I have a D-link 600M router with a simple WPA2 password that got cracked. 60 Gb of data was downloaded (I think they downloaded torrent movies), which resulted in the renewal of my data plan. I searched for devices in the status of my WiFi router but found no results.

Is there is any way I can use forensic tools to find the devices which attached to my router? I'd like to know their MAC addresses to be able to catch the culprits.

Do WiFi routers log data about devices that are now disconnected? My router currently only shows those devices which are actively connected in the status window.

  • Do change your WiFi password right away. Also did the password have a lot of entropy, or was it a simple password? See also: xkcd.com/936 – Bryan Field Nov 17 '16 at 20:21
  • 1
    The router probably recorded the MAC address - the MAC address will reveal the hardware of the network card, which might be a clue. On the other hand if you didn't configure any logging on your router, then the router won't have logged anything. GIGO – Mark C. Wallace Nov 17 '16 at 20:56
  • a little suggestion: if WDS is enabled on your router, you may think about disabling it, there are many examples in which routers/modems are compromised via WDS. – JackSparrow Nov 16 '17 at 8:41
  • Don't forget to disable WPS. Not sure if that model vulnerable to reaver or pixie-dust attacks or known default PIN. These WPS attacks are far quicker / more likely than WPA password guessing. @JackSparrow - did you mean WPS? – MZB Dec 17 '17 at 14:37
  • @MZB Yes, I meant WPS but I think I was little confused when answered. Thanks for correction though. – JackSparrow Dec 23 '17 at 6:39

You should be able to access their MAC address in the ARP table on the modem, but this have two problems:

  1. The MAC Address is easily spoofable, so this invalidates the the white/black list solutions.
  2. This model of modem has no way to consult the ARP table, so no way to know.

About the logs, it depends on the model, this is product baseed, so you should check the settings if it logs anything and if it's doing it.

Maybe you can try a ping sweep on you local network while they're using it. Or also handle/modify the DHCP so you assign/manage manually IPs, but this reduce functionality by a lot and still has some workarounds.

| improve this answer | |

I dont think the router will show which device was connected and even if it did it would only show MAC address and IP address. If you really want to restrict who can access your network use MAC address association.

See the guide here: Configure MAC filtering on D-Link

| improve this answer | |

You should be able to activate a white list and put your devices on it, so the other one shouldn't get access. Definitely change your password if it got hacked.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.