WiFi Guard: questions and answers

Common questions about WiFi Guard. For how it works and how to identify your devices, see the WiFi Guard manual.

Can WiFi Guard block a device?

No. WiFi Guard is a monitoring tool: it scans your network and tells you when a device it does not recognise joins. An application running on one computer cannot block other devices on the network; only the router decides who gets connected. What to do after an alert is up to you.

Some routers can block a device by its MAC address, but MAC addresses are easy to forge, so such a block is easily circumvented. If someone has your WiFi password, change it on the router. Your own devices will need the new password, and anyone else will be cut off. While you are there, strengthen your WiFi security:

• use WPA2 or WPA3 rather than WPA or WEP;
• choose a long password that is hard to guess;
• turn off WPS on the router, as it has known vulnerabilities by design.

Some or all devices are missing from the list

If WiFi Guard does not find some of your devices, or none at all, check these in turn:

• The device is asleep. Phones and tablets in standby often do not answer. Wake the device and scan again; sometimes it takes a couple of scans to find everything.
• The wrong network adapter is selected. On the General page of Settings, make sure Network adapter is the one connected to your WiFi or cable network.
• The router isolates its clients. With wireless client isolation (also called AP isolation), devices on the network cannot see each other, and WiFi Guard cannot see them either. Guest networks usually isolate their clients too. Turn the isolation off in the router’s settings, or run WiFi Guard on a computer connected to the same network as the devices.
• The devices are on another subnet. WiFi Guard scans the subnet of the selected adapter. To scan other address ranges too, add them under Custom IP address ranges on the Scanning page of Settings.
• A firewall blocks WiFi Guard. On Windows, the installer allows WiFi Guard through Windows Firewall. If you use another firewall, allow WiFi Guard in it, or turn the firewall off briefly to see whether it is the cause.

All devices behind a repeater show the same MAC address

Devices connected through a wireless range extender or repeater may show different IP addresses but the same MAC address, the repeater’s own. Most repeaters replace their clients’ MAC addresses with their own, so nothing on the network can see the real ones. You can see the same thing by typing arp -a in a command prompt. It is not a fault in WiFi Guard.

One way around it is to use WDS (Wireless Distribution System) mode, if your router and repeater support it: WDS keeps the original MAC addresses across the link between access points. The drawback is that WDS equipment from different makers is often not compatible.

A known device shows as unknown again

WiFi Guard recognises devices by their MAC address. To protect their owners’ privacy, phones, tablets and computers now often use a private, randomly generated MAC address instead of their real one, and may change it from time to time. When a device you marked as known comes back with a new address, WiFi Guard sees a new device and reports it as unknown, until you mark it as known again.

There are two ways to stop this.

Let WiFi Guard trust private addresses

Private addresses are recognisable: they are “locally administered”, while real hardware addresses are not. On the Whitelisting page of Settings, tick Automatically mark locally administered addresses as known. Devices with such an address are then marked as known straight away, with the comment “Locally administered address”.

This is the easy way, but it has a cost: a stranger’s phone joining your network will usually also use a private address, and it will be marked as known without an alert. If that matters to you, use the second way instead.

Give your devices a fixed address on your network

Most devices can keep the same address on a network you trust, such as your home network. WiFi Guard then recognises them every time, and still alerts you to anything new.

iPhone, iPad and Mac

• On an iPhone or iPad, open Settings, then Wi-Fi, and tap the “i” icon next to your network. On a Mac, open System Settings, then Wi-Fi, and click Details next to your network.
• Set Private Wi-Fi Address to one of these:
  • Fixed: a private address that stays the same on this network. Recommended: other networks cannot track the device, and WiFi Guard recognises it reliably.
  • Off: the device’s real hardware address. WiFi Guard recognises it too, but the device can be tracked across networks.
  • Rotating: the address changes from time to time on this network, and WiFi Guard reports it as unknown each time.

Windows

• Open Settings, then Network & internet, then Wi-Fi, and click Manage known networks.
• Choose your network and set Random hardware addresses to Off for it, so the computer uses its real address on this network.

Android

• Open Settings, then Network & internet or Connections, depending on the device, and then Wi-Fi.
• Tap the gear or info icon next to your network, or long-press its name.
• Under Privacy or MAC address type, choose the device’s own MAC address (Use device MAC or Phone MAC, depending on the maker) instead of a randomised one.

Other devices

Some smart TVs, games consoles and other devices use private addresses too. Look in their network or Wi-Fi settings for an option such as “MAC randomisation” or “Private address”.

How do I approve all devices of one make at once?

The first three pairs of a MAC address identify the maker of the device’s network chip. If you have several devices of one make, such as smart plugs, light bulbs or cameras, WiFi Guard can approve them all by that prefix:

• Open the Whitelisting page of Settings and click Add... under Partial match (first 3 MAC octets).
• Enter the first three pairs of the address, as shown in the MAC column of the device list (for example, 00:1A:2B), and a comment, such as “Smart plugs”.
• Click OK, then OK in Settings.

Every device whose address starts with that prefix is then marked as known with your comment, both those already in the list and any that join later.

Use this only for makers whose devices you would not expect from anyone else. A prefix belonging to a phone or laptop maker would approve every visitor’s phone or laptop of that make too. It also does not help with phones that use private addresses, as those do not carry the maker’s prefix.

Still have questions? Drop us a line.