I have a D-link 600M router with a simple WPA2 password that got cracked. 60 Gb of data was downloaded (I think they downloaded torrent movies), which resulted in the renewal of my data plan. I searched for devices in the status of my WiFi router but found no results.

Is there is any way I can use forensic tools to find the devices which attached to my router? I'd like to know their MAC addresses to be able to catch the culprits.

Do WiFi routers log data about devices that are now disconnected? My router currently only shows those devices which are actively connected in the status window.

  • Do change your WiFi password right away. Also did the password have a lot of entropy, or was it a simple password? See also: xkcd.com/936 Nov 17 '16 at 20:21
  • 1
    The router probably recorded the MAC address - the MAC address will reveal the hardware of the network card, which might be a clue. On the other hand if you didn't configure any logging on your router, then the router won't have logged anything. GIGO
    – MCW
    Nov 17 '16 at 20:56
  • a little suggestion: if WDS is enabled on your router, you may think about disabling it, there are many examples in which routers/modems are compromised via WDS. Nov 16 '17 at 8:41
  • Don't forget to disable WPS. Not sure if that model vulnerable to reaver or pixie-dust attacks or known default PIN. These WPS attacks are far quicker / more likely than WPA password guessing. @JackSparrow - did you mean WPS?
    – MZB
    Dec 17 '17 at 14:37
  • @MZB Yes, I meant WPS but I think I was little confused when answered. Thanks for correction though. Dec 23 '17 at 6:39

You should be able to access their MAC address in the ARP table on the modem, but this have two problems:

  1. The MAC Address is easily spoofable, so this invalidates the the white/black list solutions.
  2. This model of modem has no way to consult the ARP table, so no way to know.

About the logs, it depends on the model, this is product baseed, so you should check the settings if it logs anything and if it's doing it.

Maybe you can try a ping sweep on you local network while they're using it. Or also handle/modify the DHCP so you assign/manage manually IPs, but this reduce functionality by a lot and still has some workarounds.


If you have a flat network, an arp -a on the systems on your network (if you have any) might give you the list of the connected devices to that system (if not too long ago and if they were probed).

You might also look at the logs of the systems for access.

If you want to invest a bit: get a cheap access point and a cheap system that is used as a sort of honeypot (f.e. a HoneyPi). Log and issue warnings.

  • This now makes a lot more sense. It's still a longshot, though.
    – schroeder
    Jun 25 at 10:03

I dont think the router will show which device was connected and even if it did it would only show MAC address and IP address. If you really want to restrict who can access your network use MAC address association.

See the guide here: Configure MAC filtering on D-Link

  • Routers do show device MACs, and the OP specifically asks for MACs, so saying that it would show a MAC is not a limitation ... And the question is not about protection, but detection.
    – schroeder
    Jun 25 at 9:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.