192.168.1.1 Can you find out who has logged in to the router backend? I turned the backstage upside down and found these four pieces of evidence.

Last month my mother called me and asked me: Why did the WiFi name at home become a string of English words? She didn’t change it. I remotely command her to enter 192.168.1.1 After taking a look, I found that the name change happened one afternoon three days ago - there was indeed someone at home at that time. My nephew was playing games on his tablet, and the router was placed on the TV cabinet in the living room. She asked if the child was acting up, and I said don't accuse people unfairly, maybe someone else came in. The case came to light in the evening, and the child admitted that he went to the backstage to blindly "want the Internet to speed up" (he couldn't tell whether the name was changed or not). But those two hours of troubleshooting forced me to ask a question: Can the router backend find out "who has logged in?" I checked the three machines at home one by one, and the answer was more confusing than I thought.

Let’s put the conclusion aside first.: Ordinary home routers do not have a "login account", and you cannot find a formal record such as "at what time so and so logged into the backend." But it doesn’t leave nothing behind. Four things can be put together to give a rough idea, each one more indirect than the other. If you suspect that someone has tampered with the backstage, read this article in this order. All the evidence you can get is here.

Pour cold water on it first: Home routers don’t remember “login history” at all.」

Many people take it for granted that since a router can manage dozens of devices, it is not easy to remember who logged in to me. Not really. I have reviewed the Mercury D191G and TP-Link XDR3010, and the things recorded in the background system logs are all network events.: Dial-up, disconnection, equipment going online and offline. Why is it designed like this? I thought about it for a while, and it actually makes sense from the manufacturer's perspective - the home backend can only be used by one person at a time, and the person who logs in is the "administrator himself", so there is no point in recording attendance for yourself. ； If you really want to prevent outsiders, the idea is to block the door (password, lock), not to hold people responsible afterwards. Enterprise routers only pay attention to this. Management and operation auditing is a compliance requirement, which cannot be violated by home machines.

So you can't find a menu called "Login Record" or "Management Log" in the background. It's not that you didn't find it, or that this page doesn't exist at all. Some ASUS models are a semi-exception. Their system logs will contain a few login and logout events, but that's about it, without "which IP it came from." It's still far from being able to use it to figure out who did it.

Doesn't that mean there's nothing left to do? Neither. Although the action of logging in is a "black box", it will affect several other accounts on the router. The circumstantial evidence is gathered together, and it is almost the same.

The first piece of evidence: Login failure in the system log, the hardest part

When browsing the backend, the first stop is always the system log, and the only key word to look for is: Login failed (Some brands write "Authentication failed" or login failed in English). I used this once when I was doing a password check on a friend’s router.: There were a total of seven failed login entries in his log in the two nights. The time matched the two times he entered incorrectly with his hand. The number was correct and it was a false alarm. The logic of interpretation is this: can the number and time of failures match up with the actual input errors of family members? It's not right. For example, no one in your family has touched the backend, but there are failures one after another in the log. That means someone is trying the password. Where can I find the logs in each company's backend? How can I identify the four key records? View router operation logs The entire entry list was written in that article.

Pay special attention to whether there is any "external network" flavor in the failure record. If the remote web management switch is turned on in your home (I have written a whole article about how dangerous this switch is, it was the one that caused the password to be tried for a week, see Should remote web management be enabled? ), the login failures in the log may come from public IP addresses, one entry is worth a hundred. On the other hand, the sources of failure are all intranet addresses such as 192.168.1.x, which means that the person who tried the password has connected to your home WiFi - then the problem has escalated. Don't worry about the background for now, check who is using the Internet, and go through it. Management password physical examination Five check points to see if the lock itself is tight.

There is an inherent flaw in the log that needs to be recognized first.: It only stores the most recent hundreds to thousands of entries, and will be cleared when the power is turned off. If what you suspect happened last week, there's a good chance there's nothing left. This is not broken, this is the storage configuration of home machines. So if something happens, you have to act quickly and export the log and save a copy on the same day. Most of them have an "Export" button in the background. Exporting a txt text is considered complete evidence collection.

second piece of evidence: Online timeline of equipment list, portrait of "suspect"

The login record cannot be found, but "the person logging in must have used a device to connect to your home network first" - this cannot be escaped. To connect a mobile phone to WiFi, it needs an IP (DHCP record) and a wireless connection (association record), both of which will be included in the log and device list. So at the second stop, I checked the device management and copied down the online time period of each device.

This is how I checked my mother's machine.: The background showed that around three o'clock in the afternoon when the name was changed, there were a total of five online devices - my mother's mobile phone, a TV box, my nephew's tablet, a sweeper, and an unfamiliar device that displayed "HONOR-xxx". The unfamiliar station went online at 2:57 pm and went offline at 4:03 pm, which coincides with the change time. Later, I concluded that the tablet was brought by my nephew's classmate (the child himself told me to lend the tablet to his classmates to play games), not an outsider. You see, the device list cannot directly tell you "who logged in to the backend", but it can circle out "who has the conditions to commit crimes at that point in time", and the rest is to work with people.

This step of identifying the device is very important. Don’t block it as if you are a stranger just by looking at the English name. My cousin's cell phone displayed a string of letters starting with HONOR in my home list, and I almost thought it was a scam. I have written a special article on how to identify the device (check the manufacturer with the first six MAC digits, check the online time, and check when the power is off). See How to identify each device in the background , follow this rule and basically you won’t wrongly accuse good people. It doesn’t matter if you make a mistake. The way to get back from being blacklisted is in the article about blacklisting ( The password is correct but cannot be connected There are also real cases of being blocked by oneself). Mention something about random MAC: The mobile phone will always use a randomly generated fake MAC on the same WiFi. It will remain unchanged unless you actively "forget the network" - so the device that was blocked last month can still be recognized this month. This is a rule that can be exploited.

The third piece of evidence: Set the timestamp of the change to lock the time of the incident

The router does not remember "who made the changes", but some changes have their own time. WiFi renaming is easy to check - the new name suddenly appears in the device list, and with a few related records in the log, time is locked. Several other places worth checking specifically: Is the DNS still the one you set? (Changing it to an unfamiliar address means that the whole family’s traffic has been redirected. This is the number one sign of being hacked.) ； Are there any rules in the port forwarding list that you don’t recognize? ； Are there any unfamiliar entries in the UPnP mapping? Any "extra thing" in any of these three places is much more serious than changing the name. The order of processing should be as follows: Self-examination for signs of being hacked In this article, we will disconnect the WAN, change the password, clear the hole, and upgrade the firmware.

There is also a stupid but effective comparison method: If you exported a configuration backup after changing the settings last time, take it out and compare it with the current configuration one by one. If you don’t have a backup habit, it’s time to develop it now. A backup is equivalent to taking a snapshot of the router. In the event of an accident, you can accurately determine “which field has been changed.” How to import backup and what is stored in it? I am here Configuration backup I wrote it all in that article. Incidentally a reminder: That file contains your broadband account and WiFi password in plain text, and the location is more important than the backup itself.

The fourth piece of evidence: Web session - only those who have used OpenWrt will have this benefit

The first three are common to all machines. Only a few players can use this fourth item: My old Mercury with OpenWrt installed can check the "session" of the web login. The principle is not complicated - every time you log in to the OpenWrt backend, the system will drop a session file in the /var/run/rpcd/sessions directory, which contains fields such as session ID and timeout. Looking through this directory, you can see "How many login sessions are alive now?"」: Normally, you are the only one ； If you are not logged in at all and there are other sessions hanging in the list, it means someone is opening a background page.

But it is only a snapshot "at the time of the incident", and the expired session files are deleted, so there is no way to settle old scores. The value of this layer is mainly two: The first is to catch the situation on the spot, and the second is to let you understand the existence of the "login state" - if you close the browser page, the session can still live for a period of time (a few hundred seconds by default), so "I just logged in and then logged out" is not the same thing as "No one is in it now". Although ordinary brand machines do not have this catalog, the principles are the same.: If you suspect that someone has tampered with the backend, please don't log in repeatedly to avoid leaving your footprints everywhere and disrupting the scene.

Now that we have obtained the evidence, we will finish in two steps.

After looking through the four items, there are only two results. The result is "all correct". Congratulations. It was probably a family member's mistake. Just two things and the case was closed.: Change the management password to a string that has nothing to do with the WiFi password (how to change it, where is the entrance, I am How to change the management password That article sorted out the two paths of mobile phones and computers), and then added notes to all the machines I know in the equipment list. Note: This matter may seem trivial, but the critical moment is the testimony - next time an unfamiliar name comes up, you don't have to guess again.

The result is "doesn't match the number". Don't worry about solving the case. Just treat it as an intrusion. The order I set for myself was also the result of that tossing.: Unplug the WAN port network cable first (cut off the outside route, so no one can get in) ； Enter the backend to change the management password (starting with 16 digits) ； Go through DNS, port forwarding, and UPnP one by one, and delete any unfamiliar ones. ； Confirm that the remote management switch is turned off ； Upgrade the firmware to the latest. After everything is done, plug the network cable back in and observe it overnight. If you still feel uneasy, reset is the cleanest way. The cost is to reset all the broadband account WiFi passwords - so copy what should be copied before doing it. The complete sequence of dialing again after reset is here Redial after reset In that article, just follow the path and avoid half of the pitfalls. If you really get to the reset step, you must first distinguish the difference between restarting and resetting ( Don't confuse the three things ), don’t regard power outage and restart as a life-saving straw.

To end with a fair word. My biggest feeling after investigating this case is: Rather than being a detective after the fact, it’s better to lock in beforehand. Make the management password harder, turn off remote management, and don't lag behind the firmware version. If you do these three things, you basically don't need to ask the question "Who has logged into my backend?" - because the answer is always "just you." I later did these three things for my mother’s machine, and it’s been half a year now, and the WiFi name hasn’t changed again.