3

I have a hunch someone is logging on my wifi. I already know how to see who is currently using my wifi, but can I find out who was using my wifi in the past?

Improve this question
1
  • 2
    Check the logs on your router
    – Ulkoma
    Commented Oct 16, 2014 at 13:30

3 Answers 3

Reset to default
2

There are several ways to view who's on your network, some easier/less technical than others:

  • The logging feature in your router;
  • Sometimes you can view currently connected devices. For example in a FritzBox you can see all devices that have a dhcp lease (i.e. which got an IP address) on the "Home Network" page.
  • You could scan the network from your laptop using a tool like Zenmap (or Nmap on the command line).
  • A bit more advanced, but you can also put your WiFi card in monitor mode and look for devices that communicate with your access point. Wireshark and airmon-ng are the tools I would use, but there may be better options.
  • If you have shell access to your router, you could use netstat or even tcpdump to view connections and traffic.
  • You could turn off DHCP on your router and enable it on your laptop, so that you can easily see who is trying to get a lease.
  • Using Wireshark you can see broadcasts on the network. Almost every device broadcasts something from time to time so if your access point works as a switch (i.e. if wireless clients can reach each other on layer 2 (ethernet)) you can pretty easily enumerate all active MAC addresses.
Improve this answer
1

Check your router/AP documentation for a logging option. Turn it on if it's off, and look at the logs. Do this every day for a week or so to develop an idea of what is "normal." Then look every week or so.

After you've looked for a while, whether you spot an intruder or not, change the AP password.

Improve this answer
0

Check router logs to find out who's accessed your router.

If your router has been compromised I'd recommend you:

  • Enable MAC filtering white list only.
  • Isolate your wireless clients from your network.
  • Prevent your SSID from being broadcast
  • Change your SSID as your attacker already knows it
  • Enable extra logging on your router to identify your attacker. (E.g. options such as log on successful or failed login attempts)
  • Disable automatic connect on your devices. Only connect to your network when you actually require network access this will reduce the potential attack of handshakes.
  • Enable time based network access if you are always working at x time then schedule your router to not broadcast at x time.
Improve this answer
2
  • 3
    MAC filtering and not broadcasting SSID won't help much - and you missed some more important things such as changing the wifi password, changing the router login password, making sure to disable any WEP/WPA compatibility (using only WPA2 or stronger instead), disabling WPS, and setting the transmit strength only as high as you need it.
    – user2813274
    Commented Oct 16, 2014 at 13:53
  • I totally agree but it's just extra line of security to prevent inexperienced people compromising his security. I know it's very easy to bypass using AirMon-NG to sniff for the SSID or you could just send de-authentication packet to get the SSID and handshake to compromise the wireless anyways. I did miss few points especially on not changing the password! I thought that be common sense but I should of listed it. Thanks for pointing them out you could go on for a long time about the security if you really want to get nitty and gritty about it. Checking the BSSID of the WAP is correct etc.
    – Paul
    Commented Oct 16, 2014 at 16:12

Not the answer you're looking for? Browse other questions tagged .