How can I find out if someone has been on my home wifi network?

Question

I am aware of DCHP tables, and apps that can scan your network to see who is "currently" on your wifi network, but I am more interested in how to tell if someone has been on my wifi network at some point in the "past". Or if that's not possible, what can I do today to keep a running log of all devices that will have ever connected to my wifi network in the future?

I ask because I have had 5-6 periodic instances when my virus scanner all of a sudden would stop working, and I can't seem to find the cause. I want to rule out that my wifi is insecure.

Answer 1

It's not possible to find this out about past connections unless it has been logged by some device. The prime device for logging this would be your access point because this is the device that authenticated the request to connect to your wifi. Whether it is capable of logging such requests will depend on the capabilities of your wifi access point. It may already be logging this information, I'd look around in the web interface.

You could also setup a computer with a wifi card to listen in promiscuous mode with wireshark. This means it will listen to all frame also those not addressed to it and you should be able to see clients authenticate to the access point and also authentication failure. You could also be logging mac addresses via ARP or DHCP.

I think your virus scanner not working is completely unrelated to the security of your wifi network. Even if your wifi was compromised it'd be unlikely for your virus scanner to stop working. If you distrust your wifi do the following:

• change the password into a complex long random string like "hXs0#/;W#y38!u0aIi$o65>Ra", you only have to input it once anyway.
• change the admin password that allows you to change these settings into a proper one too.
• update the firmware on your wifi access point / router
• make sure WPS is disabled
• make sure you're using WPA2

Answer 2

What I am doing right now, to rule out a wifi breach like you, is to replace my normal AP, with a raspberry pi using a TL-WN722N and acting as the normal AP.

This means using the same ESSID, same channel, and mac address (BSSID), and passphrase, same frequency, and same type (wifi n). I am using create_ap ( a simple bash script) to do that. You don't have to reconfigure any of your device.

That way. I am able to keep a log of all associated device with the AP. Wether they use DHCP or static IP. Moreover, I disable wifi on the device I don't use to be sure their mac are not spoofed, and try to keep tab of when I use wifi on those device or not (which is quite harder to do and a hassle).

I am not running frame capture on the rpi for now. I could use tcpdump or tshark. But I am not, for now.

Of course, you can't go back in time and get data that has not been collected. So the first answer still stands: it is not possible unless you had some device that logged the activity you are looking for. Your best bet is your router log (for DHCP like you said) or your AP if it's not the same as the router.