A sudden drop in internet speed or malfunctioning smart devices are often the first warning signs of uninvited guests on your local network. When you notice your router operating at its limits for no apparent reason, it's natural to wonder how to check who's connected to your Wi-Fi. This isn't just a matter of saving bandwidth, but a fundamental digital security issue that requires immediate attention.
There are several proven methods for identifying intruders, from using the router's built-in interface to specialized software. In this article, we'll examine each method in detail, explain how to distinguish your devices from those of others, and provide a step-by-step plan for protecting your network from unauthorized access.
Indirect signs of unauthorized access
Before moving on to technical testing methods, it's worth paying attention to how your network behaves in everyday use. Connection instability Intermittent connection interruptions can be caused not only by provider issues but also by channel congestion from other devices. If the activity lights on your router are flashing wildly while all your devices are asleep or turned off, this is a sure sign that someone is actively using your resource.
Another important indicator is a decrease in page loading speed and buffering of high-quality video. Modern routers have limited bandwidth, and even a single active user, for example, downloading large files, can significantly impact the experience of others. Also, be wary if your router settings have changed without your intervention or if the password has been reset.
- 📉 A sharp drop in internet speed during peak hours or at night.
- 💡 Active blinking of the WLAN/Wi-Fi indicator when there is no active download for the owners.
- 🔒 Block access to router settings or change the administrator password.
- 📱 Gadgets you don't recognize appear in the list of connected devices.
⚠️ Caution: Some antivirus programs and smart home systems can generate background traffic that they mistakenly identify as unauthorized activity. Always check your device list before panicking.
It's important to understand that indirect signs don't provide a 100% guarantee, but they serve as an excellent trigger for a more in-depth diagnosis. Ignoring these signals could lead to personal data leaks or the use of your IP address for illegal online activity.
Checking via the router's web interface
The most reliable and accurate way to find out who is using your Wi-Fi is to look into your router's admin panel. Almost all modern models from manufacturers like TP-Link, Asus, Keenetic or MikroTik have a built-in monitoring function for connected clients. To access this data, you'll need to know the gateway's IP address, which is usually found on a sticker on the bottom of the device.
Open any browser and enter a standard address in the address bar, for example, 192.168.0.1 or 192.168.1.1After entering your login and password (often admin/admin by default), go to the section that may be called "Status," "Client List," "DHCP Client List," or "Wireless Statistics." This displays a complete table of all active connections in real time.
In the table provided, you will see MAC addresses, IP addresses, and often device names. MAC address — is a unique identifier for a network card that cannot be forged using software without specialized equipment. It is the key to identifying "friends" and "foes."
| Parameter | Description | Why is it needed? |
|---|---|---|
| IP Address | Internal address of the device on the network | Allows you to find a device on the local network |
| MAC Address | Physical address of the network card | Main identifier for filtering and blocking |
| Lease Time | IP address lease time | Shows how long the device has been connected |
| Interface | Connection type (LAN/WLAN) | Helps you understand whether the user is connected via cable or Wi-Fi |
After reviewing the list, disable all known devices (smartphones, TVs, laptops) and see which ones remain. If, after disabling all gadgets, there are still active entries in the table, it means unauthorized people have access to the network. In this case, you should immediately change your Wi-Fi password.
Using mobile apps and scanners
If access to a computer is difficult or the router interface seems too complex, specialized smartphone apps can help. Programs like Fing, Network Scanner or proprietary utilities from router manufacturers allow you to conduct a network audit in seconds directly from your phone.
These applications scan a range of addresses and provide detailed information about each device found, including the network card manufacturer (based on the MAC address) and operating system. This greatly simplifies the identification process: you can immediately see that an "Unknown Device" with a MAC address starting with a certain prefix belongs to, for example, a company Samsung or Apple.
Many of these snails also have a security check feature. They can warn you if your connection is unsecured or if dangerous ports are open on the network. However, it's important to remember that for these apps to work, your phone must be connected to the same Wi-Fi network you're checking.
- 📱 Fing: Market leader, identifies device type and operating system with high accuracy.
- 🔍 WiFi Analyzer: In addition to searching for clients, it shows channel load, which is useful for signal optimization.
- 🛡️ Kaspersky Wi-Fi Security: Scan your network for known vulnerabilities and suspicious activity.
- 🏠 Proprietary apps (TP-Link Tether, Mi Wi-Fi): Allow you not only to see but also to block users with one click.
⚠️ Please note: Free versions of scanners may have limited functionality or display ads. In-depth real-time traffic analysis often requires a paid subscription or root access on Android.
Using mobile scanners is especially convenient because you can test from anywhere in your apartment where there's a signal. This allows you to ensure that your neighbor's signal isn't masquerading as your network in distant rooms.
☑️ Network security check
Analyzing traffic using the command line
For advanced users who prefer not to install unnecessary software, the operating system's command line is an excellent tool. In Windows, this is the utility arp, which displays a table of IP addresses and physical MAC addresses in your computer's cache. This method allows you to see which devices your PC has already communicated with.
To run the analysis, open the command prompt by pressing Win + R, by entering cmd and pressing Enter. In the black console window, enter the command arp -aThe system will display a list of all devices your computer has recently interacted with. These may include not only Wi-Fi-connected devices but also network printers or media servers.
C:\Users\User> arp -a
Interface: 192.168.1.5 --- 0x3
Internet Address Physical Address Type
192.168.1.1 00-1a-2b-3c-4d-5e dynamic
192.168.1.15 aa-bb-cc-dd-ee-ff dynamic
192.168.1.255 ff-ff-ff-ff-ff-ff static
To ensure that the data is as complete as possible, before entering the command arp -a It is recommended to ping the entire address range of your subnet. This will force the computer to query all possible devices on the network and update the ARP table. You can use the command for /L %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i > nul, then run it again arp -a.
The main difficulty here is the need to manually match MAC addresses to devices. However, this method has the advantage of working at the operating system level and is independent of router models or internet connection (it works within a local network).
What is ARP spoofing?
ARP spoofing is an attack technique in which an attacker sends false ARP messages on a local network. The goal is to associate the attacker's MAC address with the IP address of another host, such as the default gateway. This allows data destined for that IP address to be intercepted. While the risk is minimal for a home network, it poses a serious threat in corporate environments.
How to distinguish your device from someone else's
The most common problem when analyzing connection lists is the presence of devices named "Unknown" or "Android." To avoid accidentally blocking your refrigerator or smart light bulb, it's important to conduct a preliminary inventory. MAC address consists of 12 hexadecimal characters, where the first 6 characters (OUI) indicate the equipment manufacturer.
Use online services or OUI databases by entering the first three pairs of characters of the MAC address. This will allow you to accurately identify the brand. If you see a device from Sony, but you don't have any equipment of this brand, this is cause for concern. A method of elimination also helps: disable Wi-Fi on your devices one by one and watch which one disappears from the list of active ones.
IoT (Internet of Things) devices deserve special attention. Smart plugs, CCTV cameras, and voice assistants often have strange names or don't display their names online at all. Write down their MAC addresses immediately after purchase to avoid guessing whose "IP-Camera-01" is.
- 📝 Make a physical list of all gadgets with their MAC addresses when initially setting up the network.
- 🏷️ Rename the devices in the router settings, giving them descriptive names (for example, "Phone_Dad", "TV_LivingRoom").
- 🔍 Use MAC address prefixes to quickly identify the manufacturer (Apple, Xiaomi, Intel).
- 📵 Disable Wi-Fi on all devices one by one to accurately identify "live" connections.
If, after all the checks, you find a device you can't identify, it's better to be on the safe side. In today's world, with dozens of sensors connected to the network, it's easy to forget about one, but the risk of a neighbor's presence remains high.
Protect your network and block unwanted guests
Detecting an intruder is only half the battle. The key is to quickly block access and prevent re-intrusion. The most effective and radical method is to completely change your Wi-Fi password. Use a complex password consisting of mixed-case letters, numbers, and special characters. Avoid obvious combinations like your date of birth or phone number.
After changing the password, all devices will be disconnected, and you'll have to reconnect them. This is inconvenient, but it ensures that the old password, which could have been stolen or cracked, is no longer valid. It's also recommended to change the password for accessing your router settings, as they are often set to the default.
An additional security measure is to enable MAC address filtering. You can create a "whitelist" in your router settings that only includes your devices. Even with the password, any other device will be unable to connect to the network, as its physical address won't be authorized by the router.
⚠️ Note: MAC address filtering is not a panacea. A skilled attacker can "clone" the MAC address of an authorized device. Therefore, a complex WPA2/WPA3 password remains the primary barrier.
Don't forget to regularly update your router's firmware. Manufacturers are constantly patching software vulnerabilities that could allow hackers to access your network. Enable automatic updates if your model supports it.
Frequently Asked Questions (FAQ)
Can my neighbor see my files via Wi-Fi?
If your network doesn't have a publicly accessible shared folder configured and your Wi-Fi password is complex, direct file access is difficult. However, if an attacker connects to the network, they're on the same local network segment as you. Theoretically, with vulnerabilities in the operating system or open network discovery, access is possible. It's recommended to set the network type to "Public" for new connections, which hides your PC from others.
Does the number of connected devices affect internet speed?
Yes, it does have a direct impact. The bandwidth is divided among all active users. If someone is downloading torrents or watching 4K video, others may not have enough speed for comfortable surfing. Furthermore, cheap routers can simply choke on the number of simultaneous connections, even with light traffic.
What should I do if I changed my password and someone else connected again?
This could mean you have a device in your home (such as a smart speaker or TV) that automatically connected to the network with a new password via WPS or phone sync, and you mistook it for an intruder. Or, less likely but possible, you have password protection software installed on an infected computer that transmitted a new key. In this case, you should scan your PC for viruses and disable the WPS function on your router.
Is it safe to use WPS function to connect?
No, using WPS (Wi-Fi Protected Setup) is considered insecure. This technology has vulnerabilities that allow someone to brute-force the PIN and obtain the network password in a matter of hours or even minutes. It is recommended to disable WPS in the wireless security section of your router settings.