The question is usually asked for one of two reasons: the connection has slowed and you want the culprit, or you saw an unfamiliar name in a device list and want to know if someone is on your network who should not be.
They need different answers. A device list tells you who is connected. It does not tell you who is using the bandwidth.
Start with the router's device list
- Open your router admin page, usually 192.168.0.1 or 192.168.1.1.
- Look for Attached Devices, DHCP Clients, or Connected Devices.
- Note each entry's hostname, IP address and MAC address.
This is the fastest route and needs no software. The catch is that the list is often close to unreadable: half the entries will be blank, or show as android-9f2c1a, or ESP_A41B7C, and the list only reflects current DHCP leases, so a device that connects intermittently may be missing entirely.
Identifying the cryptic entries
The first three octets of a MAC address are the Organisationally Unique Identifier, assigned to the manufacturer. That is how tools turn A4:B1:C2 into a vendor name, and it is usually enough to recognise a device.
| Vendor in the list | Usually means |
|---|---|
| Espressif | A smart plug, bulb or DIY sensor. ESP32/ESP8266 chips. |
| Murata / Liteon / Azurewave | WiFi module inside a TV, console or laptop. |
| Amazon Technologies | Echo, Fire TV or Kindle. |
| Raspberry Pi Foundation | A Pi. Yours, hopefully. |
| Apple / Samsung / Google | Phone, tablet or watch. Often several per person. |
How to tell a stranger from your own hardware
Counting is the reliable method. Walk the house and add up everything with a radio: phones, laptops, tablets, watches, TVs, consoles, speakers, thermostats, doorbells, printers, plugs, bulbs. The total is almost always higher than people guess, and a modest smart home passes thirty without difficulty.
If the device count matches your tally, you have no intruder. If you are several over, work through the list by powering things off one at a time and watching which entry drops.
For what it is worth, an unknown device is far more often a forgotten smart plug than a neighbour. Genuine WiFi intrusion requires either your password or a real attack against WPA2/WPA3, and neither is common in practice.
Seeing who is actually using the bandwidth
This is where the router usually stops being useful. Most consumer routers show you what is connected, not what each device is consuming, and by the time you have logged in to check, the 9pm slowdown has often passed.
To answer it properly you need per-device throughput updating in real time. Perimetery PRO runs on one Windows machine on the network, discovers every device on the subnet with its vendor resolved, and shows live upload and download per device with a sparkline of recent activity, so the device responsible is obvious while it is happening rather than after the fact.
From there you can cap the offending device instead of blocking it, which usually resolves the complaint without anyone losing access.
If you do find something you cannot account for
- Change your WiFi password. This evicts everything and is the only step that reliably removes an unknown device.
- Check you are on WPA2 or WPA3. If the network is on WEP or open, fix that immediately.
- Turn off WPS. Its PIN mode has known weaknesses and it is rarely needed.
- Update your router firmware.
- Reconnect your own devices and recount. Anything that reappears without your action deserves a closer look.
Frequently asked questions
How can I see who is using my WiFi right now?
Your router's attached devices page lists everything currently connected. It will not show per-device bandwidth usage, so to see who is actually consuming the connection you need a network monitor that reports live throughput per device.
What does an unknown device on my network usually turn out to be?
Most often a smart home gadget you forgot about, or a phone using MAC randomisation so it does not match a known vendor. Look up the MAC prefix to identify the manufacturer before assuming intrusion.
Can someone use my WiFi without knowing the password?
On a WPA2 or WPA3 network with a strong password, that is difficult. It is far more likely the password was shared at some point, or the network is still running WPS or older WEP encryption.
Does a device count as using my WiFi if it is idle?
An idle device holds a DHCP lease and appears in the connected list while using almost no bandwidth. That is why a long device list is not by itself a cause of slow internet.
See every device on your network
Perimetery PRO shows live upload and download per device, and lets you cap or block any of them in one click. Runs on one Windows machine, no agents to deploy.
See pricing