Who's Connected to My MikroTik Wi-Fi: All the Ways to Check

Have you noticed your internet speed has suddenly dropped, and unknown devices have appeared online? Or do you simply want to monitor who's using your Wi-Fi connection? MikroTikUnlike consumer routers with simplified interfaces, this brand's equipment offers dozens of ways to monitor connected clients—from visual tools to in-depth traffic analysis. But without understanding the nuances, it's easy to miss important details: for example, not all devices appear in the standard list. DHCP Leases, if they use static IPs.

In this article we will look at 5 working methodsHow to see who is connected to your Wi-Fi MikroTik — from basic to advanced. You'll learn how to distinguish legitimate devices from shady ones, why some clients may not appear in standard reports, and how to block unwanted users in just two clicks. And for those who prefer automation, we'll show you how to set up email notifications about new connections.

Method 1: Viewing via Winbox (the easiest)

Winbox - is a proprietary graphical interface for management MikroTik, which can be installed on Windows, macOS, or Linux. It allows you to see all active connections in real time, not only via Wi-Fi, but also via cable. The main advantage of this method is visual clarity: MAC addresses, IP addresses, hostname (if the device is broadcasting one), and even the current data transfer rate are displayed here.

To open the list of connected devices:

• 🖥️ Launch Winbox and connect to the router (via MAC address, IP or local network search).
• 📊 Go to the section IP → DHCP Server → LeasesHere you will see all devices to which the router has assigned IP addresses via DHCP.
• 🔍 For viewing everyone connected clients (including those using static IPs), open IP → ARP.
• 📶 To see only Wi-Fi clients, go to Wireless → Registration Table.

Please note: in Registration Table are displayed All Devices that have ever connected to your Wi-Fi network, even if they are currently disconnected. To see only active clients, sort the table by column. Last Activity.

2. Method: Using WebFig (web interface)

WebFig - this is a web version of the interface MikroTik, which works directly in the browser. It's convenient if you don't have access to Winbox or you are on another device (for example, a smartphone). Functionality WebFig almost identical Winbox, but some sections here are less clear.

Instructions for viewing connected devices:

1. Open your browser and enter your router's IP address (usually 192.168.88.1).
2. Log in (the default login and password are often admin without a password, if you haven't changed it).
3. Go to IP → DHCP Server → Leases for a list of devices with dynamic IP.
4. For a complete list (including static IPs), please visit IP → ARP.
5. To see only Wi-Fi clients, go to Wireless → Registration.

IN WebFig There is one useful feature: if you hover over the MAC address in the table, a tooltip with the device manufacturer will appear (for example, Apple, Xiaomi or Samsung). This helps quickly identify unknown gadgets.

Method 3: Terminal commands (for experienced users)

If you prefer to work with the command line, MikroTik provides powerful tools for analyzing connected devices. Via the terminal (available in Winbox, WebFig or by SSH) can be obtained as detailed as possible information including connection time, protocol used (802.11n/ac/ax) and even signal strength.

Basic commands for viewing clients:

/ip dhcp-server lease print # List of DHCP clients
/ip arp print # List all devices in the ARP table
/interface wireless registration-table print # List of Wi-Fi clients

To see only active connections with traffic details, use:

/tool sniffer quick interface=wlan1

To filter results by a specific parameter (for example, only devices with IP from a certain range), use the flag where:

/ip dhcp-server lease print where address~"192.168.88"

Make sure you have access via SSH or Winbox

Check user rights (you need at least read level)

Save the current configuration (/system backup save)

Don't change the settings unless you are sure of the command-->

4. Method: Monitoring via log files

MikroTik Keeps detailed logs of all events, including device connections and disconnections from Wi-Fi. This is useful if you want to track When And how often An unknown client appears. Logs are stored in the section Logs and can be exported for analysis.

To view connection logs:

1. Open Logs V Winbox or WebFig.
2. Filter entries by keywords:
   • wireless,connect - successful connections.
   • wireless,disconnect - shutdowns.
   • dhcp — issuance of IP addresses.

Example of a log entry when connecting a device:

12:34:56 wireless,info wlan1: connected 00:1A:2B:3C:4D:5E (Xiaomi)

To automate monitoring, you can set up email notifications when new MAC addresses appear. To do this:

1. Create a script in System → Scripts:

:local newMac [:toarray [/interface wireless registration-table find where last-activity>5m]]
:if ([:len $newMac] > 0) do={
/tool ​​e-mail send to="your@email.com" subject="New Wi-Fi connection" body=("New devices detected: " . [/interface wireless registration-table get [find where last-activity>5m] mac-address])
}

2. Add a task to System → Scheduler, which will run this script every 5 minutes.

Method 5: Analyze traffic using Torch

Tool Torch V MikroTik allows in real time Monitor traffic passing through the router, broken down by IP and MAC address. This is the most effective way to identify "invisible" clients that may be hiding behind static IP addresses or using non-standard protocols.

How to use Torch:

1. Open Tools → Torch V Winbox.
2. Select an interface (eg. wlan1 for Wi-Fi).
3. Set the filter by protocol (eg. TCP or UDP) or leave Any for general analysis.
4. Click Start — a list of active connections will appear in the window, indicating the data transfer speed.

In the results Torch Please note:

• 📥 Unknown MAC addresses with high traffic (possible "pirates").
• 🔄 Devices that exchange data with external IPs (may indicate a botnet or data leak).
• 🕒 Connections during non-working hours (for example, at night when everyone is sleeping).

For in-depth analysis, you can export data from Torch to file:

/tool torch interface=wlan1 duration=1m file-name=traffic_analysis

How to block an unknown device

If you find a suspicious device online, there are several ways to block it. The most reliable is add a MAC address to the blacklist (MAC Filtering). This will prevent reconnections even after rebooting the router.

Blocking instructions:

1. Go to Wireless → Security Profiles.
2. Select the profile used by your Wi-Fi network (usually default).
3. Tab MAC Filter → Add the MAC address of the unwanted device to the list and select an action deny.
4. Apply the settings and restart the Wi-Fi interface (/interface wireless disable wlan1; /interface wireless enable wlan1).

Alternative blocking methods:

Common mistakes and their solutions

When trying to view connected devices, users often encounter common issues. Here are the most common ones and how to fix them:

Problem 1: On the list DHCP Leases Some devices are missing.

⚠️ Attention: Devices with static IP addresses are not displayed in DHCP Leases. Check the section IP → ARP or Wireless → Registration Table.

Problem 2: IN Registration Table Devices that have been disconnected for a long time are displayed.

• 🔄 Clear the table with the command /interface wireless registration-table remove [find].
• 🔧 Set up automatic cleaning in Wireless → Settings → Registration Timeout (set value 5m to remove inactive clients after 5 minutes).

Problem 3: Unknown devices continue to appear even after MAC blocking.

• 🔍 Check if the MAC address is cloned (compare with the original device).
• 🔒 Change your Wi-Fi password and turn it on WPA3 in security settings.
• 🛡️ Configure your firewall to block unauthorized connections:

/ip firewall filter add chain=forward src-mac-address=00:1A:2B:3C:4D:5E action=drop

Problem 4: After updating the firmware MikroTik stopped showing Wi-Fi clients.

⚠️ Attention: In some versions RouterOS (for example, 7.x) the menu location has changed. If the section Wireless → Registration Table missing, update firmware or use command /interface wireless registration-table print in the terminal.

FAQ: Answers to frequently asked questions

/queue simple add name="Limit_Device" target=00:1A:2B:3C:4D:5E max-limit=10M/10M