause the router to believe it's your device. The only solution is to temporarily disable all your devices, block the clone, and change the Wi-Fi password.
Does the number of connected devices affect the speed?
Absolutely. The Wi-Fi channel is shared between all active clients. If one starts downloading large files or watching 4K video, the speed on the other devices may drop to a crawl, even if the provider's internet connection is very fast.