I have a D-link 600M router with a simple WPA2 password that got cracked. 60 Gb of data was downloaded (I think they downloaded torrent movies), which resulted in the renewal of my data plan. I searched for devices in the status of my WiFi router but found no results.

Is there is any way I can use forensic tools to find the devices which attached to my router? I'd like to know their MAC addresses to be able to catch the culprits.

Do WiFi routers log data about devices that are now disconnected? My router currently only shows those devices which are actively connected in the status window.

  • Do change your WiFi password right away. Also did the password have a lot of entropy, or was it a simple password? See also: xkcd.com/936 Commented Nov 17, 2016 at 20:21
  • 1
    The router probably recorded the MAC address - the MAC address will reveal the hardware of the network card, which might be a clue. On the other hand if you didn't configure any logging on your router, then the router won't have logged anything. GIGO
    – MCW
    Commented Nov 17, 2016 at 20:56
  • a little suggestion: if WDS is enabled on your router, you may think about disabling it, there are many examples in which routers/modems are compromised via WDS. Commented Nov 16, 2017 at 8:41
  • Don't forget to disable WPS. Not sure if that model vulnerable to reaver or pixie-dust attacks or known default PIN. These WPS attacks are far quicker / more likely than WPA password guessing. @JackSparrow - did you mean WPS?
    – MZB
    Commented Dec 17, 2017 at 14:37
  • @MZB Yes, I meant WPS but I think I was little confused when answered. Thanks for correction though. Commented Dec 23, 2017 at 6:39

3 Answers 3


You should be able to access their MAC address in the ARP table on the modem, but this have two problems:

  1. The MAC Address is easily spoofable, so this invalidates the the white/black list solutions.
  2. This model of modem has no way to consult the ARP table, so no way to know.

About the logs, it depends on the model, this is product baseed, so you should check the settings if it logs anything and if it's doing it.

Maybe you can try a ping sweep on you local network while they're using it. Or also handle/modify the DHCP so you assign/manage manually IPs, but this reduce functionality by a lot and still has some workarounds.


If you have a flat network, an arp -a on the systems on your network (if you have any) might give you the list of the connected devices to that system (if not too long ago and if they were probed).

You might also look at the logs of the systems for access.

If you want to invest a bit: get a cheap access point and a cheap system that is used as a sort of honeypot (f.e. a HoneyPi). Log and issue warnings.

  • This now makes a lot more sense. It's still a longshot, though.
    – schroeder
    Commented Jun 25, 2021 at 10:03

I dont think the router will show which device was connected and even if it did it would only show MAC address and IP address. If you really want to restrict who can access your network use MAC address association.

See the guide here: Configure MAC filtering on D-Link

  • Routers do show device MACs, and the OP specifically asks for MACs, so saying that it would show a MAC is not a limitation ... And the question is not about protection, but detection.
    – schroeder
    Commented Jun 25, 2021 at 9:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .