A sudden drop in internet speed or intermittent connection interruptions are often the first warning signs that your network is being used by unauthorized users. Many users notice that pages load more slowly and video content constantly buffers, even with a high ISP plan. This could mean that neighbors or unscrupulous acquaintances have found a way to bypass your password and are now actively consuming your bandwidth.
The situation is exacerbated by the fact that modern gadgets require a constant connection, and bandwidth load increases every year. If several unknown smartphones or TVs are connected to your access point, the router may simply be unable to handle the data packets, resulting in unstable operation for all devices in the home. Control of connected clients — this is not just a matter of saving traffic, but also a basic necessity for ensuring the security of your personal data.
In this article, we'll take a detailed look at software and hardware methods for detecting intruders. You'll learn how to analyze router indicators, use specialized software to scan your network, and, most importantly, properly configure protection to prevent re-intrusion. Understanding How does authorization work? in the local network, will allow you to keep the situation under complete control.
Analysis of indicators and primary diagnostics
The first step in detecting unauthorized access is to monitor the physical state of your router. Most modern models are equipped with indicator lights that flash at a specific frequency when data is being transmitted. If you've turned off all your devices (smartphones, laptops, TVs), and the light with the symbol is on, Wi-Fi or WLAN continues to flash intensively, this is a sure sign of activity on the network.
However, relying solely on visual inspection isn't recommended, as background processes on your own devices can also cause indicator lights to flash. For example, cloud photo syncing or app updates can generate network traffic even when idle. Therefore, this method should be considered solely as a preliminary indicator for a more in-depth investigation.
⚠️ Note: Some router models have separate activity indicators for each LAN port, but the Wi-Fi indicator is often shared. Do not confuse the blinking Internet (WAN) indicator with the blinking local wireless network indicator.
For a more accurate diagnosis, you can temporarily disable the router's Wi-Fi module via the web interface or a physical button. If after this, the internet on devices connected via cable (if any) remains stable and the router's processor load decreases, then the problem was in the wireless segment. This will help isolate the source of the issue.
Using the router's web interface
The most reliable and accurate way to view a complete list of connected devices is to log into your router's control panel. This displays information directly from your network equipment, so the data will be as accurate as possible. To access it, open a browser and enter the gateway IP address, which most often looks like this: 192.168.0.1 or 192.168.1.1.
After entering your login and password (the default is often admin/admin, unless you've changed them), you need to find the section responsible for the wireless network. Depending on the model and firmware routerThis section may have different names: "Wireless," "WLAN," "Status," or "Client List." This is where the table with the MAC addresses of all active devices is located.
In the table you will see a list of identifiers. Each device has a unique MAC address, consisting of six pairs of hexadecimal characters. By comparing this list with your existing gadgets, you can easily identify an intruder. If you see a device you can't identify, that's cause for concern.
☑️ Router security check
Below is a table with example section names for popular hardware manufacturers to help you navigate the interface:
| Manufacturer | Section title | Path to the menu |
|---|---|---|
| TP-Link | Wireless Statistics | Wireless -> Wireless Statistics |
| ASUS | System Info / Network Map | Network Map -> Clients |
| Keenetic | Client list | My Networks and Wi-Fi -> Home Network |
| D-Link | Active Users | Status -> Active Users |
If the list includes devices with a "Static" or "Reserved" status, but you haven't configured them, this may indicate an attacker has already established a foothold on the network. In this case, you should immediately change the password and reboot the equipment.
Specialized programs for PC
If you find logging into your router settings difficult or have forgotten your administrator password, you can use third-party computer software. These utilities scan your local network and provide a detailed report on all detected nodes. One of the most popular and functional tools is Wireless Network Watcher from NirSoft.
This utility requires no installation and works immediately after launch. It automatically detects your IP address and scan range, listing all active devices. The report displays the IP address, MAC address, network card manufacturer, and device name (if accessible via NetBIOS). This allows you to quickly identify whose phone or laptop is currently connected to the network.
Another powerful program is SoftPerfect WiFi GuardIt runs in the background and periodically scans the network. When a new device appears in the list of connected devices, the program beeps and displays a notification. It's the ideal tool for continuous, real-time security monitoring.
⚠️ Warning: Antivirus programs may detect network scanners as potentially unwanted software, as they use the same information-gathering methods as hackers. Add trusted utilities to exclusions or temporarily disable protection during scanning.
Using such software is especially convenient because it eliminates the need to remember complex paths to the router menu. However, keep in mind that these programs only work when the computer is turned on and connected to the same network you're testing. For continuous protection, it's better to configure the router itself.
Why does the program show Unknown Device?
Some operating systems (especially new versions of iOS and Android) hide their names online by default to enhance privacy. They may appear as "Unknown" or "Generic" in the scanner list, but their MAC address remains visible. Compare the first six characters of the MAC address with the manufacturer's table (OUI lookup) to determine the device type (e.g., Apple, Samsung, Xiaomi).
Mobile apps for network testing
For users who prefer to manage their network from a smartphone, there are numerous mobile apps available. These are particularly convenient, as they allow you to perform checks even when you don't have a computer nearby. Popular apps such as Fing or WiFi Analyzer, provide comprehensive information about connected clients.
The Fing app, for example, not only displays a list of devices but also identifies their type (camera, printer, phone) and operating system. Furthermore, it can run network security tests, checking for open dangerous ports or weak encryption protocols. This turns your phone into a handheld network administrator's tool.
It's important to note that for these apps to work correctly, your phone must be connected to the Wi-Fi network being scanned. Scanning via mobile internet (3G/4G) will not yield results, as you'll be on a different subnet. Also, some routers may block port scanning from mobile devices for security reasons.
The advantage of mobile solutions is their accessibility and simple interface. You can quickly scan through the list and check MAC addresses. If the app shows a device you don't recognize, it often allows you to immediately access the router settings (if you know the admin password) to block the intruder.
Signs of a break-in and circumstantial evidence
In addition to direct scanning methods, there are indirect signs that may indicate the presence of unauthorized access. One such sign is an unexplained change in your router settings. If you notice that the network name (SSID) has changed, the encryption type has been switched to WEP (less secure), or the administrator password has been changed without your knowledge, these are clear signs of compromise.
It's also worth paying attention to the behavior of your antivirus software on connected computers. If your firewall constantly reports incoming connection attempts from your local network, this could mean someone on your Wi-Fi network is trying to scan your devices for vulnerabilities. By gaining access to your Wi-Fi, the attacker is technically on the same local network as you.
Another warning sign is the inability to connect to the router settings. If you enter the correct administrator password but the system doesn't accept it, it means the password has been changed by an intruder. In this case, the only solution is a full reset of the router to factory settings, which will require you to set up your internet connection again.
Don't ignore these signals. Even if your internet speed is currently satisfactory, the presence of an unknown device on your local network creates the risk of website passwords being stolen (if HTTPS isn't enabled), as well as access to shared folders and files on your computers. Security should be a priority.
What to do if you find someone else's device
If you discover an unknown device during an inspection, you need to act quickly and decisively. First, change the password for your Wi-Fi network. Create a complex combination of upper- and lower-case letters, numbers, and special characters. The password must be at least 12 characters long. After changing the password, all devices will be disconnected, and you will have to reconnect your devices using the new key.
The second step is to change the password for accessing the router settings. The default admin/admin passwords are known to all hackers. Set a unique password that will be requested when attempting to change the router's settings. This will prevent an attacker from changing the network configuration in the future.
The third, and perhaps most important, step is enabling MAC address filtering. This feature allows you to create a "whitelist" of devices that are allowed to connect. Even if someone discovers your Wi-Fi password, they won't be able to connect because their MAC address won't be added to the allowed list in the router settings.
⚠️ Note: MAC address filtering is an effective measure, but it requires manual registration of each new device (guest smartphone, new tablet). If you frequently host guests, it's more convenient to create a separate guest network with limited access for them.
After completing these steps, it is recommended to update your router firmware to the latest version. Manufacturers regularly release updates to patch security holes. You can check for updates in the "System Tools" or "Administration" sections of the web interface.
Is it possible to track who connected?
Technically, you can only see the device's MAC address. It's impossible to identify a specific person by the MAC address, as it's simply an identifier for the network card. You can only guess whose device it is based on the manufacturer (for example, if your neighbor has an iPhone, and an Apple device appears in the list).
FAQ: Frequently Asked Questions
Can my neighbor see my files if he is connected to Wi-Fi?
If your computer doesn't have a shared folder configured with public access for all network users, direct access to files is difficult. However, if you're on the same network, an attacker could try to exploit vulnerabilities in the operating system or running services to gain access. Therefore, having an outsider on your network is always a risk.
Will my router reset if I unplug the power cord?
No, simply turning off the power (pulling the plug) does not reset the router. To reset it to factory defaults, press and hold the dedicated Reset button on the router for 10-15 seconds while the router is turned on. This will erase all settings, including your ISP login and password.
Why is the internet speed slow if no one is connected?
Slow speeds can be caused by a variety of factors: channel congestion from neighboring routers (especially at 2.4 GHz), physical obstructions (walls, mirrors), outdated equipment, or issues with your provider. Check your speed using a cable connection to rule out Wi-Fi interference.
How to block a device permanently?
The most reliable method is to add the intruder's MAC address to the blacklist in your router settings, if such a feature is available. If there's no blacklist feature, changing the Wi-Fi password and enabling whitelist filtering will guarantee that all devices except those you've authorized will be blocked.
Does the number of connected devices affect router wear and tear?
Yes, a large number of simultaneous connections increases the load on the router's processor and RAM, which can lead to overheating and a shortened service life. Furthermore, constant reconnections of "heavy" clients (such as torrents) can accelerate the wear and tear of the device's flash memory, which stores logs and settings.