4

I have a TP-Link wifi router. There is no screen on the front to indicate how many devices are connected to it. Is there any way to either access logs or in real-time monitor how many devices are connected, so I can verify that it is secure?

4

TP-Link routers, like most home routers I know about, maintain a system log that one can view through the web browser administrative interface.

You could use a cast-off computer to read the log file repeatedly and do something like send an SMS message any time there's a new connection, or when the number of connections reaches a threshold, etc.

You might be able to send the log entries to a central log server using the syslog protocol. I haven't researched TP-Link that far. Then your remote logging server could do the monitoring.

Both of those seem like overkill to me. Use a really strong (i.e. randomly generated) password, which you write down and keep someplace safe. Use the strongest authentication available, which is likely to be WPA2. Check the logs every week or so for strangeness. If you're really paranoid, turn the router off when you're not using it.

3

You can use ARP scanner like netdiscover / arp-scan for Linux, arping for Windows or Fing for Android devices.

It simply sends ARP Request messages in your network (starting from the first available IP address for devices in your subnet), and says "for your IP (ip address of the host), give me the MAC address".

If there is a host on that IP, it will reply on the ARP-Request with his own MAC address in ARP-Reply message to you.

Then the tool builds result table in format IP -> MAC, and you will know every device in your LAN that reply on the ARP request message.

Some ARP scanners also check the OUI portion of the device's MAC address to identify the vendor.

When you know all MACs and the manufacturer, you can filter the unwanted ones via router web interface, but REMEMBER: the attacker can put his/her network card in promiscuous mode and monitor all stations connected to the router in order to find some MAC address that is allowed to connect, then he/she can spoof it's own MAC to the taken one, and easily bypass the MAC filtering.

2

I'm not sure if there is a way to monitor your router in real time but most routers show you how many users are connected when you log into its admin interface. The interface is usually accessed via a well know address - e.g. 192.168.1.1. You should check your router manual to find out the exact address.

Another option which may be supported by your router is to allow connections only from white listed MAC addresses. You would be able to find if such an option is available in your router manual.

Also don't use WEP encryption. If you use WPA and set a password that is not a based on a common word and add few special characters (and use at least 8 characters) you should be pretty safe.

  • 3
    Just to be clear, white listing MAC addresses isn't going to stop a competent attacker. – David Houde Sep 6 '14 at 11:52
  • That's true! It's very easy to change the MAC address! So use WPA2, with a strong password (and disable WPS). – Gerifield Sep 6 '14 at 13:28
  • 3
    Yes it is easy to change MAC. But the more things attacker needs to do the less likely he/she is to do it. So the more stuff attacker needs to do the more likely he is to quit. Nothing is ever 100% secure. – markovuksanovic Sep 6 '14 at 13:31
0

TP-Link router has an IP address to access and control the router that looks like 192.168.0.1. Open it in a browser and go to DHCP the DHCP Client List. Here you can see which devices are using the router right now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.