When the internet starts to slow down or access to local resources suddenly disappears, it often makes the administrator think about the security of the network perimeter. Who's connected to Mikrotik via WiFi? — this is one of the most common queries that arises when diagnosing such problems. Unlike simple home routers, where the client list is hidden behind a primitive interface, the equipment MikroTik Provides the most comprehensive tools for connection auditing.
However, the abundance of menus and terminology can be confusing even for an experienced user. Understanding the difference between DHCP Lease And ARP Table Not everyone succeeds on the first try. In this article, we'll examine all available device identification methods, explain how to distinguish a legitimate device from an intruder, and show you how to effectively manage access.
Monitoring connected subscribers isn't just a curiosity; it's a fundamental necessity for maintaining network stability. Knowing the exact number of active sessions helps avoid channel congestion and prevent traffic theft. Below, we'll explore the technical aspects of monitoring in detail.
⚠️ Attention: The RouterOS interface is updated regularly. The location of some menu items may differ between v6 and v7, and package functionality (e.g., Wireless or Wifi) depends on the installed license and device model.
DHCP Lease Table Analysis
The easiest and fastest way to see who's on your network is to look at the DHCP lease table. Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses to all devices that request network access and don't have static settings. In the menu IP → DHCP Server → Leases You will see a list of everyone who has recently received an address from your router.
It is important to understand that the presence of an entry in this table does not always mean that the device is actively transmitting data right now. DHCP Lease Shows the history of leases within the lease time. If a client left the coverage area an hour ago, but the lease time is 24 hours, their record will still appear in the list with the status waiting or bound.
For accurate identification, pay attention to the column MAC Address And Host Name. Often the device name (eg. Ivan-iPhone or LivingRoom-TV) immediately makes it clear who the gadget belongs to. If you see obscure names like android-xyz or no name at all, it is worth checking the MAC address through the online databases of manufacturers.
Experienced administrators often use the filter in the window Leasesto sort active rentals. By clicking the filter icon, you can set a condition. dynamic=yesto hide static entries you created manually. This helps you focus on the devices that connected automatically.
⚠️ Attention: An attacker can change the MAC address of their network card (spoofing) to copy the address of a trusted device. This could cause a conflict in the DHCP table or update the entry with a new lease time.
Monitoring via ARP Table
A more technically accurate method of checking is to analyze the ARP table. The Address Resolution Protocol (ARP) maps IP addresses to physical MAC addresses at the data link level. By going to IP → ARP, you will see a list of matches that the router knows at the moment.
The main difference from DHCP Lease is that the ARP entry only appears when the device is actually exchanging packets with the router. If the device is simply "sleeping" on the network and not generating traffic, it may not appear in the ARP table, even if it has an IP address. Entry status dynamic indicates that it was created automatically in response to network activity.
Using ARP Table, you can identify devices with static IP addresses that have bypassed the DHCP server. Such clients won't appear in the lease list, but they will definitely appear in the ARP, as data transfer is impossible without it. This is a critical tool for finding "silent" offenders.
Why doesn't ARP list all devices?
An entry in the ARP table is valid for a limited time (usually a few minutes). If the device hasn't transmitted packets during this period, the entry is deleted to conserve router memory. To force an update, you can send a ping request to the entire network range.
For ease of viewing large lists in WinBox you can sort the column InterfaceThis will allow you to separate clients connected via Wi-Fi (usually wlan1 or wifi1), from those connected via cable. This filtering will instantly answer the question of who exactly is connected wirelessly.
Using Registration Table for Wi-Fi
The most specific and accurate tool for wireless networks is the registration table (Registration Table). It is available in the section Wireless (for old interfaces) or Interfaces → Wifi (for new wifi-qcom/ac packages). Only devices that have completed the association and authentication process with the access point are displayed here.
Unlike DHCP and ARP, this table shows the current state of the radio channel. You'll see not only the MAC and IP address, but also critical signal parameters: Signal Strength (signal level), Tx Rate (transmission speed) and Uptime (continuous connection time). This allows us to evaluate the connection quality of each individual client.
If you are looking for an answer to the question Who's connected to Mikrotik via WiFi?, the Registration Table will provide the most accurate picture of the wireless segment. It's impossible to miss a device that maintains an association, even if it didn't request an IP via DHCP (for example, if it has a static address).
| Parameter | Description | Where to watch |
|---|---|---|
| MAC Address | Physical address of the device | All tables |
| IP Address | Network address (if received) | DHCP, ARP, Reg. Table |
| Signal Strength | Signal level (dBm) | Registration Table Only |
| Uptime | Time since connection | Registration Table Only |
| Interface | Port or radio interface | ARP, Registration Table |
Pay attention to the column AuthorizedIf there is a value no, this means the device knows the password (or is attempting to connect to an open network), but is blocked by Access List rules or is blacklisted. This is a common situation when setting up guest access or MAC filtering.
Checking via Terminal and commands
For professionals who prefer the speed of working with a keyboard, the command line MikroTik offers the most powerful capabilities. Entering commands in Terminal Allows you to receive filtered lists of connected clients in a split second, which is especially convenient when working via SSH or a slow connection.
The basic command to view DHCP leases looks like this:
/ip dhcp-server lease printTo see only active rentals, you can add a filter:
/ip dhcp-server lease print where active=yesTo view the ARP table, use the command /ip arp print, and for wireless clients in the new package wifi (RouterOS v7) the command will look like this /interface/wifi/registration-table printIn the old version wireless team - /interface wireless registration-table print.
⚠️ Attention: When using commands in the terminal, be careful with the command removeDeleting an active DHCP Lease entry does not always block the device, but it may disrupt its network logic before the timer expires.
You can also display a summary of all connected Wi-Fi clients, sorted by signal strength. This will help you quickly identify "dead souls"—devices with critically low signal strength that are lingering on the network, generating noise but not delivering any useful data.
Identifying devices by MAC address
Often in the list of connected devices there are entries with incomprehensible names or without any names at all (for example, unknown). In this case, the only reliable identifier is the MAC address. The first six characters (OUI – Organizationally Unique Identifier) indicate the network card manufacturer.
There are many online services and databases that allow you to identify the vendor by the MAC address. For example, if the address begins with 00:1A:2B, the search will show that this equipment Apple. If B8:27:EB - this is most likely Raspberry PiKnowing the manufacturer helps you understand what kind of device is connected: a phone, a laptop, a security camera, or a smart plug.
Modern operating systems (iOS, Android, Windows 10/11) have the "Randomized MAC Address" feature enabled by default to enhance privacy. This means that each time a device connects to a new network (or even reconnects), it may present itself with a different MAC address. This complicates identification, as the same phone may appear as three different, unknown devices.
☑️ Unknown Client Verification Algorithm
If you see a sudden spike in connections and a lot of devices with randomized MAC addresses from the same manufacturer, this could be a sign of a deauthentication attack or network scanning, although more often these are just visitors with modern smartphones.
Blocking and access control
Once you have found out, Who's connected to Mikrotik via WiFi?If you've detected an illegal user, you need to block them. The most effective way is to use the Access List in the wireless network section. You can create a rule that prevents a specific MAC address from connecting.
To do this, go to the menu Wireless → Access List (or similar in the wifi package) a new entry is created. In the field MAC Address the address of the offender is entered, and in the Action (Action) is selected reject or just check the box Disabled (if the rule is added to the allowed list). You can also use the function Forwarding=noso that the device can connect, but does not have access to the Internet and local network.
An alternative method is blocking at the DHCP level. In the table Leases You can select the desired entry, right-click and select Make Static, and then uncheck the box Dynamic or click DisableHowever, this method is less reliable, as a smart user can simply manually enter a static IP address and bypass the block.
After making changes to the Access List or Firewall, it is recommended to reboot the wireless interface or ask legitimate users to reconnect so that the rules are applied correctly. Keep in mind that changes take effect immediately, but active sessions may only time out.
Frequently Asked Questions (FAQ)
Why can I see my device online but it doesn't work?
This may be due to an IP address conflict if two devices are assigned the same static address. The device may also be blocked by Firewall or Access List rules, or quarantined (Captive Portal). Check the status in the Registration Table.
Can the connected user see my files?
By default in MikroTik Client-to-Client port isolation is enabled (Client-to-Client forwarding is disabled) only in some guest network configurations. If this feature is not enabled, devices on the same subnet can see each other. For security reasons, it is recommended to enable isolation for guest Wi-Fi.
How can I find out how much traffic a specific Wi-Fi client is consuming?
The Registration Table contains the Tx/Rx Bytes columns, which show the volume of bytes transmitted and received since the connection was established. For detailed statistics on IP addresses, you can use the tool Tools → Torch, filtering traffic by wlan interface.
What should I do if there are more devices in the "unknown" list than I have?
Your devices are likely using MAC address randomization. Each new "virtual" connection appears as a new device. Compare the number of unique manufacturers (OUI) and connection times (Uptime) to match them with real devices.