WiFi Stealing issue, monitor Devices on Network

[ixq]

@ogra

Start with researching these instead of assuming someone sat down and invested a big amount of work to hack your WLAN (they would have to do that literally every time from scratch if you change passwords and SSID)…

Also to add to this, there is a simplest way to see it in router admin mac address tables.
There’s no need for assumptions if it’s 2 min job to check and see. Even the bare bones routers can block mac addresses or work with the whitelist.

[ericmarceau]

Except for having a WiFi card on you computer itself, in order to have access to the full range of network analysis tools, I don’t know what else to suggest.

Also, I still don’t see any mention of your WiFi modem’s Model and Make. Without that, it is an unknown quantity and we are all stabbing in the dark! Please provide the hardware details.

[meetdilip]

I made a support request. Instead of pouring your infinite knowledge about networking, you can honour the original query. Which is a tool or a script. I am sad that is not the case here. No point for me visiting this thread back again. A moderator should have asked people to honour the original support request, but the reverse happened. I am reporting that post.

[ian-weisser]

Folks, we don’t really need 23 posts to argue about whether or not “stealing WiFi” is actually occurring or not. It doesn’t seem relevant to the actual question

@meetdilip

Any way to get alerts when there is a new device on network, is there any software or script I can use?

Let’s please return to the topic and try to offer constructive advice.

[ogra]

I’m sorry, I didn’t mean to de-rail the topic like that, but we will need to collect some hard data to help you instead of operating on the simple assumption that someone broke into your network…

Lets start with a simple tool that should show all used IPs and MAC adresses in your wlan…

Install the arp-scan tool:

sudo apt install arp-scan

Now lets do a scan (assuming you are connected to the wlan and it is your default network), to allow the arp-scan tool to dump its temporary files we need to go into /tmp first :

cd /tmp
sudo arp-scan -l --interface=$(ip r |grep default|sed 's/^.*dev //;s/ .*$//')

(instead of the stuff in brackets you can also just manually look up the name with ip link and directly put the interface name into the command if you want)

Now you should have a list of connected machines with IP, MAC address and the name of the manufacturer of the wifi hardware, that should get you some initial data … check if you see anything unusual you can not identify …

[vidtek99]

I think @halogen2 has probably hit the nail on the head. These days there are many gadgets that require internet connections, including smart home devices such as wall switches, lights, doorbells, mobile 'phones and tablets etc etc.
Cheap routers such as supplied by ISP’s have only a limited number of DHCP connections, some as little as 14. It doesn’t take too many devices to clog up these cheap devices, leaving no room for you when you wish to switch on your computer and log on.

As far as network persistence goes, it can take upwards of 40 minutes for residual devices IP’s to be drained from the network, if there is still one active node that is powered on.