How to find out where your Wi-Fi traffic is going and who's stealing your internet

Many people are familiar with the situation when the internet starts to slow down, pages load slowly, and video calls drop out. Often, router owners don't even realize that the cause of low speeds may not be a hardware malfunction or a problem with the provider, but rather simple traffic theft. Uninvited guests, connected to your network, can download large files, watch 4K videos, or use your IP address for illegal activities while you try to resolve technical issues.

Fortunately, modern technology makes it quite easy identify all clients, located on your wireless network, and block their access if necessary. You don't need to be a professional network engineer to do this—basic diagnostic techniques and access to your router or smartphone settings are sufficient. In this article, we'll cover all the ways to track your traffic and secure your home network from unauthorized connections.

The first thing to do is stop panicking and start acting methodically. Identifying "pirates" requires vigilance, as some devices may be connected to the router but not currently in use, remaining in the background. Understanding how a local area network works will help you distinguish a smart light bulb from someone else's laptop.

Analysis of indicators and primary network diagnostics

Before delving into the complex settings of the admin panel, it's worth paying attention to the physical condition of your router. On the case of most models TP-Link, ASUS, Zyxel or Keenetic There is an LED indicator labeled as WLAN, Wi-Fi or depicted as an antenna. In normal operation, it flashes at a certain frequency, depending on the volume of data being transmitted. If you've turned off all your gadgets, turned off the TV and computer, and the light continues to flash rapidly and intensely, this is a clear sign. background activity on the network.

⚠️ Attention: A rapidly blinking indicator doesn't always indicate data theft. Background Windows operating system updates, cloud storage synchronization, or smart cameras can create a constant data stream.

For a more accurate initial assessment, you can use the command line on a Windows computer. This is an easy way to see a list of active IP addresses your PC is communicating with and indirectly assess the bandwidth usage. Enter the command netstat -n or more informative netstat -eto see the number of bytes sent and received. A sharp increase in counters without your active actions is a warning sign.

It's also worth paying attention to the interface behavior of your devices. If the battery drains quickly and the case heats up on a smartphone or tablet without any apps running, it's possible the device is constantly transmit data This could be a sign that someone is remotely using the camera or microphone, or that the device has become part of a botnet. In this case, checking the list of connected devices becomes a priority.

Checking the client list via the router's web interface

The most reliable and accurate way to find out who is connected to your Wi-Fi is to access the router's settings. The device's administrative panel stores accurate information about everyone. DHCP clients, which received an IP address. To log in, open any browser and enter the gateway IP address in the address bar. Most often, this is 192.168.0.1, 192.168.1.1 or 192.168.31.1The exact address, login, and password are usually indicated on a sticker on the bottom of the router.

After authorization (standard credentials are often admin/admin or admin/password(if you haven't changed them) you need to find the section related to wireless networking. Depending on the model and firmware, it may be called Wireless, Wi-Fi, Status or Client listIn modern routers Keenetic This section is located on the main screen, and in TP-Link with the new firmware - in the menu Advanced Settings → Wireless → Wireless Statistics.

In the list that opens, you will see MAC addresses and possibly device names. Device name (Hostname) often helps to identify the owner, for example, iPhone-Ivan or Samsung-TV. However, if you see a device named Unknown or Android-xyzIf you're unfamiliar with a device, you should be wary. Compare the number of active connections with the number of devices you have. If the router shows 10 devices, but you only have a phone and a laptop— extra 8 require immediate attention.

To avoid accidentally blocking a smart plug or temperature sensor, it's best to create a list of the MAC addresses of all your devices in advance. This can be done by viewing the Wi-Fi settings on each device individually. The table below shows examples of what the client list might look like:

Using mobile apps for scanning

If you have limited access to a computer or want to check on the go, specialized smartphone apps are a great solution. Programs like Fing, WiFi Analyzer or Network Scanner Allows you to instantly scan your network and display a complete list of devices. These tools operate at the ARP request level, detecting even those devices that hide their SSID or use complex settings.

Application Fing, is perhaps the leader in this niche. It not only displays IP and MAC addresses, but also tries to determine the manufacturer of the network card (for example, Apple, Intel, Huawei) and device type (smartphone, printer, game console). This greatly simplifies identification. You can rename devices in the app for convenience, creating an up-to-date map of your home network. Additionally, such apps often have a feature Ping, which allows you to check the availability of the device in real time.

It's worth noting that for a full scan, your smartphone must be connected to the same Wi-Fi network you're checking. Using mobile data (3G/4G/5G) won't yield results in this case, as you're scanning a local network, not the global internet. Some advanced features may require superuser privileges (root on Android or jailbreak on iOS), but basic functionality is also available on standard devices.

PC monitoring software

For users who prefer in-depth analysis from a computer, there is a powerful arsenal of software. The program Wireless Network Watcher from NirSoft is a lightweight utility that requires no installation and instantly lists all connected devices. It displays the MAC address, IP address, device name, network card manufacturer, and last detected time. It's the perfect tool for quickly diagnostics without unnecessary load on the system.

More advanced users can use the utility WiresharkThis is a professional traffic analyzer that allows you to see not only the list of hosts but also the contents of transmitted packets. It can help you understand where exactly the traffic is going: to update servers, video streaming platforms, or suspicious foreign IP addresses. However, working with Wireshark requires some knowledge of TCP/IP protocols, as the amount of information can be overwhelming for a beginner.

Windows also has a built-in console utility. arp. Team arp -a Displays a table of IP addresses and physical MAC addresses cached by your system. This is a quick way to see who your computer has recently communicated with. If you see a lot of addresses starting with your router's prefix (e.g., 192.168.1.x) but can't identify them, it's time to investigate further using the web interface.

⚠️ Attention: When using third-party network analysis software, download programs only from the developers' official websites. Versions from unverified sources may contain viruses or miners, which themselves can leak traffic.

Interpreting MAC addresses and identifying devices

The key identifier in a network is the MAC address (Media Access Control Address). This is a unique 48-bit identifier assigned to a network interface during manufacturing. The first three bytes (six hexadecimal digits) are called OUI (Organizationally Unique Identifier) and indicate the device's manufacturer. Knowing these numbers, you can easily identify the device connected to the network, even if its name is hidden.

For example, if the MAC address starts with 00:1A:2B, this may indicate equipment Cisco, and the prefix 3C:5A:B4 belongs to the company AppleThere are online OUI databases where you can enter the first six characters of a MAC address to get the exact manufacturer name. This helps distinguish a smart vacuum cleaner from someone else's smartphone. If you see a device from a manufacturer you don't own (for example, you haven't purchased anything from Xiaomi, and a device with the MAC address of this company is hanging on the network), this is a clear sign of an intrusion.

What is MAC address randomization?

Modern versions of iOS (starting with 14) and Android (starting with 10) use a feature called "Private Wi-Fi Address" or "MAC Randomization." This means that the device changes its MAC address to a random one every time it connects to a new network or periodically to protect the user's privacy. Because of this, the same device may appear in the router's client list as several different "new" devices or as an "Unknown Device."

However, it's important to consider modern privacy protection technologies. As mentioned, many smartphones use random MAC addressesThis can be confusing when attempting to identify a device. In such cases, you need to rely not only on the MAC address but also on the device's behavior: if you disable Wi-Fi on your phone, the suspicious device should disappear from the router's list or switch to "Offline" status.

Blocking methods and network protection

Once you've identified the intruder, you need to immediately block their access. The simplest and most effective method is to use Blacklist In the router settings, find the intruder's MAC address in the client list and select "Block" or add it to the Blacklist. After this, the router will ignore any connection attempts from this address, even if the attacker knows the correct password.

A more radical, yet secure, method is to change your Wi-Fi password. Changing the security key will disconnect all devices, and only those you share the new password with will be able to reconnect. It is recommended to use a complex password consisting of mixed-case letters, numbers, and special characters, at least 12 characters long. The encryption type must be set to WPA2-PSK or WPA3, because it is outdated WEP hacked in a few minutes.

Also worth paying attention to is the function WPSThis protocol is designed to simplify connections, but it often contains vulnerabilities. If you don't use the WPS button to connect devices, it's best to completely disable this feature in your router settings. This will close one of the common loopholes used by automated password guessing programs.

Real-time traffic optimization and monitoring

After clearing the network of unauthorized users, it is recommended to set up traffic monitoring to quickly respond to anomalies in the future. Many modern routers (for example, Keenetic with the operating system KeenOS or ASUS with firmware Asuswrt) have built-in traffic consumption graphs. You can see how many megabytes each device has downloaded in a day or right now.

If you notice that a specific device (such as a Smart TV or gaming PC) is consuming a disproportionate amount of data, check its settings. It may have automatic downloads of 4K game updates or cloud syncing of large files enabled. Speed ​​limits for individual devices (Bandwidth Control) will help you prioritize your work or study time, preventing one device from choking out the entire network.

⚠️ Attention: Router interfaces and function names may vary depending on the model and firmware version. If you can't find a specific setting, check the official instructions on your equipment manufacturer's website, as the menu may be updated.

Regularly checking the list of connected devices should become a habit, especially if you live in a densely populated apartment building. Periodically changing your password and updating your router firmware are basic digital security practices that will protect you from traffic theft and potential attacks on your personal data.

Frequently Asked Questions (FAQ)

Can a neighbor steal my internet if I don't see him in the list of devices?

Theoretically, yes, if it uses advanced MAC address masking techniques or if the router is vulnerable. However, in 99% of cases, all connected devices appear in the DHCP list. If traffic is flowing but no devices are showing up, check whether background processes on your own devices (Windows updates, torrents, cloud services) are causing the load.

What should I do if I don't remember the password for my router's admin panel?

If standard admin/admin If it doesn't fit and you've changed it but forgot, you'll have to reset it. There's a small hole with a button on the router body. Press it with a paperclip for 10-15 seconds while the router is turned on. After rebooting, it will return to factory settings, and you'll be able to log in using the information on the sticker. You'll have to reset your Wi-Fi password.

Does the number of connected devices affect internet speed?

Yes, the bandwidth is shared among all active users. If you have a 100 Mbps plan and five people are downloading files simultaneously, each will get approximately 20 Mbps. Furthermore, cheap routers may not be able to handle a large number of simultaneous connections, even if traffic isn't being actively consumed, due to insufficient RAM.

How can I find out who is connected to my Wi-Fi if I have a router from my ISP?

Routers from providers (for example, Sagemcom, Eltex) often have a stripped-down interface. Try the standard addresses. 192.168.0.1 or 192.168.1.1The login and password are often found on a sticker. If access is blocked, contact your provider's technical support or use mobile scanner apps that work regardless of your router model.