Is there a possible intrusion into the home network?
Is there a possible intrusion into the home network?
I came home and saw that my modem's internet light was flashing quickly and the WLAN light was blinking irregularly. None of my devices were connected at that time, and there were no appliances nearby to connect to, nor anyone else in the house. Could this indicate someone is using my Wi-Fi? I can't log in because I forgot the password.
Many modems include a small opening that lets you restart the device locally and set a new password. Wi-Fi remains highly vulnerable even when configured securely, making your point reasonable. Other factors could also be at play, like unexpected traffic appearing due to things such as DHCP lease expirations and changes.
What model of modem and which particular light did it display? They generally come with several indicators, such as a "link" light, "uplink," "downlink," and "data transfer" signals. It might also have shown other lights if someone was sending traffic through the router without proper filtering. If the LAN or Wi-Fi lights weren't flashing simultaneously, it suggests no network activity was occurring inside your system.
It might be a random DDoS attempt or an exploitation of a known vulnerability through connection requests—such as a buffer overflow that could trick the device into accepting an external login to access the router’s admin panel, allowing upload of malicious firmware.
The manual is available and page 7 contains LED details, though they don’t clearly specify the model or exact physical positioning of the lights.
The WLAN light flickering irregularly may simply reflect normal operation of the access point, handling signals or beacons without forming a real data link, or it could be performing a channel scan. I’m unsure if this behavior changes when a mobile device attempts connection without a password, such as blinking in response.
The Internet light indicates ongoing DSL authentication, which might appear as a slow or rapid blink and could suggest either legitimate traffic or a firmware update attempt. This light may also signal actual data flow, possibly from an external source or a router trying to apply updates.
I have no knowledge of your specific device, so this behavior would likely be unique to you. Additionally, the light can reflect real network activity, meaning it could point to malicious traffic from the Internet or a system attempting a firmware upgrade.
Since you couldn’t access the device to review connected devices, troubleshooting remains challenging.
As @USAFRet advised, reset the unit and set a strong password for the management interface plus a new wireless SSID. Press the reset button for 6 to 20 seconds; longer durations trigger a deeper reset. You might need to reach out to your ISP to reconfigure the DSL connection unless you received setup details. The default login credentials are admin/admin.
For extra caution, consider logging in regularly and checking system logs for any signs of device association or unauthorized management access. Even if someone succeeded in cracking your Wi-Fi password, simply changing the password and SSID each time helps, and you could opt for a hidden SSID to further obscure it.
Thanks for the clear response, I used Nirsoft's Netwatcher program which is very user-friendly. I didn't detect any other devices, though it only scanned up to 254. So I'm proceeding as suggested earlier and resetting the modem just in case, perhaps someone is hiding their devices from network scanners.