My Home Wi-Fi Got Slow — Diagnosing Suspected Unauthorized External Use with Data

Suspicion

My home WiFi felt slower than usual. The first thought: "Is someone outside using our WiFi without permission?" But before changing the router password based on a hunch, I decided to check with data.

Step 1 — Is the line itself alive? (ping)

$ ping 1.1.1.1
Reply: time=3ms TTL=55
Reply: time=3ms TTL=55
Reply: time=41ms TTL=55
Reply: time=3ms TTL=55
average = 12ms, loss 0%

Small packet pings are very fast (average 12ms, 0% loss). The line/ISP itself is normal. It's easy to mistakenly conclude "no problem" based on this alone.

Step 2 — Actual Speed Test (fast.com)

However, when I tested with fast.com:

Download:        17 Mbps   (~3% of contracted speed)
Upload:          0.85 Mbps
Latency (no traffic): 38ms
Latency (heavy traffic): 1.1 seconds   ← Decisive clue

The key is "Latency with heavy traffic: 1.1 seconds." Normally 38ms, it explodes 30-fold when large amounts of traffic are flowing. This is a strong signal of bufferbloat — the line is already saturated by someone's large download/upload. Small pings are fast, but the bandwidth is choked.

Step 3 — Is it my PC? (Task Manager)

If the line is choked, I need to narrow down "who" is using it. First, my own PC:

Ctrl + Shift + Esc → Performance tab → Wi-Fi, and then Processes tab → Sort by Network column:

Total Network:  0%
Chrome:        0.2 Mbps
Rest:          0 Mbps
─────────────────────
My PC Total:   ~0.3 Mbps

My PC is using only 0.3 Mbps, but the line is saturated at 17 Mbps. → The culprit isn't my PC, but another device.

Step 4 — Distinguishing Family vs. External

The candidates for "another device" are, in order:

1. Family devices — Netflix 4K, game downloads, phone backups (most common)
2. Unauthorized external users
3. IoT device malfunction — set-top box/appliance firmware downloads

How to check: Router management page (usually http://192.168.0.1 or the "Default Gateway" address from ipconfig) → Connected devices list. Count your own + family devices beforehand and compare. If there are more, it's an external user.

When You Don't Know the Password — Physical Reset

What if you don't know the router's admin password? Press and hold the RESET hole on the unit for 10 seconds to factory reset → The WiFi password resets to its default, immediately disconnecting unauthorized users who cannot reconnect. This is a way to block them without the password. (Reconnect your own devices with the default password from the router's sticker).

Lessons Learned

1. Ping normal ≠ Speed normal. Small packet pings (1.1.1.1) can be fast even if the line is saturated. Bandwidth issues should be assessed with large-volume tests like fast.com and "latency with heavy traffic."
2. Bufferbloat is the key indicator. If latency jumps dozens of times when under load compared to no load, it means the line is choked by someone's large-volume traffic.
3. "Who is using it?" is narrowed down with Task Manager. If your PC is quiet but the line is saturated, the culprit is another device. Act after confirming suspicion with data.
4. The router's RESET button = password-free blocking. Even if you forget the admin password, a physical reset will reset the WiFi password, allowing you to disconnect unauthorized users.