Slow page loading speeds, constant buffering when watching 4K videos, and sudden connection drops aren't always your ISP's fault. In most cases, the root cause is unauthorized access to your wireless network by unauthorized devices. If you've changed your password but the situation hasn't improved, it means someone has managed to gain access, or your current security key is too weak to be easily cracked.
Modern encryption algorithms WPA2 and WPA3 provide a high level of security, but human error often negates their effectiveness. Simple passwords like "12345678" or dates of birth can be cracked in minutes using automated scripts. That's why regular network audit is becoming a mandatory procedure for any router owner who wants to maintain the confidentiality of their data.
To detect intruders, there are numerous specialized utilities that scan the airwaves and compile a detailed list of all active MAC addresses. In this article, we'll examine the most effective tools for PCs and mobile devices and discuss the steps to take immediately after identifying an intruder.
Signs of unauthorized network access
The first warning sign is often unstable internet service during off-peak hours. If, on a weekday evening, when everyone is asleep or out, the router's lights continue to flash actively, transmitting large amounts of data, this is a clear sign of unauthorized activity. Traffic It may be spent downloading updates, watching streaming videos, or, worse, allowing your device to participate in botnets.
Another indirect sign is a decrease in response time in online games or the inability to conduct a video conference without delays. When the communication channel is overloaded with several unknown devices, bandwidth The bandwidth is divided among all participants, which critically impacts service quality. It's also worth paying attention to the blinking WLAN indicator on the router, which indicates a constant exchange of data packets.
⚠️ Warning: Some smart devices (cameras, speakers, IoT sensors) may transmit data in the background. Before panicking, make sure your gadgets aren't causing the traffic spikes.
For accurate diagnostics, it's necessary to use specialized software that will show not only the connection but also the device type. This will help you distinguish a neighbor's smartphone from a forgotten tablet or smart plug. Without visualizing the connection list, troubleshooting is virtually impossible.
Programs for checking Wi-Fi on a computer (Windows, macOS, Linux)
The most powerful tools for network security analysis are traditionally available on personal computers. Desktop versions of programs often offer more extensive functionality than their mobile counterparts, providing detailed information about each node. One of the most popular utilities is Wireless Network Watcher from NirSoft, which works without installation and instantly scans the local network.
This program displays the IP address, MAC address, device name (if available in DNS), and network adapter manufacturer. The utility's convenience lies in the ability to sort the list and highlight new devices in color. For more advanced users working on Linux or macOS, this is an excellent choice. Angry IP ScannerThis is a cross-platform, open-source application that allows you to scan not only your local network but also remote address ranges.
It's important to note that for these programs to function correctly, the computer and devices being scanned must be on the same subnet. In corporate networks or complex home configurations with multiple routers (access point mode), scanning may not provide a complete picture. In such cases, each network segment must be analyzed separately.
Why might antivirus software complain about network scanners?
Some antivirus programs detect active port scanning and pinging as an attack. If you use WireShark or Angry IP Scanner, add them to the exceptions list or temporarily disable network protection.
Another powerful tool is Wireshark, however, it requires in-depth knowledge of TCP/IP protocols to correctly interpret the data. It's a professional sniffer that displays every packet passing through an interface. It may be overkill for a quick "who's using the Wi-Fi" check, but for detecting traffic anomalies, there's nothing better.
Mobile apps for Android and iOS: control from your phone
A smartphone is the most accessible device for quickly checking Wi-Fi security. Mobile apps allow you to audit your network without turning on your computer. For the Android platform, the app remains the market leader. FingIt not only displays a list of connected devices, but also identifies their type (TV, phone, printer) with high accuracy using a MAC address database.
iOS users can also take advantage of the app's functionality. Fing or something similar Network AnalyzerHowever, due to limitations of the iOS operating system, scanning may be less detailed than on Android. Apple strictly controls app access to network interfaces, so some features available on the "green robot" may be limited or require additional permissions.
- 📱 Fing — a market leader that identifies device brands, checks internet speeds, and checks for open ports.
- 📡 WiFi Analyzer — more focused on channel and signal level analysis, but has a client list function.
- 🛡️ Kaspersky Who Is On My Wi-Fi — a simple application from a well-known antivirus vendor, focusing on security.
When using mobile scanners, it's important to remember about local network access permissions. In modern versions of Android (starting with 10) and iOS (starting with 14), you must explicitly allow the app to access devices on the local network when you first launch it. Without this permission, you'll only see your phone and gateway, but not other devices.
The most reliable method: checking through the router's web interface
No third-party program will provide more accurate information than the router itself. The router's administrative panel is the source of truth, as it manages the allocation of IP addresses via DHCP and maintains the ARP table. To access it, you need to enter the gateway IP address (most often 192.168.0.1 or 192.168.1.1) in the browser's address bar.
After logging in (the login and password are usually found on a sticker on the bottom of the device), find a section with a name like "Status," "Network Map," "WLAN Clients," or "DHCP Server List." This section displays all devices that have currently received an IP address. The advantage of this method is that it works even if the device is in sleep mode but has already logged in to the network.
Interfaces from different manufacturers vary greatly. TP-Link This is often the "Wireless Statistics" section, ASUS — "Network Map", and MikroTik You need to look in the "Leases" menu under DHCP. Despite the differences in names, the essence remains the same: you see a list of MAC addresses of all connected devices.
| Router manufacturer | Typical entry address | Section to check | Peculiarities |
|---|---|---|---|
| TP-Link | 192.168.0.1 | Wireless -> Wireless Statistics | Shows the current connection status (Enabled/Disabled) |
| ASUS | 192.168.1.1 | Network Map -> Clients | User-friendly graphical interface, device type visible |
| D-Link | 192.168.0.1 | Status -> Wireless | Switching to advanced mode is often required |
| Keenetic | 192.168.1.1 | Client list | Shows the device name and connection history |
It is through the web interface that it is easiest to carry out MAC filteringYou can copy the addresses of your trusted devices and block access for all others. This is the most radical, but also the most effective, protection method, which we'll discuss in the security measures section.
⚠️ Note: The interface and menu names may vary depending on your router's firmware version. If you can't find the item you need, check the official instructions for your specific model on the manufacturer's website.
Analysis of the obtained data: how to distinguish your own from someone else's
A user may feel overwhelmed when presented with a list of 10-15 devices. How can they figure out what this "Unknown Device" is or why there are so many of them? The first step is to disable Wi-Fi on all known devices (TVs, phones, laptops). Any devices that remain active on the list are highly likely to be someone else's.
The second method is MAC address analysis. The first 6 characters (for example, A4:5E:60) identify the manufacturer of the network chip. Using online services to check the OUI (Organizationally Unique Identifier), you can find out the brand of the device. If you see the manufacturer "Honor" or "Xiaomi" but don't own any devices from these brands, this is cause for concern.
It's also worth paying attention to device names (Host Name). Users often don't change the factory names, and the list might include "Ivan-iPhone," "LivingRoom-TV," or "Printer-HP." The presence of the name "Android-7f3a2b" could indicate either a guest's phone or someone else's laptop. If the number of devices on the list exceeds the number of your own devices, it's time to sound the alarm.
☑️ Checking the list of devices
What to do if you find a stranger: protective measures and blocking
The first and most important step upon detecting a rogue device is to immediately change your Wi-Fi password. Don't just "add a number"; set a new, complex key containing mixed-case letters, numbers, and special characters. After changing the password, all devices will be disabled, and you'll have to re-enter the new key on your devices.
The second step is to disable the function WPS (Wi-Fi Protected Setup). This technology, which allows you to connect by pressing a button or using a PIN code, is one of the most vulnerable. Attackers can brute-force the WPS PIN code in a few hours, even if the master password is complex. Find this feature in the router's web interface and set it to "Disable."
The third level of protection is MAC address filtering. You can configure your router to allow only a strictly defined list of devices onto the network. Even if an attacker knows your password, they won't be able to connect because their MAC address will be blacklisted or not whitelisted. This is a labor-intensive process that requires manually registering each new device, but it guarantees 100% protection against accidental connections.
Don't forget about physical security either. If your router is located near a window on the first floor, the signal could reach the entire building. You can reduce the transmitter power (Tx Power) in your router settings so that the signal covers only your apartment and not extends beyond it.
Frequently Asked Questions (FAQ)
Can my neighbor see what websites I visit if he's connected to my Wi-Fi?
If the connection isn't secured with HTTPS, this is theoretically possible. However, modern browsers and apps use encryption by default. Your neighbor will be able to see that you're logged into YouTube or VKontakte, but they won't be able to read your messages or see your passwords if you use two-factor authentication and HTTPS.
Why does the program show more devices than I see in the router settings?
This may be due to data caching. The router may store entries in the ARP table for previously connected devices, even if they are currently offline. Also, some programs may treat virtual interfaces or network bridges as separate physical devices.
Is it safe to use free Wi-Fi test software?
Most well-known free utilities (such as Fing or Wireless Network Watcher) are safe. However, avoid dubious "signal boosters" or "password crackers," which often contain adware or viruses. Download software only from the developers' official websites.
What is a guest network and will it help?
A guest network is an isolated segment of your Wi-Fi network. If you share the guest network password with your friends, they'll have internet access but won't be able to access your files, printer, or router admin panel. This is a great way to secure your main network.