If you've ever noticed that your connection is slower than usual, that there are strange dropouts, or that the router is blinking even when you're not using the internet, you may have someone hooked up to your network. Detect intruders on your WiFi using simple commands and tools It is accessible to anyone; you don't need to be a system administrator.
Throughout this guide we'll see how to control who connects to your network, first with commands like arp -a, ipconfig, nmap and similar programs, and then with Windows programs, Android/iOS apps and options from the router itself. The idea is that you can identify unknown devices, block them, and strengthen security. so they don't sneak in again.
Why is it so important to know who connects to your WiFi?
Beyond the fact that they "steal megabytes" from you, Having unknown devices connected to your WiFi is a serious security problem.Anyone who connects to your network is, in a way, inside your digital home.
On one hand, They can consume your bandwidth Downloading like crazy, streaming in 4K, or playing online, which translates into a slow connection, interruptions, and even some devices running out of IP if the router has a client limit.
But the most delicate issue arises when we talk about privacy: A knowledgeable intruder can attempt to spy on traffic, attack other devices on your network, or sneak in malware.If your router is misconfigured, it could even access control panels, shared folders, or IP cameras.
There is also a legal factor that should not be forgotten: Everything done on the Internet from your connection is associated with your public IP address.If someone commits a crime using your WiFi, the first door they'll knock on won't be theirs, but yours.
That's why it's crucial that you know, at all times, what devices are connected to your networkLearn to recognize your devices by their MAC address or hostname, and never ignore an unknown computer "because, well, nothing will happen."
Detect intruders using the ARP protocol and commands
One of the most powerful and direct ways to see who is on your local network is to take advantage of the ARP tableARP (Address Resolution Protocol) relates IP addresses to physical addresses or MAC of each network card, wired or WiFi.
The idea is simple: If you check the ARP table from your computer, you get a list of IPs and MACs recently detected on your LANThat gives you a good starting point for catching intruders and block suspicious network connections with commands.
View the ARP table in Windows with arp -a
In Windows, all of this is done from the command console. The first step is to open a command prompt window:
- Open the Start menu and type runPress Enter.
- In the Run window, type cmd and confirm with Enter.
Once you have the black window open, you can type arp and press Enter to see the available options, but what interests us is the specific command:
arp -a
This command shows all the ARP entries that the team has at that timeYou'll see a list with IP addresses, physical (MAC) addresses, and the type (usually "dynamic"). Your router, computers, mobile phones, televisions, etc., will appear there.
For example, if your PC has IP address 192.168.1.41, you will usually see the gateway (192.168.1.1), other computers (192.168.1.2, 192.168.1.3, etc.) and any device that has spoken to your computer on the network. That list is a pretty accurate picture of who's using your WiFi and wired LAN..
How to find out your own MAC address
To be able to distinguish the intruders, the first thing is to keep track of the MAC addresses of your own devicesThis way you can mark as suspicious anything you don't recognize.
In Windows, the most direct way is to use the command:
ipconfig / all
It can also be run from the console (cmd) and displays a lot of network information. Find the adapter you use to connect to WiFi or cable (for example, “Wi-Fi Wireless LAN Adapter”). There you will see a field called “Physical Address”: that is the MAC address of that device.
It is also easy to find in other systems: on Android You can find it in Settings > About phone > Networks (or similar), where the WiFi MAC address, Bluetooth MAC address, and even the IMEI usually appear. On iOSGo to Settings > General > About and you'll see a "Wi-Fi Address" field with the MAC address of your iPhone or iPad.
Other powerful commands: nmap, ip neighbor, and more
If you want to go a step further and do a active network scanningInstead of limiting yourself to the ARP table, you can use tools such as Nmap, available on Linux, macOS and also on Windows.
Imagine that your network is 192.168.1.0/24 (the typical home network). With nmap you can find out which IPs are active with a command like this:
nmap -v -sP 192.168.1.1/24 | grep down -v
That scan returns a list of all active IPs on that subnet. From there, you just need to identify which devices are yours (PC, mobile, console, smart TV, etc.) and see if any seem out of place. If a suspicious IP address appears, the next step is to find its MAC address.
To do that, you can use ARP pointing to that address, for example:
arp -n 192.168.1.101
With this you now have the two key pieces of information about the intruder: your local IP address and your MAC addressLater we will see how to use them on the router to block access through MAC filtering.
On Linux and macOS, in addition to nmap, You can use commands like ip neighbor to see the IP-MAC associations detected on the network, which are another perspective on the same thing that ARP shows.
Windows programs to view computers connected to the network
If you don't feel like fighting with the console, Windows has free network scanners that do the work for you, launching pings to all the IPs on your LAN and presenting the information in a very visual way.
One of the most popular is Angry IP ScannerIt's free, easy to use, and installs in just a couple of clicks. It requires Java to be installed, but in return, it works on Windows 7, 8, 10, and later versions.
When you run the program, You specify the IP range of your network (for example, 192.168.1.0/24) and click on ScanIn a few seconds you will see a list with each detected device, its IP address, its MAC address, in many cases the hostname and even the manufacturer.
The advantage of this tool is that They put everything on your network right in front of you at a glance.If you see a device name or MAC address that you don't recognize, be suspicious. At best, it's something of yours that you'd forgotten about. At worst, it's a greedy neighbor.
Android and iOS apps to detect intruders on your WiFi
If you tend to use your mobile phone more than your computer, You can also scan your WiFi network from Android or iOS using specific apps that analyze the LAN and list all connected devices.
One of the best known is FingAvailable on both Android and iPhone. Open the app, grant permissions, start a scan, and in a few seconds It shows you each device with its IP, MAC, manufacturer and type. (mobile phone, TV, printer, camera, etc.). It's quite easy to tell who's who.
Besides Fing, there are alternatives such as NetX Network Tools o Network Scanner on Android, which offer similar features: They explore the local network and show everything that's up there.Many even allow you to perform ping, traceroute, or basic port scans.
Some of these apps offer the option to mark a device as known or unknownSo, the next time you scan, you'll be notified if anything new or unusual appears on your Wi-Fi. It's a convenient way to maintain some control without having to constantly access your router.
In some advanced applications it is possible try to "eject" a device from the mobile phone itselfHowever, most of these functions require root access or special permissions, and they aren't always effective. The most reliable approach, as we'll see, is to access the router directly.
Check the devices connected to the router
The most direct way to find out who is using your WiFi is usually access the router's administration panelVirtually all of them include a section that lists the connected devices.
The usual thing to do is open a browser and type something like this into the address bar: 192.168.1.1 or 192.168.0.1These are usually the default gateways for many routers. If you're unsure, you can find your gateway by running ipconfig on Windows or by looking at the network settings on your mobile phone.
Once the router page loads, you will need to Enter administrator username and passwordIf you've never changed it, it will be on a sticker on the device itself or in the operator's documentation. It's very often something like admin/admin, admin/1234, or similar… and that's precisely why it's a good idea to change it as soon as possible.
Next, look for a menu with names like this: “Connected Devices”, “Network Map”, “LAN”, “DHCP Clients”, “Device List” or similar. On routers from operators like Movistar, Euskaltel and others, there is usually a screen where you can see the router, internet access and all the devices connected at that moment or in the last few hours.
In more advanced models (for example, some FRITZ!Box), You can see separately what's connected via cable and what's connected via WiFi....and even a history of devices that connected in the past. That's great for detecting possible intrusions that occurred while you were not at home.
Locate and recognize MAC addresses of your devices
To be able to identify an intruder with any degree of accuracy, it is key have a list of the MAC addresses of all your legitimate devicesThink of the MAC address as the license plate of each network card: it is (in theory) unique and permanent.
- En WindowsWe've already seen that it's enough to open cmd and use ipconfig / allLocate the adapter you use to connect and note the "Physical Address" (six pairs of characters separated by hyphens). Repeat the process on each PC in the house.
- En MacOSGo to System Preferences > Network, select the interface you're connecting with (WiFi or Ethernet), and click on Advanced and open the tab HardwareThere you will find your MAC address.
- En AndroidGo to Settings, then Wi-Fi or Connections and look for the Advanced Information or Status section; depending on the brand, You will see the WiFi MAC address of the phone or tablet.. In iOSAs we mentioned, it's in Settings > General > Information, in the "Wi-Fi Address" field.
Consoles also count: in PS4 Go to Settings > Network to see MAC address for wired or Wi-Fi connections; PS5Go to Settings > Network > Connection status > View connection status. An XboxOpen the guide, go to Profile and system > Settings > Network settings > Advanced settings. On Nintendo SwitchGo to Console Settings > Internet and at the bottom you will see the console's MAC address.
Identify the intruder by comparing it to the router's table.
Once you have your sheet (or note on your mobile) with all the authorized MAC addresses, tap compare with what the router indicates as connectedThis is the moment of truth.
On the router's control panel, within the connected devices section, you will usually see the Internal IP (of type 192.168.1.X), the MAC address, sometimes the name of the device and, hopefully, the manufacturer.
Now it's a matter of reviewing them one by one: Mark as “OK” the MAC addresses that match those on your list (home phones, game consoles, computers, smart TVs, home automation devices...). If you find something that no one in the family recognizes, or that doesn't match anything you have listed, you have a potential intruder.
Many modern routers allow this assign a friendly name to each devicewhich is great so that later, at a glance, you can see "Juan's Mobile", "Living Room Laptop", "Dining Room TV", etc. and only the unusual items will be left without a name.
If your router is very basic and only shows you one current ARP table without historyYou'll need to check at various times throughout the day, because the intruder might only be online at certain hours. It's a good idea to keep an eye on things when you notice the network is slower or when you know that the internet isn't being used much at home.
Block and expel intruders: MAC filtering and password change
Once you've located the MAC address of a device that shouldn't be there, it's time to close the door to your networkThere are several ways to do it, some more forceful than others.
MAC filtering on the router
Almost all routers include some kind of system access control by MAC addressIt is usually found in menus such as "Access Control", "Access Control", "MAC Filter" or similar.
The general logic is as follows: you choose whether you want a Whitelist mode (only allowed MAC addresses can connect) or blacklist mode (the MAC addresses you specify are blocked)To expel a specific intruder, the usual and fastest way is to use the lock mode.
You just need to copy the suspicious MAC address from the list of connected devices and Add it to the list of blocked addresses for the 2,4 GHz and 5 GHz bandsThen you save the changes and, normally, the router will immediately cut off the connection to that device.
However, it's important to understand that MAC filtering... not infallibleSomeone with advanced knowledge can change the MAC address of your SIM card to spoof that of an authorized device. Even so, for the typical home intruder or "smart" neighbor, it's usually more than enough of a barrier.
Change the WiFi password and the router password
Regardless of whether you use MAC filtering, what's really important is Change your WiFi password As soon as you know someone has entered without permission, report it. If they've managed to connect even once, it means that password is no longer secure.
From the router itself or from your operator's website/app you can change the wireless network passwordIt should ideally be at least 15-20 characters long, combining uppercase and lowercase letters, numbers, and symbols. No proper names, birthdates, or easy patterns.
When you change your password, All devices will disconnect and you will have to re-enter it on mobile phones, computers, consoles, etc. It's a bit of a hassle, but it's the cleanest way to get rid of anyone who knew about it.
Do not forget either change the router's administrator passwordMany devices come with default passwords like admin/admin, 1234, or even "password". If an attacker has gained access to your Wi-Fi, they could try these default passwords and take control of the router if you haven't changed them.
After changing both passwords, it's a good idea completely restart the router This will close all sessions and ensure the changes take effect. From then on, only those with the new password will be able to reconnect.
Use the operator's website or app to monitor your network remotely
Many companies already offer customer dashboards and mobile apps where you can view and configure basic aspects of your connection without accessing the router directly.
Within these platforms there is usually a section where they are displayed the WiFi networks you have created, their name, password, and the number of connected devicesIn some cases, the information is as detailed as on the router itself: it shows you each device, its IP address, and its MAC address.
The advantage of this is that, even if you're away from home, You can check if someone is using your connection when they shouldn't.If you see a higher number of devices than expected, or if something unusual appears, you can take action from within that same app.
According to the operator, it is possible eject devices, activate MAC filtering, change the WiFi password, or even remotely turn off the routerIt's a pretty convenient way to cut off an intruder's access as soon as you detect them, without waiting until you get home.
In addition, many apps allow you to schedule. WiFi hours or temporarily disable certain networks (such as the guest network), which reduces the attack surface when you are not using the connection.
Real dangers of having intruders on your WiFi
Beyond the annoyance of going slowly, Allowing someone to connect to your WiFi without permission can have quite serious consequences. if things get complicated.
First, there is the Information theftIf your network or devices are poorly secured, a skilled attacker can attempt to access your equipment, steal passwords, private documents, photos, credit card data, etc., and even use your connection to launch attacks against third parties.
There is also the unauthorized use of the network for downloading illegal content, making VoIP calls, sending spam, or committing fraudAll of those activities are associated with your connection, which could get you into trouble if there's an investigation.
We must not forget the malware riskAn intruder could use the network to spread viruses, Trojans, or ransomware to other devices in your home. In the worst-case scenario, you could be forced to format computers or lose data.
Finally, if you have a limited router, the mere fact that someone connects can remove IP addresses from some of your devices or saturate the bandwidth to the point of making the network almost unusable. In other words, you pay for a connection that you can barely use.
Security measures to protect your WiFi
Once you've mastered how to detect intruders, the next step is leave the network as secure as possible to make it much harder to sneak in. This is the best advice:
- Disable WPS (Wi-Fi Protected Setup) of the router. This system, designed to connect by pressing a button or using a PIN, is very convenient, but it has also had significant vulnerabilities and can be an entry point for automated attacks.
- Make sure you are using WPA2-Personal encryption with AES. Or, if your router supports it, WPA3-Personal. Avoid WEP and WPA/TKIP at all costs, as they are completely obsolete and relatively easy to crack.
- Use a long, complex key that doesn't make obvious sense.A strong password with symbols and numbers is better than something like “wifiCasa2020”. You can even check the approximate strength of your password using tools that estimate how long it would take a brute-force attack to crack it.
- Keep the updated router firmwareMany models receive security patches that close known vulnerabilities; if you never go into that section, you may have been using a vulnerable version for years.
- Create a guest WiFi networkThis way, you connect friends and family to that separate network and keep your main network, where you have computers, NAS, cameras, and so on, much more isolated.
Is it legal to "steal" your neighbor's WiFi?
From a legal standpoint, the answer is clear: Connecting to a private WiFi network without permission is a crime.In Spain, this type of conduct falls under the Penal Code, with articles that punish fraud related to services such as electricity, gas, and also telecommunications.
On a practical level, it is considered similar to to take advantage of another's supply without payingFurthermore, in certain cases it may be accompanied by more serious crimes, such as discovery and disclosure of secrets, harassment, identity theft or fraud.
To be able to report this type of intrusion, it is usually helpful to have technical dataThis includes things like the MAC address of the intruding device and router logs that prove the unauthorized connection. It's also important that your Wi-Fi has a password: if you leave it completely open, it becomes much harder to prove.
In any case, beyond the legal theory, what's important for you as a user is not to make it easy for anyoneIf your network is well protected, you change passwords from time to time, and you regularly check connected devices, you greatly reduce the chances of unpleasant surprises.
Limit or increase the number of clients on your router
Some home routers allow Configure a maximum number of IP addresses that the DHCP server assigns.This means that if you set a limit (for example, 10), the router will only assign automatic IPs to the first ten devices that connect.
This feature can be used as an extra layer of control, although it is not a magic solution. If you have few devices at home, limiting the number of clients can prevent many from sneaking in at once.But you can also leave out some legitimate teams if you fall short.
In some operator models, such as certain Movistar routers, this option is usually found in Advanced settings > Wireless > Max Clients or similar, where you can specify the maximum number of devices that the 2,4 GHz and 5 GHz networks will accept.
From a security standpoint, it makes more sense to use it as a complement to strong passwords and MAC filtering, not as a standalone tool. The only mechanism to prevent WiFi theftIn fact, if your network is well protected, you'll usually prefer to have headroom for new devices that come into your home.
However, if you find that the client limit is excluding legitimate devices because an intruder is monopolizing IPs, then it makes sense. Increase that limit and, at the same time, block the suspicious device and change the password..
Everything we've seen so far allows you Control your network with great precision: know who connects, detect them with commands and programs, locate their MAC address, block them on the router, strengthen WiFi security, and, if necessary, use the operator's app even when you're away from home.With a few simple habits—occasionally checking connected devices, updating firmware, using strong passwords, and disabling insecure features like WPS—you can make your home network quite tough for any occasional intruder trying to sneak in.
