How do you check which device is stealing data on a Xiaomi router? At night, the whole family was stuck on a PowerPoint slide, and in five minutes the real culprit was my computer

Last Wednesday night at 10 PM, my wife was in the living room scrolling through videos, my son was shouting for 460 games, and my mom's TV was also buffering. Three rooms were lagging at the same time. In this kind of scene, my first reaction wasn't to restart the router, but to open the background app to see who was stealing data. But within five minutes, I identified the real culprit: the desktop in the study, with 49GB of game updates running on Steam, download speeds steadily reached 90MB/s. My gigabit broadband was basically eaten by one device.

distinguish between the three types of cards, so you don't reboot as soon as you get stuck on the card

the whole family gets stuck at once, there are only three ways to handle it, and the methods are completely different. Take a minute to identify the exact situation.

The first is outsiders freeloading the internet. When you open the Mijia app to check the device list, an unfamiliar phone appears, meaning the password is missing. Follow the I previously wrote about checking and checking online to handle it, block and change the password in one step.

second is too much equipment to carry. At home, dozens of cameras, speakers, and vacuum cleaners are crowded together. The main symptoms of overload are disconnections, supplemented by lag. It's not the same as my home where 'everything is online but all lag.' I wrote about how to judge this in my about the number of devices I carry.

the third scenario is the main focus of this article: a certain device is rapidly downloading or transferring data in the background, eating up most of the broadband. The most typical feature of this card is that the device is fully online and the signal is full, but the internet speed is gone. Restarting the router doesn't help at all; it crashes and you get stuck on it.

First Station: 31.1 Device List, Check Real-Time Rates to Catch Current

open 192.168.31.1 on your computer or mobile browser, log in to the backend homepage, where you'll find a large topology diagram with a row of device cards at the bottom. Each card displays not only the device name but also a flashing real-time number, which shows the device's current upload and download speed.

don't search page by page; your eyes just scan the numbers. In standby mode at home, most devices are at 0 or tens of KB/s in small numbers, with camera feed at most 2 to 4 Mbps. If a card's numbers are consistently in double digits in MB/s, or even above 90MB/s, don't hesitate—it's the culprit.

night at my place: all other devices were running in the tenths of a bit, and only the desktop download box in the study room had 92MB/s. Gigabit broadband tests only reach about 118MB/s, with one unit eating up 90%, leaving FamilyMart to compete for just a fraction. The web page is just spinning.

casually mention three points that are easy to misjudge. First, the same device might have two lines—one 2.4G and one 5G. This means each band is recorded separately, not an extra device, so don't count the numbers when checking the numbers. Second, connect the desktop via network cable and also list it—don't just focus on WiFi devices. Third, the page numbers refresh every few seconds. You have to watch the trend for over ten seconds, and if you close it at a glance, it's easy to miss devices downloading in the pulse.

Second stop: Traffic statistics page, where repeat offenders are caught by cumulative counts

real-time rate is caught in the act, but some data theft isn't a daily offense. My TV box is just like that: normally, you can't tell it, but at three or four in the morning, it wakes up on its own to update and cache, and after a month, it steals 60 to 70GB of data.

repeat offenders like this should be caught on the 'Traffic Statistics' page. The path is in the "Common Settings" section at the top of the backend. Scroll down to find traffic statistics. The page is divided into two sections: the top shows the current uplink and downlink speeds for the entire broadband; the bottom lists cumulative traffic by device, starting from the day statistics are enabled.

the trick to reading this page is sorting thinking: whoever has a cumulative count an order of magnitude higher than similar equipment has a problem. TV boxes consume 70GB a month, while my mom only watches TV for two hours a day, so normally she's just over ten GB at most. This difference is solid proof of sneaking away at night. Box manufacturers love to update late at night, precisely because no one watches TV then, but they don't count your home's broadband uplink is just so-so, and the cache lasts two or three hours straight. You can casually check the "Internet Report" section in the Mi Home app to get a rough idea, but the granularity is only for reference, not evidence.

three techniques for identifying equipment, plus a list of habitual offenders

the list couldn't identify which machine the card was, the investigation couldn't proceed. My method is rustic but effective.

first trick: check the factory trademark annotation. 31.1 device cards automatically include the manufacturer's name. Xiaomi, Apple, Honor can be grouped at a glance, and phones are grouped by manufacturer, splitting phones, computers, and smart devices into three groups, narrowing the scope directly.

second trick: check online time. Click into the device details to see if it's hanging 24/7. Desktop computers, NAS, and cameras are all normal for regular online hours, but 'phones are still active at 3 a.m.' It's worth a closer look—either cloud backups or something serious.

third trick is the dumbest yet fastest: disconnect from the table and reconnect. Turn off the WiFi on suspicious devices and check if the total speed drops—it's the one that drops. Within the range of three or five units, this move is faster than any analysis. If you encounter a string of garbled device names that you can't recognize, it's very likely that a random MAC is enabled. I'll write the details in the of MAC address.

recognize who it is, then you have to identify what kind of thief it is. After several rounds, I put together a checklist: for home network cards, consider these six first, with a hit rate of 80-90%.

pay special attention to which column to upload. The uplink bandwidth at home is already narrow, and gigabit plans generally only get 30 to 50 Mbps. When you back up your phone's photo album, uploads get maxed out, and downlink suffers—web requests can't be sent, and no matter how fast the download is, it's useless. I explained this in my speed test .

after finding the real culprit, the punishment is divided into four stages

After pulling out

, don't rush to unplug the network cable. Think carefully about what effect you want, and use four levels of methods, from light to heavy.

the lightest level is to wait until it finishes running. Steam updates for one-time tasks, and you just let them finish before bed; it's not worth changing any settings for them.

second gear is the speed limit. Devices that need to be online for a long time but don't want to let them lose their appetite, like your child's computer or a permanent downloader, can directly enter the device speed limit , set a 100MB downlink and 20MB uplink limit. If it works, the whole family won't suffer.

third tier is the off-network period. For TV boxes that only act during specific time periods, use the children's internet control to disconnect during disconnection periods, cutting off directly from midnight to 7 a.m. and solving the problem once and for all.

the lowest level in the box is QoS. For families with many devices and everyone wants to grab them, running QoS in the background to prioritize game videos and bottom download rankings is unbeatable. I'll write the exact switch location in QoS .

you want to check when you're out, you can check the Mijia App's device list remotely to view real-time speed, paths, and more remote features in the remote management . However, a reminder: some older app models don't display real-time internet speed, which is due to firmware limitations, not a broken issue. Just check the webpage backend honestly.

Finishing: Five-step sequence, follow the

comes down to one thing: when your FamilyMart card is off, don't rush to restart your router—it will only interrupt your investigation. First, open the 31.1 device list and glance at the real-time numbers. Within five minutes, the real culprit is basically revealed—if my desktop could talk, I'd probably apologize on Steam's behalf.