SURVEILLANCE • TECHNICAL GUIDE

Network Recon: Who is on Your Wi-Fi?

Identifying and neutralizing intruders on your private home network.

RT
Technical Protocol Analyst

router.mobi Research Team

Verified hardware reconnaissance team specializing in gateway recovery and administrative protocol analysis.

Last Verified: router.mobi Research Team

Key Takeaways

  • DHCP List: Your router keeps a real-time record of every connected device.
  • MAC Addresses: Use these unique IDs to identify the hardware manufacturer.
  • SSID Rotation: Changing your password is the only 100% effective way to kick intruders.
  • Guest Networks: Use them to isolate untrusted IoT devices from your main data.

A slow network isn't always an ISP issue; it might be an uninvited guest. Monitoring your wireless perimeter is a critical part of modern digital hygiene.

Identifying everyone on your network is essential for both performance and security. If you suspect someone is leeching your bandwidth or, worse, attempting a lateral movement attack, you need to audit your **DHCP Client List** immediately.

If you discover unauthorized devices on your network, we strongly recommend performing a full Security Audit and updating your encryption keys.

Accessing the DHCP Client Table

The DHCP (Dynamic Host Configuration Protocol) table is the official ledger of your network. Every device—from your iPhone to your smart fridge—must request an IP address from this list to get online.

  • Login to your gateway (Consult our guide on how to find your router IP address if you're unsure).
  • Navigate to the Status, Network Map, or DHCP Server menu.
  • Review the list of active hostnames. Descriptions like "Apple-Watch" or "Windows-Desktop" are easy, but look out for "Unknown" or generic names.

Decoding MAC Addresses for Hardware Identification

If a device name is cryptic (e.g., BC-F5-AC-89-01-22), the MAC address is your best forensic tool. A MAC address is a permanent hardware ID assigned at the factory.

Technical Protocol: Use an OUI (Organizationally Unique Identifier) lookup tool online. This will tell you if that "Unknown" device was manufactured by Xiaomi, Philips (Hue bulbs), or a generic chip manufacturer you don't recognize.

How to Neutralize Unauthorized Access

If you identify a device that shouldn't be there, you have two primary options for enforcement:

  1. MAC Filtering (Blacklisting): You can block a specific hardware ID. However, advanced users can "spoof" their MAC address to bypass this.
  2. SSID & Password Rotation: This is the nuclear option. If you change your Wi-Fi password, every single device is instantly disconnected. This forces the intruder out and requires you to re-authenticate only the hardware you trust.

Preventing Future Intrusions

Avoid using weak default passwords that are easily guessed. Always enable WPA3 encryption if supported by your hardware. If you frequently have guests, set up a dedicated **Guest Network** that has no access to your primary files or local servers.

Network Monitoring FAQ

Q: Can I see what websites they are visiting?

A: Most consumer routers do not provide a detailed browsing history per device. You would need a more advanced firewall like pfSense or OPNsense for that level of packet inspection.

Q: Why do I see devices that are currently turned off?

A: The DHCP table often shows "Leases". A device might be physically off, but its IP address is reserved by the router for 24-48 hours. Look for the "Active" or "Online" status indicator.

Q: Will a third-party app like Fing work?

A: Yes. Apps like Fing or Scapy scan your local subnet and can often identify devices more accurately than a basic router interface.