The word "clip" in the context of wireless networks is most often a distorted pronunciation of the English term Client (client). When users ask "who's filming" or "who's the video," they usually mean the list of connected devices— Clients List or Attached DevicesUnderstanding which devices are currently using your hotspot is fundamental to digital hygiene and security.
Visually, in the router interface, this looks like a table where all active connections are displayed. Network administrator You should regularly check this list to rule out traffic theft or man-in-the-middle attacks. If you see a device you can't identify, it's a reason to immediately change passwords and encryption settings.
Modern routers provide sufficient tools to not only view but also manage every connection. We'll explore how to interpret client data, the various network hiding methods, and how to properly block unwanted devices without disrupting your own devices.
Interpreting the list of connected clients
The first thing a user encounters when entering the router control panel (usually at the address 192.168.0.1 or 192.168.1.1), is the status section. It displays a table of active connections. Each row contains critical data: MAC address, IP address, device name (Hostname), and Lease Time. The device name is often taken from the device's settings, but it's not always a reliable source of information.
A MAC address is a unique identifier for a network card, hardcoded by the manufacturer. It consists of six pairs of hexadecimal digits. The first three pairs (OUI) identify the hardware manufacturer, which helps identify what's connected: a phone. Samsung, laptop Apple or a smart socket TuyaHowever, if you see a device named "Android-1234" or just a string of characters in the list, it could be your old tablet or someone else's smartphone.
⚠️ Warning: Device hostnames can be changed by the user or be the default factory names. Do not rely solely on the name "Ivan Phone," as the attacker may have renamed their device to disguise their identity.
The lease time indicates how long a device is allowed to use the assigned IP address. If the timer is constantly reset or the time is very short, this may indicate active data exchange or frequent reconnections. For accurate identification, it is recommended to compare MAC addresses with the labels on your personal devices.
Methods for detecting hidden and foreign devices
Not all devices display correctly. Some operating systems, especially iOS And Android In newer versions, the "Private Wi-Fi Address" feature is used by default. This means the device generates a random MAC address for each network to hide its true identity. In the router's client list, such a device may appear as "Unknown" or have a strange MAC address that doesn't match the one on the label.
To detect such devices, additional traffic analysis methods are required. The standard router interface doesn't always display protocol details. If you suspect a hidden miner or packet sniffer, it's worth using specialized software on your PC, such as Wireshark or Fing (on a smartphone). These tools scan the network deeper, identifying open ports and operating system types.
- 📱 Mobile scanners: Apps like Fing or Network Scanner will quickly display all active IP and MAC addresses on your local network, often identifying the device model more accurately than the router.
- 💻 Command line: On the computer you can enter the command
arp -ato see a table of IP and MAC addresses that your PC has accessed. - 🌐 Analysis of indicators: A sharp flashing of the WLAN indicator on your router while all your devices are turned off is a sure sign of background activity by an intruder.
It's also worth paying attention to the channel load. If the internet speed drops during certain hours, and the router's client list is empty or full of "unknown" devices, someone may be using tools to hide their presence, although modern routers rarely allow complete concealment of the connection.
What is MAC filtering and will it help?
MAC filtering is a whitelist or blacklist of addresses. In "Allow Only" mode, connections from any other address will be blocked at the router driver level. This is effective, but inconvenient for guests.
Practical steps for blocking and disabling
If a foreign device is detected in the client list ("clients"), it should be blocked immediately. Most modern routers (TP-Link, ASUS, Keenetic, Xiaomi) have a "Blacklist" or "Block" feature directly in the client list interface. There's usually a lock or trash can icon next to the device's name. Clicking it adds the MAC address of the offending device to the blocked list.
However, simply blocking the interface is a temporary measure. An experienced user can bypass it by changing the MAC address of their network card (MAC spoofing) to that of an authorized device. Therefore, after blocking, more serious action is required. The first step should always be changing the WiFi password and simultaneously changing the encryption type.
☑️ Emergency Network Security Checklist
It's important to understand the difference between blocking and disassociating. Blocking denies access to a specific address but leaves the network open to other attacks. Disassociating terminates the current connection, but the device can attempt to reconnect. The most secure method is to completely change the encryption key and put the router in a mode where new connections require physical confirmation (for example, a WPS button, although its use is not recommended due to vulnerabilities; it's better to use a guest network for temporary access).
| Action | Efficiency | Difficulty for the offender | Impact on your devices |
|---|---|---|---|
| MAC blocking | Low | Low (easy to change MAC) | Absent |
| Changing your WiFi password | High | Medium (brute force required) | Requires reconnection of all gadgets |
| Hiding the SSID | Average | Medium (requires scanner) | You need to enter the network name manually. |
| MAC Filter (White List) | Maximum | High (need an exact clone) | High (difficult to add guests) |
Setting up a hidden network (Hidden SSID)
One popular, but not a panacea, security method is hiding your network name (SSID Broadcast). When this feature is enabled, your router stops broadcasting packets with your network name. Your network won't appear on neighbors' and passersby's lists of available Wi-Fi networks. However, this doesn't make your network invisible to professionals.
Specialized software easily sees “hidden networks” (marked as <Hidden> (Or simply by BSSID). Moreover, when your legitimate device (phone or laptop) attempts to connect to a hidden network, it actively broadcasts requests with the network's name, allowing its name to be intercepted. Therefore, hiding the SSID protects against "nosy neighbors," but not against hackers.
⚠️ Caution: Hiding the SSID may cause connection issues with some smart devices (IoT), such as older robot vacuums or light bulbs that are unable to detect hidden networks. Use this feature with caution.
To activate this feature, find it in the wireless settings (Wireless Settings) option Enable SSID Broadcast and uncheck it, or select the option Hide SSIDAfter this, you will have to manually enter the network name on all devices, observing the case of the letters.
Using Guest Mode and VLANs
The most civilized way to answer the question "who's filming?" and control guests is to use a Guest Network. This is a virtual access point with a separate username and password. The main advantage of Guest mode is isolation. Devices connected to the Guest Network have internet access but cannot see your primary devices (NAS, printers, files on your PC).
This solves the trust issue. You can give your password to guests without worrying about their virus-infected smartphone gaining access to your personal information. Furthermore, modern routers (e.g., Keenetic or MikroTik) you can set speed and time limits for the guest network.
- 🛡️ Safety: The main network remains hidden and accessible only to the family.
- ⏱️ Timer: You can set up automatic shutdown of guest WiFi at night.
- 🚫 Resource Limitation: Guests will not be able to download torrents, saturating the entire channel if you set a speed limit.
For the corporate segment or advanced users, the following setting is recommended: VLAN (Virtual Local Area Network). This allows for logically dividing the network into segments. For example, CCTV cameras can be placed in a separate VLAN without internet access but with access to the DVR, while employees' smartphones can be placed in another. This is the ultimate in clip and traffic management.
Log analysis and long-term monitoring
The router interface only shows the current moment ("here and now"). To understand who was "filming" yesterday or the day before, you need to consult the system logs (System Log). The logs record connection and disconnection events, including MAC addresses and timestamps. However, the log volume is limited by the router's memory, and older entries may be overwritten by new ones.
For serious analysis, it is recommended to set up a remote log server or use cloud monitoring functions if the router supports them (for example, Trend Micro HomeCare on ASUS or Home Network Security). These services save connection history and can alert you to new devices via push notifications.
If you detect repeated password guessing attempts (multiple authentication requests from the same MAC address) in your logs, this indicates a targeted attack. In this case, a standard password change may not be enough—you may need to update your router firmware to the latest version to patch vulnerabilities in the WPS or WPA2 protocol.
How to find out the manufacturer of a device by MAC address?
The first six characters of a MAC address (e.g., 00:1A:2B) are called the OUI. Enter them into any online "MAC Address Lookup" service (e.g., macvendors.com), and the site will display the network card manufacturer. This will help you determine whether the connected device is an Apple, Espressif (often a smart device), or an Intel device.
Can my neighbor see my screen via WiFi?
Simply being connected to the same router doesn't grant you permission to see your screen. However, if you have "Network Discovery" enabled on your computer and there's no firewall, you can theoretically access shared folders. However, screen sharing (like in TeamViewer) is not possible without your permission and the password on your device. The risk lies in the interception of unencrypted traffic (HTTP), so use HTTPS and a VPN.
Why does the router show the device as "Offline"?
The "Offline" status in the client list means that the device previously received an IP address (the lease hasn't expired yet), but is currently inactive on the network. It may have fallen asleep, moved out of range, or been turned off. The router stores the lease record until the timer (Lease Time) expires so that it can quickly assign the same IP address when reconnecting.
What should I do if I can't access my router settings?
If you suspect a hack and can't access the settings (the administrator password doesn't work), the attacker has likely already changed it. The only solution is to physically reset the router using the button on the case (hold it for 10-15 seconds). This will restore factory settings, but will also disable everyone, including you, so set a new password immediately.