I'm trying to figure out how to configure a network so that I can tell what an intruder did (in the past) while on the network after they are detected. eg. If someone with a wi-fi enabled laptop parked outside my home and connected to my home network because he was able to crack my weak encryption. and if he were to do some fraudulent activity from my network, how can I configure my network and where would I have to look on the network to see what he was up to? What devices would be able to log valuable information and how would I make sense of this information?
Most routers (even retail wifi units) have an admin screen that lists all the active clients that have been allocated an IP address by DHCP. This usually lists the MAC address of the client too.
usually they look like this:
CLIENT NAME IP ADDRESS MAC ADDRESS android_blah 192.168.1.10 AA-BB-CC-00-00-00 my_pc 192.168.1.11 DD-EE-AA-00-00-00
If you do not recognise the client names - then a handy tip is to take the first 3 octets of the MAC address and google them (e.g. AA-BB-CC) and this will tell you the manufacturer of the device which could help determine whether it really is inside or outside of your home.
You yourself likely can't do much as most consumer gear isn't going to keep a log of what happened. Your ISP likely has records about activity from your account and that could be useful, but you are unlikely to be able to get it without a court order. General rule, unless you have reason to suspect something nefarious, simply document the breach, fix it and move on with life. Keeping the MAC address of the connection if you have it (should be listed in the router or AP if the connection was recent), but that is likely spoofed if someone was actually up to no good.
Really you only need to be worried about being able to support it wasn't you. It's up to the authorities to track down any illicit activity that might have been done (though it is much more likely they were simply a neighbor mooching off your connection.)
It is also worth running virus scans and such on your other systems to make sure they were not up to anything within your network, but if those don't reveal anything I wouldn't be that worried. What initially raised your suspicions?
On the off chance that your equipment has the ability to record useful information about network activity available and turned on, it would most likely be on the router, but the exact way to get to it would depend on the make and model.
Note that the majority of this answer is addressing the question as you phrased it which seems to indicate you believe they were simply using your network for an Internet connection and not attacking your network directly. If that is incorrect, then a lot of what you can do changes as computers on your network would have very valuable information in their event logs about access attempts and the like. You could access this information from the event viewer under administrative tools in the control panel on most Windows machines. If you can't find it there, you can also find it as a snap-in for Microsoft Management Console, which you can launch by going to run and typing mmc. The information in there is going to be rather hard to follow if you don't know what to look for though and the full details of what to look for are a bit broad for a Q/A format (more like a lecture series).
More details about what made you think this was going on might help narrowing down the scope of where you might be able to find information.
You can scan your network with network security scanners to detect for any intruder IP accessing your wifi network. It may not be a perfect solution for a corporate environment but i think it will work for home network with far fewer nodes in a network. The following is a list of some network scanning tools it some help for you
Since I now know your question is theoretical, I can answer it better about how you can setup your network so you would be able to tell. The exact way of setting it up will vary from device to device, but there are a lot of options available. The key is that you need a device capable of logging that is in a location on the network that everything the person does will go through it.
For an average home network, this could be either the Wireless Access Point, the Router or if applicable, the gateway or firewall. The wireless access point will get the information right as they get on to the network and will ensure that all activity coming in on the wireless network is logged, but if they were to use their wireless connection to compromise a wired system and then use the wired system, you would have an incomplete log.
Most likely the Router also serves as the gateway and firewall (the device that gives the rest of the network access to the Internet and ensures the Internet doesn't have unintended access to the private network). Logging at the gateway and/or firewall ensures that all outbound traffic is logged, but won't tell you anything about what the intruder did internally on your network.
In most home networks, since there is only one router and it also generally serves as wireless access point, gateway and firewall, it will end up being privy to all connections flowing across the network. It may not have access to all the contents of the packets it routes (if encryption is used) but it at least (by necessity) has access to the routing information (ie, where it is coming from and where it is going). This is likely the best place in a home network to log.
Most consumer routers do not have this kind of logging by default, however third party firmwares such as DD-WRT often add logging capability to the routers that can either write to an internal store (limited space) or a network share. Exactly what information can be stored and how it is formatted varies from device to device, but in general information like the IP and MAC Address of the client as well as the requested destination IP, Port and protocol (such as TCP or UDP) as well as a timestamp can give you a lot of what you need to get at least a general idea of what was going on.
If space is no object, it may even be possible to log the content of every packet sent across the network, but that will be a huge amount of space and it may not be safe to exclude "known" MAC addresses from the logging to try and reduce the amount since MAC spoofing is fairly easy on a wireless network. (IE, the intruder can make themselves look like a valid machine) Of course, if you are going to this kind of length, you could also do a per machine certificate and/or not use a weak key at which point the problem would likely be avoided in the first place.
You could always set up a honeypot in conjunction with not broadcasting your SSID (service set identifier). An attacker would not know the real AP exists, thus attack the honeypot which you can log to varying degrees based on how much knowledge you have. A simple google search will wield you with many tools. MAC address filtering is a good security feature if no clients were connected to your AP which is unlikely. There are also downfalls to not broadcasting your SSID because it is easily uncloaked as soon as a client connects. You could also set up a proxy like squid and log various information such as sites that are visited and such. Hope this helps.
Have a look at Kismet.
Kismet is an 802.11 wireless network detector, sniffer, and intrusion detection system. Kismet will work with any wireless card which supports raw monitoring mode, and can sniff 802.11b, 802.11a, 802.11g, and 802.11n traffic
Kismet includes IDS functionality, providing a stateless and stateful IDS for layer 2 and layer 3 wireless attacks. Kismet can alert on fingerprints (specific single-packet attacks) and trends (unusual probes, disassociation floods, etc).
You can set kismet up on a raspberry pi with a second wifi NIC and it will happily listen for wireless clients, recording their mac addresses and possibly saving raw packet traffic.