First I would like to say that I didn't know how to format the proper title but below is the issue.

I have a router that connects to the ISP but in this router there X people connected, i know all of these devices. I even reviewed this cited below with only me connected.

The issue is as follow, the statics the router gives (ping/up/down/...) are not close to proper of what I am supposed to have. At first I thought its from the ISP, maybe an infrastructure issue, I still think it may be is/was but I decided to use a software to check something out. Its called selfishnet for whoever knows it. Now using this stats became real, what is supposed to be. So i started thinking what if someone in the area was connecting to the frame then again I checked the DHCP table of the router still nothing, just me. At this point I suppose two things (beside an ISP issue). Someone is on the frame all the time but is somehow not appearing in the dhcp table or some activity with the softwares i use is draining but i already checked that and there is nothing abnormal.

Maybe there is something I missed and should check, I apologize in advance I dont know much in the security field.

  • You're using some terms inconsistently, try to keep your explanation simple. To me it's not clear why you think there are more devices connected then are shown. What exactly is being "drained"? Is one of your own devices not showing up? Also, DHCP is local so that would be an issue with the router, not the ISP. – J.A.K. Mar 19 '17 at 12:07
  • I know DHCP is local but its local to all connected devices to it meaning i would find all the devices connected to it to access the ISP. as for drained i meant the connection is just being eaten, its extremely slow to a 90% slower than the normal stats. think of a suscribtion of 4Mbs where you instead of having that 4 you have 40Kb & the rest is just .. not found. – Ranked Bronze Mar 19 '17 at 12:57
  • A lot of things can cause you internet to be slow. A 'ghost' device is one of the least likely explanations. But if you want to check, just download wireshark and take a look yourself if you see traffic going over the net. I'm voting to close this question because it is not clearly related to security. – J.A.K. Mar 19 '17 at 13:13
  • appreciate the help. sorry if this not security i thought it would be. – Ranked Bronze Mar 19 '17 at 13:49

Someone can definitely be connected to your router without showing up in your DHCP lease table. Anybody who has given themselves a static IP address will not show up in your DHCP table.

In order to do this, someone would need to know some basic things like

  • What the gateway IP address is
  • The subnet mask
  • an available IP address that would not cause a conflict with another device on the network.

This could easily be done by connecting via DHCP, then statically setting your IP address to the same settings the DHCP server gave. Now in that instance, the DHCP lease would still show up in the table until it expired, but once the lease expired that device could exist on your network and not show up in your DHCP server. They would need to have physical access to the inside of your network to make this happen. This could be a wireless connection, or physically plugging into a switch or router.

Now with that said, I highly doubt that the issues your experiencing are caused by a rogue actor on your network sucking up all your bandwidth. In your post you say that the statistics the router gives the upload / download speed are not what you would expect. I'm going to assume you know that you're not always going to be downloading or uploading at peak speeds. In addition if you did have a rogue device sucking up your bandwidth, this would be shown in your router statistics (this is a generalization, but I assume you can see realtime transmission statistics based on what you've said in your post).

The long answer to your short question is that if you are not receiving speeds that you would expect (run something like Speedtest.net to confirm your upload / download speeds) then this is likely an ISP issue. This commonly happens in instances where the signal is not strong enough, or perhaps there is an MTU issue. Contact your ISP and they will walk you through troubleshooting.

| improve this answer | |
  • what you said makes extreme sense but why i thought its a rogue actor as you said is because at some points at first when using speedtest it shows perfect results (comptaible to what should be) then after few minutes maybe an hour it just drops horribly no matter the hour of the day i was in. – Ranked Bronze Mar 19 '17 at 14:56
  • @RankedBronze If you're getting your speeds at one time of the day, but not at other times of the day it's likely a signal issue or network congestion on your ISP's side. – DKNUCKLES Mar 20 '17 at 12:16
  • no its everytime of the day now i somehow got control now as its stable i reset the router aswell maybe it was infected but i highly doubt that. – Ranked Bronze Mar 20 '17 at 23:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.