Author: edmalaker

Every activity on a network—from opening a website to checking email—requires devices to exchange small units of data called packets. Examining these packets can help network owners understand how their systems communicate, troubleshoot connection problems, and investigate potentially suspicious activity.

This process is commonly called packet capture or packet analysis. It is a valuable skill for network administrators, cybersecurity students, and Security Operations Center analysts.

What Is a Network Packet?

A network packet is a small piece of information sent from one device to another. A packet normally contains information such as:

• The time it was transmitted
• Its source and destination addresses
• The network protocol being used
• Source and destination port numbers
• The packet’s size
• Control information used to manage the connection

Some packets also contain application data. However, most modern websites and applications use encryption, so a packet capture will not normally reveal the contents of HTTPS webpages, passwords, private messages, or encrypted files.

Packet analysis is often more about examining communication patterns than reading the actual content.

Why Capture Packets at the Router?

A router sits between the local network and the internet, making it a useful observation point. Depending on the router’s capabilities, it may be able to capture traffic entering or leaving the network.

Packet captures can help answer questions such as:

• Is a device successfully reaching the internet?
• Which protocols is a device using?
• Is a connection failing during its initial setup?
• Is a device repeatedly contacting an unfamiliar destination?
• Is unencrypted traffic being transmitted?
• Is unexpected data leaving the network?
• Are DNS requests working properly?

Packet captures can also establish a baseline of normal activity. Knowing what ordinary traffic looks like makes unusual behavior easier to recognize later.

Authorization and Privacy Come First

Only capture traffic on a network that you own or have explicit permission to monitor. Other authorized users should understand that troubleshooting or security monitoring may occur.

Packet-capture files can contain private information, including IP addresses, device names, domain requests, session identifiers, and portions of unencrypted communications. They should be treated as sensitive security records.

Never capture traffic from a neighbor’s network, public network, workplace, or another person’s device without proper authorization.

Creating a Small, Controlled Capture

The best first experiment uses one test device and a short capture period.

1. Select a computer or phone that you own.
2. Record the purpose of the test.
3. Close unrelated applications on the device.
4. Start a limited packet capture on the appropriate router interface.
5. Generate a few known activities, such as opening one HTTPS website, performing a DNS lookup, or sending a ping.
6. Stop the capture after one or two minutes.
7. Save the resulting capture securely.
8. Open it locally in a packet-analysis program such as Wireshark.

Some routers provide packet capture through their normal administration interface. Advanced router systems may support tools such as tcpdump, which can save traffic in a PCAP file for later analysis. The exact procedure varies by router and firmware. Do not install packages or enter commands copied from the internet without confirming that they apply to the specific device and creating a configuration backup first.

Captures should be limited by device, interface, protocol, time, or file size whenever possible. An unrestricted capture can grow rapidly and may consume the router’s memory or storage.

Understanding Common Protocols

A beginner will commonly encounter the following traffic:

ARP

Address Resolution Protocol helps local devices associate IP addresses with hardware addresses. ARP traffic is normal on most local networks.

DNS

The Domain Name System translates names such as example.com into IP addresses. Traditional DNS requests may be visible, but encrypted DNS can conceal these names from the router capture.

TCP

Transmission Control Protocol establishes reliable connections. A normal connection often begins with the three-way handshake:

1. SYN
2. SYN-ACK
3. ACK

Repeated SYN packets without a response may indicate a connectivity problem, filtering, an unavailable service, or unsuccessful connection attempts.

TLS

Transport Layer Security protects communications such as HTTPS. A capture may show which systems are communicating and provide details about the encrypted session, but it normally will not reveal the protected webpage, password, or message.

ICMP

Internet Control Message Protocol supports diagnostic functions such as ping. It can help determine whether a destination is reachable, although some systems intentionally ignore ping requests.

Using Wireshark Filters

Wireshark can open PCAP files and display each captured packet. Useful beginner display filters include:

• dns — display DNS traffic
• icmp — display ping and related diagnostic traffic
• tcp — display TCP traffic
• tls — display encrypted TLS connections
• ip.addr == 192.0.2.10 — display traffic involving one example address

The address 192.0.2.10 is a documentation address, not an actual home-network address. During a private investigation, it can be replaced with the test device’s real address. The real address should be removed or replaced before publishing screenshots or notes.

Wireshark’s packet list shows a summary of each packet. Selecting a packet reveals protocol details, while the bytes pane shows the underlying raw data. Beginners should start with the packet list and protocol details instead of trying to interpret every byte.

What Might Require Investigation?

Potentially interesting patterns include:

• Repeated unsuccessful connection attempts
• A supposedly idle device making frequent connections
• Regular connections occurring at exact intervals
• Unexpected use of unencrypted protocols such as Telnet or FTP
• Large unexplained outbound transfers
• DNS requests for unfamiliar or random-looking domains
• A device communicating with many destinations in a short period
• Traffic using a service or port that the device should not require

One unusual packet is not proof of malware or an attack. Software updates, advertising services, cloud platforms, content-delivery networks, and device telemetry can produce complicated-looking traffic. Suspicious activity should be investigated using additional evidence, including router logs, device logs, antivirus results, process information, and known device behavior.

Important Limitations

A router capture may not show every packet on the local network. Traffic traveling directly between two devices through a network switch may never pass through the router.

The results may also be incomplete if the wrong interface is selected, traffic takes a different route, or hardware acceleration prevents some packets from reaching the capture tool. VPNs and encryption can hide application contents even though connection metadata remains visible.

Packet capture is therefore an evidence source, not a complete verdict about the network.

Documenting the Results Safely

A useful private record can include:

• Date and time
• Reason for the capture
• General interface category
• Test duration
• Device being tested
• Capture filter
• Approximate packet count
• Expected activity generated
• Observations
• Follow-up action
• Location of the protected capture file

Original PCAP files should remain private. They should not be uploaded to unknown online analysis services because they may contain far more sensitive information than is immediately visible.

Final Thoughts

Learning to read packets turns invisible network activity into observable evidence. A short, controlled capture can demonstrate how DNS, TCP, TLS, and other protocols work while building skills that are directly relevant to troubleshooting and security analysis.

The safest approach is to begin with one authorized device, generate known traffic, capture for a short period, and carefully document the results. Over time, these controlled observations can create a reliable baseline for distinguishing ordinary network behavior from activity that deserves further investigation.

Further Reading

• OpenWrt: Capturing packets with tcpdump and Wireshark
• Wireshark User’s Guide

A home router quietly records information about events occurring on the network. These records, called logs, may show devices connecting and disconnecting, administrative login attempts, internet-connection changes, firewall activity, software errors, and router restarts.

Reviewing these logs can help identify unusual behavior before it becomes a larger problem. However, router logs are clues—not automatic proof that an attack occurred. Understanding the context of an event is just as important as finding it.

What Are Router Logs?

A router log is a time-ordered record of activity. Depending on the router, available logs may include:

• System events and errors
• Administrative login activity
• Firewall blocks
• Devices joining or leaving the network
• Internet connection interruptions
• DHCP address assignments
• VPN connections
• Firmware updates
• Service changes
• Router restarts

Consumer routers vary considerably. Some provide detailed records, while others retain only a small number of recent events. A router may also erase some logs after restarting.

Before Reviewing the Logs

First, make sure the router’s date, time, and time zone are correct. An incorrect clock makes it difficult to compare a router event with activity on a computer, phone, or security alert.

Next, locate the logging page. It may appear under a menu named:

• System Log
• Security Log
• Event Log
• Administration
• Diagnostics
• Firewall
• Advanced Settings

Do not change settings simply because an unfamiliar message appears. Preserve the available information and investigate its meaning first.

Failed Administrative Login Attempts

Repeated failed attempts to enter the router’s administration panel deserve attention, especially when they occur at times when nobody was managing the router.

A few failures may be caused by someone mistyping a password. Repeated failures from an unfamiliar device, however, may indicate that a person, application, or compromised device is attempting to gain access.

Check whether remote administration is enabled. If the administration panel is available only from the local network, the source may be a device inside the home. If remote administration is enabled, the attempts could have originated from the internet.

A failed login does not mean the attacker succeeded. Unexpected successful logins, configuration changes, or newly enabled services are more serious.

Unusual Restarts

Routers restart for many legitimate reasons, including:

• Firmware updates
• Scheduled maintenance
• Brief power interruptions
• Overheating
• Software errors
• Someone manually restarting the device

An isolated restart is not necessarily suspicious. Repeated restarts, unexplained configuration resets, or restarts occurring alongside administrative logins and setting changes deserve further investigation.

Before restarting a router during an investigation, export or photograph the relevant logs when possible. Restarting may erase the evidence being reviewed.

Firewall Messages and Blocked Connections

A firewall log may contain many blocked incoming connections. This is common because internet-connected addresses are continuously scanned by automated systems.

A blocked attempt usually means the firewall performed its job. It does not automatically mean the router was compromised.

Look for patterns instead of reacting to a single entry:

• Large increases in repeated attempts
• Activity directed at an intentionally opened port
• Unexpected outbound connections
• Firewall rules being added or disabled
• Remote-management services becoming active
• Connections appearing immediately after an unusual configuration change

Establish a Normal Baseline

Logs become more useful after you understand what normal activity looks like. Review them during a quiet period and make note of routine events such as expected restarts, internet reconnections, and known devices joining the network.

Later reviews can be compared with this baseline. Unexpected changes are easier to recognize when normal activity has already been documented.

Document Findings Safely

Router logs may contain information that should remain private, including:

• Public and private IP addresses
• MAC addresses
• Device and host names
• Wi-Fi network names
• Usernames
• Router serial numbers
• VPN server addresses
• Dynamic DNS names

Keep the original export or screenshot private and unchanged. If information must be shared publicly, create a separate redacted copy.

A useful private review record should include:

• Date and time of the review
• Router time zone
• General type of event
• Whether the event was expected
• Possible explanation
• Action taken
• Whether follow-up is required

Do not include passwords, authentication tokens, recovery codes, or complete configuration exports in public documentation.

What to Do If Something Looks Suspicious

First, preserve the available logs. Then confirm that the event is not explained by maintenance, a family member, a power interruption, or a known device.

If unauthorized access appears possible:

1. Use a trusted computer to change the router administrator password.
2. Disable unnecessary remote administration.
3. Review SSH, port forwarding, UPnP, VPN, DNS, and firewall settings.
4. Check for unfamiliar administrator accounts or connected devices.
5. Install an official firmware update if one is available.
6. Examine computers and phones for malware.
7. Contact the router manufacturer or internet provider if assistance is needed.

If there is strong evidence that the router was compromised, a factory reset and careful manual reconfiguration may be safer than restoring a questionable configuration backup.

How Often Should Logs Be Reviewed?

A monthly review is a reasonable starting point for many home networks. Logs should also be checked after:

• An unfamiliar device appears
• The router restarts unexpectedly
• Internet behavior changes without explanation
• A security alert is received
• Remote access or port forwarding is enabled
• Important router settings are changed

Regular log review cannot prevent every security incident, but it creates awareness. That awareness makes it easier to distinguish ordinary router activity from a change that requires investigation.

A home router is supposed to act as a protective boundary between the internet and the devices inside a home. Computers, phones, televisions, cameras, game systems, and smart devices can make outgoing connections, while the router’s firewall normally blocks unexpected incoming connections.

However, router settings can change this behavior. Remote administration, port forwarding, Universal Plug and Play, VPN servers, and other features may create paths from the internet into the home network. Some paths are intentional and useful, but others may have been enabled temporarily and forgotten.

Checking a router’s internet exposure helps identify these openings before someone else discovers them.

What Does “Exposed to the Internet” Mean?

A router is exposed when a person or system outside the home network can reach one of its services or a service on a device behind it.

Exposure does not automatically mean the router has been hacked. For example, someone may intentionally run a VPN server for secure remote access. The important questions are:

• Which services can be reached?
• Were they intentionally enabled?
• Are they still needed?
• Are they updated and protected?
• Can access be limited further?

An unexpected open service increases the network’s attack surface. Attack surface refers to all the possible places an attacker might try to enter a system.

Why Should You Check?

Router settings are not always permanent. A game console, security camera, file-sharing program, or other application may request changes. Someone troubleshooting a connection might enable a feature and forget to disable it later. Firmware updates can also add or modify options.

Attackers regularly target internet-facing routers. In April 2026, the NSA and FBI again advised owners of home and small-office routers to disable internet-facing remote management, install current firmware, replace unsupported devices, and change default credentials.

A regular exposure check can help identify:

• An administration page available from the internet.
• Old or unnecessary port-forwarding rules.
• A device placed in the router’s DMZ.
• Ports opened automatically through UPnP.
• File-sharing services available outside the home.
• An unused VPN or remote-access server.
• Weak or missing IPv6 firewall protection.
• Features that were enabled for testing and never disabled.

Understand the Common Sources of Exposure

Before testing the connection, review the settings most likely to create internet access.

Remote Administration

Remote administration allows someone to sign in to the router while away from home. This may also be called remote management, web access from WAN, or administration from the internet.

Unless it is specifically required and carefully secured, remote administration should normally be disabled. Router configuration should be performed from a trusted device connected to the internal network.

Port Forwarding

Port forwarding directs incoming internet traffic to a particular device inside the network. It may be used for gaming, cameras, servers, or remote-access applications.

Every forwarding rule should have a known owner and purpose. Remove rules that are no longer required.

DMZ Host

Some home routers have a setting called DMZ host. It can send a large amount of unsolicited incoming traffic to one internal device.

This is not the same as a properly designed business-network DMZ. On a home router, placing a device in the DMZ can significantly increase its exposure. Leave this feature disabled unless there is a clearly understood reason to use it.

Universal Plug and Play

Universal Plug and Play, or UPnP, allows applications and devices to request port-forwarding rules automatically. This is convenient for gaming and communication applications, but it reduces the owner’s control over which ports are opened.

Security guidance from the NSA recommends disabling UPnP. If it is required for a particular device, review its mappings regularly and understand the tradeoff.

VPN Servers

A router may include a VPN server that allows secure access to the home network while traveling. Because the VPN server must accept internet connections, it is intentionally exposed.

Keep the router updated, use strong authentication, disable unused VPN protocols, and review the VPN accounts regularly.

Cloud Management

Some routers can be managed through a manufacturer’s website or mobile application. This type of access may use an outbound cloud connection and might not appear during a normal port test.

Review cloud-management settings separately. Disable the feature if it is not needed, protect the account with a strong unique password, and enable multifactor authentication when available.

IPv6

IPv6 does not normally depend on the same type of address translation used by many IPv4 home networks. Devices may receive globally routable IPv6 addresses, making the router’s IPv6 firewall especially important.

Do not assume that a successful IPv4 test also proves that IPv6 is protected. Confirm that the router’s firewall applies to both IPv4 and IPv6.

Step 1: Update the Router

Before performing the audit, check for firmware updates through the router’s administration panel or the manufacturer’s official support site.

Updates frequently correct security vulnerabilities. If the router is no longer receiving security updates, replacing it may be safer than continuing to expose it to the internet.

If the router supports configuration backups, create one before changing settings. Store the backup privately because it may contain sensitive network information.

Step 2: Review the WAN Settings

Sign in to the router from a trusted device on the internal network.

Look for menus with names such as:

• Security
• Firewall
• Remote Access
• Administration
• Port Forwarding
• Virtual Server
• NAT Rules
• UPnP
• DMZ
• VPN Server
• Cloud Management
• IPv6 Firewall

Menu names vary by manufacturer. Do not change an unfamiliar setting until its purpose is understood.

Record which internet-facing services are intentional. Do not publish public IP addresses, usernames, device names, port-forwarding destinations, or screenshots of the administration panel.

Step 3: Review Port-Forwarding and UPnP Rules

Examine every manually configured port-forwarding rule.

For each rule, determine:

• Which device receives the traffic?
• Which application needs the rule?
• Who created it?
• Is it still required?
• Is the receiving device updated?
• Does the service use authentication and encryption?

Next, review any UPnP mappings displayed by the router. An unfamiliar mapping is not proof of an attack, but it should be investigated.

Do not immediately delete a rule if its purpose is uncertain. Identify the associated device or application first. Removing a needed rule can interrupt gaming, cameras, remote work, or other services.

Step 4: Check from Outside the Network

Testing only from inside the home network may show the router’s internal services instead of what the public internet can reach.

A simple external test can be performed with a reputable online port-checking service. Test only an internet connection and equipment that you own or have permission to assess. Avoid scanning unrelated addresses.

Begin with ports that appear in the router’s forwarding or remote-access settings. A port-testing service will normally display one of three general results:

• Open: A service appears to be accepting connections.
• Closed: The address responded, but no service accepted the connection on that port.
• Filtered or timed out: A firewall or another network device may be silently blocking the traffic.

An open port is not automatically malicious. Compare it with the list of intentional services. An unexpected open port should be investigated promptly.

A port checker will see the public IP address used for the test. Treat that address as private information and do not include it in an article, screenshot, forum post, or social-media message.

Step 5: Consider ISP Address Translation

The WAN address displayed by a router may be different from the public address reported by an internet-testing site. This can happen when an internet provider uses carrier-grade network address translation, commonly called CGNAT.

CGNAT can make unsolicited incoming IPv4 connections more difficult, but it should not replace a security audit. Cloud access, IPv6 exposure, router vulnerabilities, and services created through the provider may still require attention.

Step 6: Correct Unexpected Exposure

If an unexpected service is reachable, determine which setting created it.

Common corrective actions include:

• Disabling remote administration from the internet.
• Removing obsolete port-forwarding rules.
• Disabling the home-router DMZ feature.
• Disabling UPnP when it is not required.
• Turning off unused VPN, file-sharing, and media services.
• Confirming that both IPv4 and IPv6 firewalls are enabled.
• Updating the router and the device receiving forwarded traffic.
• Changing default or weak administration credentials.
• Removing unused administrator and remote-access accounts.
• Replacing a router that no longer receives security updates.

Make one change at a time and test again. This makes it easier to identify which setting affected the result.

If there are signs that the router was compromised, disconnect it from the internet and consult the manufacturer or internet provider. A factory reset followed by a manual reconfiguration and credential changes may be necessary. Do not restore an old configuration backup if it may contain the unwanted setting or compromise.

What an External Test Cannot Prove

A clean port scan is encouraging, but it does not prove that a router is completely secure.

A basic test may not identify:

• UDP services that respond only to specific requests.
• Cloud-based remote management.
• Exposure through IPv6 when only IPv4 was tested.
• Vulnerabilities in services that appear closed during the test.
• Malicious settings affecting DNS or outgoing traffic.
• A compromised device that communicates outward to an attacker.
• Services that become active only at certain times.

Internet-exposure testing should be combined with firmware updates, strong credentials, configuration reviews, device inventories, DNS monitoring, and examination of router logs.

How Often Should the Check Be Repeated?

Perform a basic exposure review at least every three months. It should also be repeated:

• After installing router firmware.
• After adding a camera, game system, server, or smart device.
• After enabling remote access or a VPN server.
• After changing port-forwarding, UPnP, firewall, or IPv6 settings.
• After troubleshooting a connection problem.
• When an unexpected device appears on the network.
• When there is evidence of suspicious activity.
• Before and after replacing a router.

Keep the detailed results private. A public article can describe the process and provide anonymous conclusions without revealing addresses, device names, account information, or open services.

Final Thoughts

The goal of an exposure audit is not necessarily to make every port disappear. The goal is to ensure that every internet-accessible service is intentional, necessary, updated, and properly protected.

For most home networks, remote administration, unused port forwarding, UPnP, and the DMZ feature should remain disabled. Services that must be available should use strong authentication, current software, encrypted connections, and the narrowest access possible.

Knowing what the internet can reach is an important part of understanding and defending a home network.

Sources and Further Reading

• NSA: Best Practices for Securing Your Home Network
• NSA and FBI guidance concerning vulnerable home and small-office routers

A USB drive normally belongs to one computer at a time. Plug that same drive into a compatible router, however, and it may become storage that multiple devices can access through the local network.

This arrangement is commonly called network storage, a network share, or a lightweight NAS. NAS stands for network-attached storage. It can provide a convenient place for documents, photographs, videos, installers, and other files without requiring a dedicated file server.

Not every router supports this feature. Before beginning, check the router’s documentation or administration panel for options such as Network Storage, File Sharing, USB Storage, Samba, SMB, WebDAV, or Media Server.

Why Create Private Network Storage?

The main benefit is convenient file sharing. Instead of copying the same file to several computers or carrying a flash drive between devices, authorized users can open a shared folder through the network.

Possible uses include:

• Sharing documents between household computers.
• Moving files between Windows, macOS, Linux, Android, and iOS devices.
• Creating a central folder for photographs or videos.
• Storing software installers and device manuals.
• Making selected media available to a television or media player.
• Creating a temporary backup destination.
• Learning how accounts, permissions, and network services work.

This is also a useful cybersecurity project. It introduces concepts that security analysts regularly encounter, including authentication, service exposure, data classification, read and write permissions, and the principle of least privilege.

What This Setup Is Not

A USB drive connected to a router should not automatically be treated as a complete backup system or a replacement for a dedicated NAS.

A single drive can fail, become corrupted, be accidentally erased, or be stolen. A router may also provide fewer monitoring, performance, encryption, recovery, and redundancy features than a dedicated storage server.

Important files should still follow the 3-2-1 backup principle:

• Keep at least three copies of important data.
• Store those copies on at least two different types of media.
• Keep at least one copy in another location.

A router-connected drive can be one copy, but it should not be the only copy.

Understanding the Available Storage Services

The exact services available depend on the router. Common options include Samba, WebDAV, and DLNA.

Samba or SMB

Samba, commonly called SMB file sharing, is normally the best starting point. It allows computers and mobile devices to open shared folders, copy files, and—when permitted—modify or delete them.

Windows supports SMB, while macOS, Linux, Android, and iOS also have compatible applications.

WebDAV

WebDAV provides another way for applications to access files over a network. It may be useful when a device or application supports WebDAV more easily than SMB.

If a router offers both HTTP and HTTPS WebDAV connections, HTTPS is generally the safer choice because ordinary HTTP does not encrypt the connection. Some routers use a self-signed certificate, which can produce a certificate warning.

Beginners who only need local file sharing can start with SMB and leave WebDAV disabled until they have a reason to use it.

DLNA

DLNA is designed mainly for streaming compatible media to televisions, game systems, and media-player applications. It does not provide the same file-management controls as SMB.

Only enable services that will actually be used. Every additional service creates more settings, accounts, and possible security issues that must be maintained.

What You Need

Before beginning, gather:

• A router that supports USB network storage.
• A USB flash drive, solid-state drive, or external hard drive.
• A backup of anything already stored on the drive.
• A computer connected to the router’s local network.
• Access to the router’s administration panel.
• A strong, unique password for the storage account.

Check the router’s documentation for its supported filesystems. Common examples include NTFS, FAT32, exFAT, and EXT4, but support varies between manufacturers and firmware versions.

External hard drives can require more power than a router’s USB port can reliably supply. If the drive has its own power adapter, use it. Unexpected disconnections caused by insufficient power can result in failed transfers or file corruption.

Step 1: Back Up and Prepare the Drive

Copy any existing files that matter to another location before connecting or reformatting the drive.

If formatting is necessary, choose a filesystem supported by the router. Remember that formatting erases the drive.

Creating separate folders before sharing can make permissions easier to manage. For example, a general read-only folder can be separated from a folder where authorized users are allowed to add or delete files.

Step 2: Connect the Drive

Connect the storage device to the router’s USB port.

Give the router time to detect it. If the drive repeatedly disconnects, makes unusual sounds, or fails to appear, stop and investigate its power supply, cable, filesystem, and physical condition.

Do not continue storing files on a drive that appears unreliable.

Step 3: Open the Storage Settings

Sign in to the router’s local administration panel.

Look for a menu named something similar to:

• Network Storage
• USB Storage
• File Sharing
• Storage Services
• Samba
• SMB Server
• Media Server

The exact menu name and location will depend on the router and firmware version.

The connected drive and its partitions should appear on the page. Do not publish screenshots that expose the router address, drive labels, usernames, folder names, or other identifying information.

Step 4: Enable SMB File Sharing

Enable the router’s Samba or SMB service.

If the settings include an option such as Allow Access from WAN, Remote Access, Internet Access, or External Access, leave it disabled.

WAN refers to the external or internet-facing side of the router. Private home storage should normally remain available only inside the local network.

Never expose SMB directly to the public internet. If remote access is needed later, use a carefully configured VPN or another secure remote-access system instead of opening the file-sharing service to everyone online.

Step 5: Create a Storage User

Create a dedicated account for accessing the shared storage.

Use:

• A username that does not reveal unnecessary personal information.
• A long, unique password.
• Credentials that are different from the router administrator account.
• A password stored in a reputable password manager.

Do not enable anonymous or guest access unless there is a specific and carefully considered reason. Anonymous access allows devices to reach the share without individual credentials, making it more difficult to control and investigate activity.

Step 6: Select the Shared Folder

Choose the folder that should be available through the network.

Sharing one intended folder is generally safer than sharing the entire drive. It reduces the amount of data exposed if an account is misused or a connected device becomes infected.

The router may allow accounts to receive read-only or writable access.

Use read-only access when a person or device only needs to view or copy files. Grant writable access only when the user must create, change, or delete files.

This follows the principle of least privilege: users and devices should receive only the access required for their purpose.

Step 7: Connect a Computer or Mobile Device

After the share is created, the router should display a local access address. Save this information privately.

Windows

Open File Explorer and look for an option to add a network location or map a network drive. Enter the SMB address provided by the router, then sign in with the dedicated storage account.

macOS

Open Finder and select Go → Connect to Server. Enter the SMB address and sign in with the storage username and password.

iPhone or iPad

Open the Files app, select Browse, open the three-dot menu, and choose Connect to Server. Enter the server address and select the registered-user option.

Android

Use a file-management application that supports current versions of SMB. Add a network location and enter the router address, share name, username, and password.

Menu names can vary between operating-system versions. Use the exact address generated by the router instead of assuming that every router uses the same address.

Step 8: Test the Permissions

Testing is an important part of the setup.

Confirm that:

• The authorized account can open the shared folder.
• A read-only account cannot modify or delete files.
• A writable account can create a small test file.
• Incorrect credentials are rejected.
• Anonymous access does not work.
• The share is unavailable from isolated guest or IoT networks.
• The drive remains available after restarting the router.
• Files remain accessible after reconnecting a computer.

Delete the test file when testing is complete.

Step 9: Protect the Storage

Network storage requires continued maintenance.

Good security practices include:

• Keep the router firmware updated.
• Keep storage accounts separate from the router administrator account.
• Disable unused SMB, WebDAV, and media-server services.
• Keep internet-facing access disabled.
• Review user accounts and permissions regularly.
• Remove accounts that are no longer needed.
• Back up important files to another device or location.
• Scan files for malware before placing them in a shared folder.
• Do not use the share as the only copy of important data.
• Disconnect the drive safely before physically removing it.
• Consider file or drive encryption for sensitive information.

A password on the network share controls network access, but it does not necessarily encrypt the files stored on the USB drive. Someone who physically removes the drive may be able to read it by connecting it to another computer.

What Performance Should You Expect?

Performance will depend on the router, USB port, drive, filesystem, network connection, Wi-Fi conditions, file sizes, and client devices.

A router is primarily designed to manage network traffic. Its USB storage feature is convenient, but it may not match the speed or capabilities of a dedicated NAS. Large numbers of small files may also transfer more slowly than one large file.

Test performance locally with non-sensitive sample files. Do not publish private folder names, network addresses, usernames, serial numbers, or screenshots containing identifying information.

Final Thoughts

Turning a USB drive into private network storage is an affordable way to share files and learn how network services operate. It can reduce unnecessary file duplication and make selected data available to multiple authorized devices.

The safest beginner configuration is straightforward: enable SMB only for the local network, create a dedicated account, disable anonymous access, share only the necessary folder, begin with read-only permission, and keep external access turned off.

Network storage becomes useful only when it is managed responsibly. Strong authentication, limited permissions, firmware updates, malware awareness, and independent backups are what turn a convenient shared drive into a safer and more dependable part of a home network.

Wi-Fi 7 promises faster transfers, lower latency, and more reliable wireless connections. One of its most important new features is Multi-Link Operation, commonly shortened to MLO.

MLO allows a compatible Wi-Fi 7 device to use more than one wireless link. Depending on the equipment and its implementation, traffic may be distributed across multiple links, switched between them, or sent using the link that is most suitable at that moment.

The technology sounds impressive, but theoretical capability does not always translate into a noticeable improvement in a real home. Distance, walls, interference, channel width, Ethernet-port speeds, client hardware, drivers, and the internet connection can all affect the result.

The best way to evaluate MLO is to compare it with Ethernet and conventional connections on the 2.4 GHz, 5 GHz, and 6 GHz bands.

What Is Wi-Fi 7?

Wi-Fi 7 is the consumer name for technology based on IEEE 802.11be. The standard includes improvements intended to increase throughput, reduce worst-case latency and jitter, and use available spectrum more efficiently. IEEE 802.11be-2024

Important Wi-Fi 7 features include:

• Multi-Link Operation.
• Support for channels up to 320 MHz where permitted.
• 4096-QAM, also called 4K QAM.
• Preamble puncturing for working around interference within a channel.
• Improvements in capacity and spectrum efficiency.

A Wi-Fi 7 router can still serve older Wi-Fi equipment, but an older client cannot use Wi-Fi 7 features merely because the router supports them. Both the router and the client must support MLO for an MLO connection to be established.

What Is Multi-Link Operation?

Older Wi-Fi clients normally communicate through one wireless link at a time. That link uses a particular channel in the 2.4 GHz, 5 GHz, or 6 GHz band.

MLO allows a Wi-Fi 7 client and access point to establish multiple links under one logical connection. Qualcomm’s Wi-Fi 7 explanation describes both simultaneous operation, in which traffic can use multiple links, and alternating operation, in which traffic can move between links to avoid interference. Qualcomm Wi-Fi 7 overview

This creates three possible areas of improvement.

Higher Throughput

A simultaneous MLO implementation may distribute traffic over more than one link. Under suitable conditions, the combined connection may transfer more data than either individual link could carry by itself.

However, not every client supports the same MLO combinations. A device may support different channel widths, spatial streams, radio combinations, or operating modes than the router.

Lower or More Consistent Latency

If one link is busy, an MLO device may be able to use another available link instead of waiting as long for access to the congested channel.

This could be helpful for gaming, video calls, remote desktops, virtual reality, and other applications that depend on consistent response times.

Greater Reliability

Interference or changing signal conditions may affect one frequency band more than another. Access to multiple links gives compatible equipment additional choices.

MLO does not make a wireless connection immune to interference, but it may help the connection adapt when conditions change.

Comparing the Available Connections

Ethernet

Ethernet should be the baseline for a home-network performance test.

A wired connection does not experience Wi-Fi interference, channel congestion, or the same signal loss through walls. It will often provide the most consistent latency and throughput.

Ethernet performance is still limited by the network ports, adapters, cables, switches, and test computers. A 1-gigabit Ethernet connection will generally prevent a test from demonstrating wireless performance above approximately one gigabit per second.

A 2.5-gigabit or faster wired connection may be needed when testing high-performance Wi-Fi 7 equipment.

2.4 GHz Wi-Fi

The 2.4 GHz band generally provides the longest range and better wall penetration, but it has fewer usable channels and is commonly shared with older Wi-Fi devices, Bluetooth equipment, and other household electronics.

It is often suitable for:

• Smart-home devices.
• Low-bandwidth equipment.
• Devices located farther from the router.
• Situations where coverage is more important than maximum speed.

Its disadvantages can include congestion, interference, and lower throughput.

5 GHz Wi-Fi

The 5 GHz band often provides a practical balance between speed, coverage, and device compatibility.

It has more channel capacity than 2.4 GHz and usually supports wider channels and faster connections. Its range through walls is generally shorter than 2.4 GHz, but it often performs well throughout an average home.

For many users, 5 GHz remains the best general-purpose band for computers, phones, streaming devices, and game systems.

6 GHz Wi-Fi

The 6 GHz band provides additional spectrum for newer Wi-Fi equipment. It can offer wide channels and reduced competition from legacy devices.

The tradeoff is range. Higher-frequency signals generally weaken more rapidly with distance and physical obstructions. Intel’s comparison of the three Wi-Fi bands describes 2.4 GHz as the longer-range, lower-speed option and 5 GHz and 6 GHz as higher-speed options over shorter distances. Intel’s 2.4 GHz, 5 GHz, and 6 GHz comparison

Using 6 GHz requires compatible router hardware, client hardware, operating-system support, drivers, and permission to use the spectrum in the device’s region.

A strong 6 GHz connection near the router may be extremely fast. After passing through several walls, a 5 GHz connection may perform better.

MLO

MLO may use links from two or more supported bands. The exact combination depends on the router, client, region, settings, and radio design.

Possible combinations include:

• 2.4 GHz and 5 GHz.
• 2.4 GHz and 6 GHz.
• 5 GHz and 6 GHz.
• Two separate high-band links.
• Other combinations supported by the equipment.

The MLO network should be treated as a separate test mode. Do not assume that seeing an MLO network name proves that the client is actively using multiple links. Verify the connection through the router or client status page when possible.

What MLO Cannot Do

MLO cannot remove every network bottleneck.

It cannot:

• Make an internet connection exceed the speed supplied by the internet provider.
• Overcome the speed limit of a slow Ethernet port.
• Give an older client Wi-Fi 7 capabilities.
• Eliminate signal loss through walls.
• Guarantee that every application will use multiple links.
• Prevent background traffic from affecting a test.
• Correct outdated drivers or incompatible firmware.
• Guarantee that MLO will outperform a strong single-band connection.

A client connected through a clean 6 GHz channel near the router may already have more capacity than it needs. In that situation, MLO may provide little additional throughput while still offering possible latency or reliability benefits.

Why an Internet Speed Test Is Not Enough

An ordinary internet speed test measures the entire route between a device and a remote test server.

The result may be limited by:

• The subscribed internet speed.
• Internet-provider congestion.
• The selected test server.
• Traffic outside the home.
• The router’s internet port.
• The remote server’s available capacity.

If an internet plan is limited to 500 Mbps, Ethernet, 5 GHz, 6 GHz, and MLO might all produce results close to 500 Mbps. That would not show how fast the local connections actually are.

A proper Wi-Fi comparison should therefore begin with a local network test. An internet speed test can be performed afterward as a separate practical measurement.

Equipment Needed for a Fair Test

A useful comparison requires:

• A Wi-Fi 7 router or access point that supports MLO.
• A client device that supports Wi-Fi 7 and MLO.
• Current router firmware.
• Current client operating-system updates and Wi-Fi drivers.
• A second computer connected to the router by Ethernet.
• An Ethernet connection fast enough to avoid limiting the wireless test.
• A local network performance tool such as iPerf3.
• A way to connect the client separately to 2.4 GHz, 5 GHz, 6 GHz, and MLO.

The wired computer will act as the local test server. The Wi-Fi 7 computer will act as the client.

How to Perform the Test

1. Record the Equipment Privately

Before testing, record:

• Router model and firmware version.
• Client model, Wi-Fi adapter, and driver version.
• Ethernet port and adapter speeds.
• Supported channel widths.
• MLO capability.
• Date and approximate test conditions.

Keep serial numbers, IP addresses, MAC addresses, network names, and other identifiers private.

2. Remove Obvious Bottlenecks

Connect the server computer to the router’s fastest appropriate LAN port.

Confirm that the server, Ethernet adapter, cable, and router port negotiated the expected link speed. A slower wired link will cap every wireless result.

Connect both computers to power and pause cloud backups, downloads, streaming, software updates, and other heavy network activity.

3. Create Separate Test Connections

The client must be able to test each connection independently:

• Ethernet.
• 2.4 GHz.
• 5 GHz.
• 6 GHz.
• MLO.

Some routers use a single Wi-Fi name and automatically select a band. That is convenient for normal use but can make controlled testing difficult.

If the router permits it, temporary test-only network names can be created for each band. Use strong, unique passwords, and remove the temporary networks after testing.

Do not publish the real network names or passwords.

4. Select Consistent Test Locations

Test each connection from the same locations. A useful set might include:

• Near the router with a clear line of sight.
• In a neighboring room.
• Farther away with multiple walls between the client and router.

Mark the locations privately so every mode is tested under comparable conditions. Do not publish a detailed floor plan.

5. Establish the Ethernet Baseline

Connect the client computer by Ethernet and disable its Wi-Fi connection.

Run the local performance test several times in both directions. Record:

• Download throughput.
• Upload throughput.
• Idle latency.
• Variability between runs.
• Any packet loss or errors reported by the test.

This establishes the maximum practical performance of the local testing equipment.

6. Test 2.4 GHz

Disconnect Ethernet and connect the client only to the 2.4 GHz test network.

Run the same tests, in the same order, for the same duration. Record the signal information and negotiated connection rate if the client displays them.

Repeat the test at every selected location.

7. Test 5 GHz

Connect only to the 5 GHz test network and repeat the complete procedure.

Do not move the router, server, or client between comparable tests.

8. Test 6 GHz

Connect only to the 6 GHz test network and repeat the tests.

Expect performance to be highly dependent on distance, channel width, and physical obstructions. Verify that the client is actually connected to 6 GHz instead of assuming that it is.

9. Test MLO

Connect the client to the MLO network.

Confirm through the router or client interface that an MLO connection has been established. If possible, record which bands or links are active without publishing their channel numbers or network identifiers.

Run the same throughput and latency tests at every location.

10. Repeat Every Measurement

A single test can be misleading. Run each test at least three to five times.

Use the median result instead of selecting the single highest number. Also record the range between the best and worst results because consistency can be as important as peak speed.

A Simple iPerf3 Test

iPerf3 is a network-testing tool maintained by ESnet. It can test local TCP or UDP performance between two computers. Its reverse option changes the test direction, and it supports additional modes for more advanced testing. Official iPerf3 documentation

On the wired server computer, start the server:

iperf3 -s

On the client, run a 30-second upload test:

iperf3 -c <server-ip> -t 30

Run a 30-second test in the reverse direction:

iperf3 -c <server-ip> -R -t 30

Replace <server-ip> with the private address of the wired test computer. Never publish that address.

Readers who are unfamiliar with command-line tools can use another reputable local-network testing application, but every connection mode must be tested with the same tool and settings.

Suggested Results Table

Connection	Location	Download	Upload	Idle latency	Consistency	Notes
Ethernet	Wired baseline
2.4 GHz	Near
2.4 GHz	One room away
2.4 GHz	Farther location
5 GHz	Near
5 GHz	One room away
5 GHz	Farther location
6 GHz	Near
6 GHz	One room away
6 GHz	Farther location
MLO	Near
MLO	One room away
MLO	Farther location

How to Interpret the Results

If Ethernet Wins

This is normal. Wired Ethernet is the reference connection and is generally the most predictable.

If Ethernet results are unexpectedly low, fix the wired bottleneck before judging the Wi-Fi results.

If 6 GHz Wins Near the Router

A clean, wide 6 GHz channel can perform extremely well at short range. This result would demonstrate the benefit of newer spectrum but would not prove that 6 GHz is best throughout the home.

If 5 GHz Wins at a Moderate Distance

This may indicate that 5 GHz provides a better balance between available bandwidth and signal strength at that location.

If 2.4 GHz Wins Only at the Farthest Location

The lower-frequency band may maintain a usable signal where the higher bands have weakened. It may still provide less throughput and experience more interference.

If MLO Has the Highest Throughput

This may indicate that the router and client are successfully using multiple links to increase available capacity.

Verify that the result is not being limited by the Ethernet server, router port, test computer, or storage device.

If MLO Improves Latency but Not Throughput

MLO may be choosing the least-congested link or avoiding delays without combining enough capacity to produce a dramatic throughput increase.

That can still be a meaningful improvement for gaming, voice calls, remote work, and other real-time applications.

If MLO Shows Little Improvement

Possible explanations include:

• The client supports only a limited MLO mode.
• A single 6 GHz or 5 GHz link is already fast enough.
• The wired server is the bottleneck.
• The internet plan is limiting the test.
• The client or router needs a firmware or driver update.
• MLO is alternating between links instead of aggregating them.
• The test location does not contain enough congestion for MLO to demonstrate an advantage.

A result showing little improvement is still useful. The purpose of the experiment is to measure the network, not to prove that the newest feature must win.

Final Thoughts

Wi-Fi 7 MLO has the potential to improve throughput, latency, and connection reliability by giving compatible equipment access to multiple wireless links. Whether it produces a noticeable benefit depends on the router, client, radio implementation, network congestion, physical environment, and existing bottlenecks.

Ethernet remains the most useful baseline. The 2.4 GHz band emphasizes coverage, 5 GHz usually offers a strong balance, and 6 GHz can provide excellent short-range performance with compatible equipment. MLO adds flexibility, but it should be measured instead of assumed.

A careful local test using the same client, server, locations, settings, and test durations will provide a much more meaningful answer than a single internet speed test.

Advertisements, trackers, malicious websites, and unwanted online services are not limited to computers. Smart televisions, streaming devices, game consoles, phones, tablets, and other connected products may also contact numerous internet domains throughout the day.

A traditional browser extension can help on a computer, but many smart devices do not support browser extensions or security software. Network-wide DNS filtering offers another layer of protection by examining domain-name requests from devices using the network’s DNS server. AdGuard Home is one tool that can provide this type of filtering. However, it is important to understand both what DNS filtering can accomplish and where its protection ends.

What Is DNS?

DNS stands for Domain Name System. It works somewhat like an internet address book. When a device attempts to visit a website or connect to an online service, it usually starts by requesting the numerical IP address associated with a domain name. For example, a device may need DNS to learn where to find example.com.

A DNS filtering service checks the requested domain before returning an answer. If the domain matches an enabled blocking rule, the DNS server can refuse to resolve it. The device is then unable to make its normal connection to that domain.

This process is sometimes called DNS blocking or DNS sinkholing.

What Is AdGuard Home?

AdGuard Home is free, open-source software that runs on a device controlled by the user. It acts as a DNS server and can apply filtering rules to devices across a network. AdGuard describes it as network-wide software for blocking advertising and tracking domains. AdGuard Home overview

It can be installed on supported computers, small servers, and certain other platforms. A router can then be configured to provide the AdGuard Home server’s address to connected devices. According to AdGuard’s setup documentation, configuring DNS at the router can cover devices connected to that router without requiring each device to be configured separately. AdGuard Home getting-started guide

This can be especially useful for smart televisions, speakers, appliances, and other devices that cannot run a conventional content blocker.

What DNS Filtering Can Help Protect Against

Known Advertising and Tracking Domains

Many advertisements, analytics systems, and tracking services use domains that are separate from the website or application providing the desired content.

If one of those domains appears on an enabled blocklist, AdGuard Home can prevent the connection. This may reduce some advertising, tracking, telemetry, and unwanted background traffic.

Results will vary according to the selected filter lists, the devices being used, and the way each service delivers its content.

Known Malware and Phishing Domains

DNS filtering can block requests to domains identified by an enabled security list or protection feature. This can prevent a device from connecting normally to some known malware, phishing, fraud, or command-and-control infrastructure.

The protection is useful because the connection can be stopped before the website or remote service is reached. However, it depends on the malicious domain being recognized by the active rules.

AdGuard Home supports filtering features and customizable blocklists, including options intended to block phishing and malware domains. Official AdGuard Home repository

Devices That Cannot Run Security Extensions

A browser extension only protects the browser in which it is installed. DNS filtering can also affect smart televisions, streaming devices, game consoles, cameras, speakers, appliances, and other equipment using the filtered DNS server.

This does not make those devices secure, but it can reduce their ability to communicate with domains that have been blocked.

Consistent Rules Across a Network

Network-wide filtering provides one central place to manage DNS rules. Instead of configuring a separate blocker on every compatible device, an administrator can maintain a common filtering policy.

Exceptions can also be created when a legitimate service is incorrectly blocked.

Greater Visibility into DNS Activity

AdGuard Home provides statistics and a query log. These features can help an administrator understand which domains devices are requesting, which requests are being blocked, and whether an unexpected device or application is generating unusual DNS activity.

This information can be useful during troubleshooting or a security investigation. It is also sensitive because the requested domains may reveal information about household activity. Query logs should therefore be treated as private security records rather than material for public screenshots.

What DNS Filtering Cannot Protect Against

DNS filtering is one layer of defense. It is not a replacement for antivirus software, software updates, secure passwords, multifactor authentication, backups, firewalls, or safe browsing habits.

Advertisements Delivered from the Same Domain as the Content

A DNS server makes decisions at the domain level. It cannot normally block one part of a domain while allowing another part of the same domain.

For example, if a video and its advertisement come from the same domain, blocking the domain would also block the video. AdGuard’s documentation specifically lists YouTube and Twitch advertisements and sponsored posts on major social platforms as examples that DNS-level blocking may not remove. AdGuard Home FAQ

A browser-based content blocker can inspect page elements and individual web requests in ways that DNS filtering cannot.

Every Malicious Website

A domain may be newly created, previously unknown, or absent from the selected security lists. Attackers can also change domains quickly.

A successful DNS lookup therefore does not prove that a site is safe. Users should still examine links carefully and respond cautiously to login pages, downloads, attachments, and security warnings.

Malware Already Installed on a Device

DNS filtering may prevent some malware from contacting a known malicious domain, but it does not scan files, remove infections, examine running processes, or repair a compromised computer.

Endpoint security tools and a proper malware-investigation process are still required.

Connections Made Directly to IP Addresses

DNS filtering works when a device asks the DNS server to resolve a name. If software connects directly to an IP address, there may be no domain request for the filter to block.

A firewall or other network-security control may be required to restrict direct connections.

Devices That Bypass the Filter

Some applications and devices may use their own DNS provider, encrypted DNS configuration, VPN connection, cellular connection, or hard-coded network settings. Those requests may not pass through the local AdGuard Home server.

AdGuard’s troubleshooting guidance recommends confirming that a device is actually using AdGuard Home and that its requests appear in the query log. AdGuard Home FAQ

Traffic Contents

DNS filtering can see requested domain names, but it does not normally inspect the full contents of encrypted web traffic. It cannot determine whether a particular document, message, video, or file is safe simply because the domain was allowed.

Protection Away from the Network

A home DNS server normally protects devices while they are connected to the network configured to use it. A phone that switches to cellular service or another Wi-Fi network may no longer use the home DNS filter.

Extending DNS filtering outside the home requires additional configuration and introduces new security responsibilities.

A Safe Way to Experiment with AdGuard Home

Changes to DNS can affect the entire network. A careful test should begin with one noncritical device instead of immediately changing the router for every device.

1. Define the Goal

Decide what the experiment is intended to measure. Possible goals include:

• Reducing requests to known advertising and tracking domains.
• Adding protection against known malicious domains.
• Observing the types of DNS requests made by a test device.
• Identifying compatibility problems and false positives.
• Determining whether DNS response performance remains acceptable.

2. Prepare a Recovery Plan

Record the original DNS settings privately before making changes. Know how to restore those settings if websites, applications, or devices stop working.

Keep the AdGuard Home administration interface restricted to trusted systems. AdGuard recommends choosing network interfaces and access settings carefully, particularly if a server might be accessible from outside the local network. AdGuard Home security guidance

3. Begin with One Test Device

Configure only one noncritical computer, phone, or other suitable device to use the AdGuard Home server.

Confirm that normal browsing and DNS resolution still work. Also confirm that the device’s requests appear in the AdGuard Home query log.

4. Establish a Short Baseline

Before enabling additional filtering, observe a limited baseline period. Record only the aggregate measurements needed for comparison.

Examples include:

• Total DNS requests.
• Number or percentage of blocked requests.
• DNS errors.
• Noticeable service failures.
• Approximate DNS response performance.
• Number of legitimate domains that required an exception.

Avoid keeping detailed logs longer than necessary for the experiment.

5. Enable a Conservative Set of Filters

Begin with a small, trusted collection of general and security-focused rules. Adding numerous overlapping lists immediately can increase false positives and make troubleshooting difficult.

Test commonly used websites, streaming services, smart-device applications, software updates, online games, and communication tools.

6. Investigate Problems Carefully

If an application stops working, do not automatically disable all filtering. Review the relevant requests and determine which domain was blocked.

Only allow a domain after understanding why the application needs it. An allowlist should not become a collection of unexplained exceptions.

7. Expand Gradually

If the test device works properly, add another device or a small group. Continue monitoring for unexpected behavior.

Router-wide deployment should occur only after the administrator understands how to restore the original DNS configuration.

Final Thoughts

Network-wide DNS filtering can reduce connections to known advertising, tracking, phishing, and malware-related domains. It can also provide useful visibility into DNS activity from devices that cannot run conventional security software. However, its limitations are equally important. It cannot inspect everything a device downloads, remove malware, block every advertisement, identify every new malicious domain, or protect devices that bypass the filtered DNS server.

AdGuard Home should therefore be treated as one part of a layered security strategy.

Smart devices have become a normal part of many home networks. Televisions, streaming devices, speakers, cameras, doorbells, thermostats, lights, appliances, and game systems may all connect to the same router as personal computers and phones.

Although these devices are convenient, they do not always receive the same level of security support as a modern computer, which can create a security risk. One way to reduce the risk is to place smart devices on a separate guest or Internet of Things network.

This practice is called network segmentation.

What Is Network Segmentation?

Network segmentation means dividing one network into smaller groups. Instead of allowing every device to communicate freely with every other device, devices are separated according to their purpose and level of trust.

A simple home network might contain:

• A main network for trusted computers and phones.
• An IoT network for smart televisions, speakers, cameras, and appliances.
• A guest network for visitors’ devices.

Each group may still be able to access the internet, but access between the groups can be restricted, reducing the number of systems an attacker can reach if one of them is compromised.

Why Are Smart Devices a Concern?

Smart devices are not automatically dangerous, but they can introduce risks that are easy to overlook.

Limited Security Updates

Some manufacturers provide security updates for years, while others stop supporting products relatively quickly. A device may continue working long after it stops receiving security patches.

It may also be difficult to determine whether a smart television, camera, or appliance is running its latest software.

Weak or Unclear Security Controls

Some devices provide few security settings. They may use default services, unnecessary network features, weak authentication, or cloud accounts that are not protected with multifactor authentication.

Unlike a computer, a smart device may not support antivirus software, local monitoring tools, or detailed security logs.

Constant Internet Access

Many smart devices communicate regularly with cloud services. This may be necessary for remote control, notifications, updates, or voice-assistant features.

However, users may not have much visibility into what information is being sent, how often the device connects, or which external services it contacts.

Risk of Lateral Movement

Lateral movement occurs when an attacker compromises one device and then attempts to reach other devices on the same network.

For example, a vulnerable smart device connected to the main network might be able to communicate with computers, printers, shared storage, or other sensitive equipment.

Separating smart devices limits the number of valuable systems they can reach.

What Is an IoT Network?

IoT stands for Internet of Things. An IoT network is a separate network intended for smart and connected devices.

Some home routers provide a dedicated IoT network option. Others provide a guest network that can serve a similar purpose. Advanced networks may use virtual local area networks, commonly called VLANs.

For many households, a properly isolated guest or IoT network is the simplest place to begin.

The important word is “isolated.” Creating a second Wi-Fi name does not guarantee that the devices are separated. The router must also restrict communication between the IoT network and the trusted main network.

Look for settings with names such as:

• Block access to the local network.
• Isolate guest devices.
• Allow internet access only.
• Prevent access to the LAN.
• Client isolation.
• AP isolation.

The exact names and behavior vary between routers.

Segmentation Versus Device Isolation

Segmentation and device isolation are related, but they are not identical.

Segmentation separates groups of devices. A smart device on the IoT network may be prevented from reaching a computer on the main network.

Device or client isolation prevents devices within the same network from communicating directly with one another. For example, two devices connected to the guest network may both have internet access but may not be able to communicate with each other.

Client isolation can provide additional protection, but it may also interfere with legitimate functions. Smart-home hubs, wireless speakers, printers, casting devices, and local controllers may need to communicate with other devices.

For this reason, isolation should be enabled carefully and tested rather than assumed to work with every smart-home product.

Which Devices Belong on the IoT Network?

Possible candidates include:

• Smart televisions.
• Streaming devices.
• Smart speakers.
• Cameras and video doorbells.
• Smart lights and switches.
• Thermostats.
• Connected appliances.
• Robot vacuums.
• Smart-home hubs.
• Game consoles.
• Other devices that primarily require internet access.

Trusted computers and phones normally remain on the main network. These devices may contain personal documents, saved sessions, financial information, browser data, and other sensitive material.

A phone used to manage smart devices can often remain on the main network, but this depends on the router and the way the smart devices are controlled.

Plan Before Changing the Network

Before creating a new network, make a private inventory of the existing devices. Record the device type, owner, connection method, and expected purpose.

Also determine how each smart device is controlled:

• Does it communicate entirely through a cloud service?
• Does a phone need to discover it locally?
• Does it require a smart-home hub?
• Does it depend on casting or screen sharing?
• Does it need to communicate with a printer or storage device?
• Does it only support 2.4 GHz Wi-Fi?
• Is it connected through Ethernet instead of Wi-Fi?

This information helps predict which features might stop working after segmentation.

It is also wise to save a router configuration backup, record the current settings privately, and make changes while physically connected to the home network. Avoid experimenting when remote access is the only way to reach the router.

A General Setup Process

Router interfaces differ, but the basic process is usually similar.

1. Create a Separate Network

Open the router’s administration panel and look for Guest Network, IoT Network, or a similar option.

Create a separate Wi-Fi name that does not reveal the owner’s name, address, router model, or other personal information.

2. Use a Unique Password

Protect the new network with a strong password that is different from the main Wi-Fi password.

Use WPA2 or WPA3 security when supported. Some older smart devices may not support newer WPA3-only configurations, so compatibility should be tested.

3. Restrict Access to the Main Network

Disable the IoT or guest network’s access to the main local network when the router provides this option.

The goal is to allow smart devices to reach the internet without giving them unrestricted access to trusted computers and other private systems.

4. Move One Device at a Time

Do not move every smart device at once. Start with one noncritical device, connect it to the new network, and test it.

Confirm that it can:

• Connect to the internet.
• Receive updates.
• Communicate with its official application.
• Perform its normal functions.
• Recover properly after a restart.

Moving devices individually makes troubleshooting much easier.

5. Test Local Features

Check any features that depend on local communication, including casting, printing, media sharing, smart-home hubs, speakers, and local device discovery.

If a feature stops working, determine whether the router supports a controlled method of allowing the required traffic between networks. Avoid disabling all isolation simply to solve one compatibility problem.

6. Document the Result

Update the private device inventory after each device is moved. Record the network group, test results, problems encountered, and any exceptions that were required.

Do not publish real Wi-Fi names, passwords, IP addresses, MAC addresses, device names, or screenshots containing private network details.

What Segmentation Cannot Do

Network segmentation is an important protective control, but it is not a complete security solution.

It does not replace:

• Router and device updates.
• Strong, unique account passwords.
• Multifactor authentication.
• Secure router administration.
• Removal of unused devices.
• Review of cloud-account permissions.
• Backups of important information.
• Monitoring for unexpected network activity.

Segmentation also cannot prevent every compromised device from communicating with a malicious service on the internet. Its primary purpose is to limit what that device can reach inside the home network.

Maintaining the IoT Network

Review the IoT network regularly.

A useful schedule is:

• Monthly: Check for unfamiliar connected devices.
• Quarterly: Review the complete inventory and verify that expected devices are still present.
• After purchasing a device: Decide which network it should use before connecting it.
• After unusual activity: Review connected clients, update passwords if necessary, and investigate unexpected changes.
• When retiring a device: Remove it from the inventory and delete its associated account or cloud access when possible.

Final Thoughts

Separating smart devices from trusted computers is a practical example of defense in depth. If one smart device becomes vulnerable, segmentation can reduce its ability to reach more valuable systems.

The safest approach is to begin with a private inventory, understand how the devices communicate, create an isolated network, and move devices one at a time. Careful testing is essential because some smart-home features rely on local communication.

A separate IoT network does not eliminate every risk, but it creates an important boundary between less-trusted equipment and the devices that contain the household’s most sensitive information.

A typical home network may include computers, phones, televisions, game consoles, printers, tablets, security cameras, smart speakers, and other connected equipment. Because many of these devices operate quietly in the background, it is easy to lose track of what is connected.

A private device inventory provides a clear record of the equipment that belongs on the network. It also establishes a baseline that makes unexpected devices and changes easier to recognize.

Why Create a Device Inventory?

Asset inventory is an important part of cybersecurity. An organization cannot properly protect its systems without knowing which devices it owns and manages. The same principle applies to a home network.

A device inventory can help you:

• Discover forgotten or unused equipment.
• Recognize devices that do not belong.
• Troubleshoot connection problems.
• Identify equipment that needs updates.
• Track who owns each device.
• Record whether devices use wired or wireless connections.
• Notice important network changes over time.

An unfamiliar router entry does not automatically mean that someone has compromised the network. It could be a family member’s phone, a television, an old tablet, a guest device, or equipment using a private MAC address. However, each unfamiliar entry should be investigated.

Step 1: Open the Router’s Client List

Connect to the home network and sign in to the router’s administration panel. Look for a page called “Clients,” “Connected Devices,” “Device List,” or something similar.

Depending on the router, this page may show:

• Device name or hostname
• Internal IP address
• MAC address
• Wired or wireless connection
• Wi-Fi band
• Online or offline status
• Current activity or traffic totals
• Reserved-address status
• Block status

Step 2: Build a Private Spreadsheet

Create one row for every router entry. Give each device a simple asset number, such as D-001 or D-002. This makes it possible to track a device even if its name, address, or connection changes.

Useful inventory fields include:

• Asset number
• Friendly device name
• Device type
• Owner
• Manufacturer and model
• Connection method
• Hostname
• Internal IP address
• MAC address
• Randomized MAC status
• Expected use
• Verification status
• First-seen date
• Last-verified date
• Notes

Never store router passwords, Wi-Fi passwords, recovery codes, or other login credentials in the inventory.

Step 3: Identify Devices Individually

Some devices may already have recognizable names. Others may appear as “Unknown.”

A simple identification method is to disconnect one known device from Wi-Fi and refresh the router’s client list. One entry should change from online to offline. Reconnect the device and verify that the same entry returns.

Only test one device at a time. Disconnecting several devices simultaneously can make the results confusing.

Another method is to compare the address in the router with the Wi-Fi or network address displayed in the device’s settings. Phones, computers, streaming devices, and game consoles usually provide network information somewhere in their settings menus.

Once an entry has been matched with a physical device, assign it a clear private name and mark it as verified.

Understanding Randomized MAC Addresses

A MAC address identifies a device’s network connection. Traditionally, devices used the same hardware address on every network. This could allow Wi-Fi operators to recognize and track a device across different locations. Modern phones, tablets, and computers often use a private or randomized MAC address to reduce this type of tracking. The router may therefore display an address that differs from the device’s permanent hardware address. A randomized MAC address is not evidence of malware or unauthorized access. It is normally a privacy feature.

Some private addresses remain consistent on a particular home network, while others may change. When an address changes, the router might display the new address as a new device while retaining the old one as an offline client.

Record whether each verified device uses a private address. This information can prevent unnecessary concern during future reviews.

Step 4: Document Changes and Decisions

Do not simply replace old information without recording what changed. Maintain a basic audit log containing:

• Date of the observation.
• Asset number.
• Original status.
• New status.
• Investigation performed.
• Action taken.
• Result.
• Required follow-up.

For example, an entry might begin as “Unknown,” move to “Investigating,” and finally become “Verified” after a disconnect-and-reconnect test.

This history explains how each conclusion was reached and provides useful practice in security documentation.

Step 5: Handle Unidentified Devices Carefully

An unidentified device should be investigated, but it should not automatically be labeled as an attacker.

First, check common explanations:

• A family member’s device.
• A visitor’s phone or tablet.
• A television or streaming device.
• A printer or smart-home product.
• An older device that is no longer used.
• A previous randomized address belonging to a known device.

If an entry remains unexplained, it can be blocked as a precaution. Record the action and continue monitoring the network. Blocking one MAC address is only a containment measure. It does not prove that the device was malicious, and a device using address randomization may later appear under a different address.

If unfamiliar devices repeatedly appear, consider stronger protective measures:

• Change the Wi-Fi password.
• Use WPA2 or WPA3 security.
• Disable WPS.
• Update the router’s firmware.
• Reconnect only approved devices.
• Review the router’s administrative-access settings.

Step 6: Preserve Dated Snapshots

Save periodic observations containing the connection state, addresses, traffic information, and block status of each client. Over time, these snapshots can reveal new devices, changed addresses, and other differences that may deserve investigation.

How Often Should the Inventory Be Reviewed?

Use a combination of scheduled and event-driven reviews:

• Weekly: Check the number of connected devices and investigate unexpected additions.
• Quarterly: Review the complete inventory, verify existing devices, and retire old entries.
• Event-driven: Perform a review after a router reset, Wi-Fi password change, new device purchase, suspected compromise, or unusual network activity.

Final Thoughts

A private device inventory turns a router’s client list into a useful security resource. It establishes what is normal, documents changes, supports troubleshooting, and helps identify equipment that may require attention.

The goal is not to treat every unfamiliar entry as an attack. Effective security depends on observation, verification, documentation, and proportionate action. By following this process regularly, anyone can gain a clearer understanding of the devices using their home network while developing practical cybersecurity skills.

Many modern routers advertise built-in VPN capabilities, which can be confusing because it may sound as though the router includes free access to VPN servers around the world. The router usually includes the software needed to create a VPN connection, but the connection must still lead somewhere. Understanding the difference can help you avoid purchasing the wrong service or accidentally changing the Internet connection for every device in your home.

What is a VPN?

A virtual private network, or VPN, creates an encrypted connection between your device and a VPN server. Websites normally see the VPN server’s public Internet address and general location instead of the address assigned to your home connection.

There are three important terms to understand:

• A VPN client is the software that connects to a VPN server.
• A VPN server is the destination at the other end of the encrypted connection.
• A VPN provider operates servers in different cities and countries.

A compatible router can act as the VPN client for televisions, streaming devices, computers, and other equipment connected to it.

Is the VPN really built into the router?

The VPN client software may be built into the router, but access to commercial VPN servers usually is not. Think of it like buying a television with a streaming application already installed. The application is available, but you still need an account and subscription to watch the service.

For instance, a GL.iNet router can connect using protocols such as WireGuard and OpenVPN. Its VPN Dashboard can also create rules that send only selected devices through a VPN tunnel. GL.iNet’s VPN Dashboard documentation explains the available routing and kill-switch options.

Do you need to buy or sign up for anything?

In most cases, you need an account with a VPN provider. The provider supplies the server and the configuration information that the router uses to connect. You may not need a new subscription if you already have a VPN service that provides WireGuard or OpenVPN router configuration files.

Another option is operating your own VPN server. However, your apparent location will be wherever that server is located. Running a VPN server on your home router is useful for securely connecting back to your home, but it will not make your connection appear to come from another country.

You also still need a legitimate subscription to the streaming service you want to watch.

Can a VPN make you appear to be in America?

A VPN server located in the United States can make websites see a U.S. Internet address. If you are outside the United States, this may make your connection appear American. If you are already in America, connecting to another American server may change your apparent city or state, but it normally will not change your country’s streaming catalog.

To appear to be in another country, you need a VPN server located in that country.

Will a VPN unlock more movies?

It might change what a streaming service displays, but there is no guarantee. Streaming catalogs are affected by licensing agreements, account settings, and service policies. Streaming companies can also recognize and restrict VPN servers.

Netflix, for example, says that viewers using a VPN may only be shown titles for which it has worldwide licensing. It also says VPN connections are not supported for live events or ad-supported experiences. Netflix’s VPN guidance explains these limitations.

Are American VPN servers free?

Some VPN providers offer free plans with U.S. servers, but free access usually has limitations. These may include:

• Reduced speed
• Limited data
• Fewer server locations
• Automatic server selection
• No router configuration files
• Limited or unavailable streaming support
• Advertising or additional tracking

A free VPN is not automatically unsafe, but you should understand how the company pays for its servers and what information it collects.

For example, Proton offers a free VPN plan, but its free service automatically selects from available locations, while its streaming features are listed with the paid plan. See Proton VPN pricing for current details.

The VPN software built into a router does not normally include free access to American servers.

How much does a VPN subscription cost?

Prices change frequently. A paid VPN commonly costs approximately:

• $5 to $15 per month for a month-to-month subscription
• $3 to $6 per month when purchasing a longer introductory plan
• $70 to $120 upfront for many one- or two-year promotions

Be careful with advertisements that display a low monthly price. That price may require paying for the entire subscription in advance. Renewal prices may also be much higher than the introductory offer.

Should every home device use the VPN?

Usually not. Routing every device through a VPN can affect banking sites, gaming, video calls, smart-home equipment, and services that rely on your normal location. It can also make troubleshooting more difficult. A safer approach is to route only one streaming device through the VPN. Everything else can continue using the normal Internet connection.

On a compatible router, a device-based policy can be designed like this:

• The selected streaming device uses the VPN.
• All other devices use the regular Internet connection.
• A tunnel kill switch blocks the selected device if the VPN fails.
• Other devices remain online if the VPN disconnects.

This provides a controlled way to use the feature without disrupting the entire household.

Final thoughts

A router with built-in VPN support provides the tools needed to manage encrypted connections and decide which devices use them. It does not normally include free access to servers around the world. A VPN also does not guarantee access to another catalog and does not override a streaming service’s rules, nor does it automatically provide anonymity, prevent malware, or make every online activity private.

Most people test their Internet connection only when something feels wrong. A video begins buffering, a game becomes unresponsive, or a work call starts breaking up. Although speed tests are useful when troubleshooting a problem, they are even more valuable when performed regularly.

Regular testing creates a baseline—a record of how your connection normally performs. Once you know what “normal” looks like, it becomes much easier to recognize unusual changes.

What an Internet test measures

A useful Internet connection test may include several measurements:

• Download speed measures how quickly information travels from the Internet to your device. It affects streaming, browsing, software downloads, and cloud services.
• Upload speed measures how quickly your device can send information. It is important for video calls, cloud backups, file sharing, and livestreaming.
• Latency measures how long it takes information to travel to a destination and return. Lower latency usually means a more responsive connection.
• Jitter measures changes in latency. High jitter can cause choppy calls, delayed audio, or inconsistent gaming performance.
• Packet or request loss indicates that some communications did not complete successfully. Repeated loss may point to Wi-Fi interference, congestion, damaged equipment, or a service-provider problem.

A single test is only a snapshot. Network performance changes throughout the day as household activity, Wi-Fi conditions, and Internet-provider congestion change.

Why establish a baseline?

A baseline helps answer important troubleshooting questions. Is the connection always slow, or only during certain hours? Is the problem limited to Wi-Fi? Did performance change after replacing equipment or installing an update? Is the issue temporary or part of a repeating pattern?

Internet testing can also support a basic security review. An unexplained increase in network activity or a sudden performance change may justify checking connected devices, software updates, router logs, and running security scans.

However, poor performance by itself is not proof of malware or an attack. Congestion, weak Wi-Fi, background updates, cloud backups, and service outages are much more common explanations.

How to test your connection

Choose a reputable browser-based testing service and use the same service for each test. Different services use different servers and measurement methods, so their results may not be directly comparable.

For the most consistent results:

1. Test from the same computer and location.
2. Use a wired Ethernet connection when possible.
3. If testing Wi-Fi, record that fact and remain in the same location.
4. Avoid large downloads, streaming, backups, or software updates during the test.
5. Record the date, general time of day, connection type, download speed, upload speed, latency, and jitter.
6. Repeat the test at different times, such as morning, afternoon, and evening.
7. Continue for several days before drawing conclusions.

For long-term monitoring, testing every four to six hours is usually more useful than running many tests within a few minutes. Frequent full tests can consume a significant amount of data, which matters if your Internet plan has a data limit.

How to interpret the results

Look for patterns rather than focusing on the highest number. Compare wired and wireless results, different times of day, and periods with and without heavy household use.

If repeated tests show a problem, check the local network first. Restarting equipment may temporarily clear an issue, but document the symptoms before making changes. Check cables, Wi-Fi signal strength, connected devices, background applications, equipment updates, and service-provider outage notices.

Internet testing cannot diagnose every network or security problem. What it can do is provide evidence. A carefully collected baseline turns “the Internet seems slow” into measurable information that can support troubleshooting, security reviews, and conversations with an Internet service provider.