Someone Was Watching My Internet Traffic — Here's How I Found Out
A friend of mine runs a small café. Last year, she noticed something odd: customers kept complaining that their bank apps weren't working on her Wi-Fi, but worked fine on mobile data the moment they stepped outside. She assumed it was a router glitch. It wasn't. Someone had set up a rogue hotspot with the same name as her café network and was sitting two tables away, intercepting traffic.
She had no idea for three weeks.
That story isn't rare. It happens in hotels, airports, libraries, and yes, home networks too. The problem is that spying on an internet connection leaves almost no obvious fingerprints — which is exactly why most people never notice it.
Your Router Is the Front Door Nobody Watches
Before checking anything else, log into your router. Type 192.168.1.1 or 192.168.0.1 into your browser address bar — one of those will open your router's admin page (the password is usually on a sticker on the device itself). Once in, look for a section called "Connected Devices" or "DHCP Clients."
You're looking for strangers.
Every device on your network shows up here — your phone, laptop, smart TV, everything. If you see a device you don't recognize, especially one with a generic name like "Unknown" or a string of random letters, that's worth investigating. Write down the MAC address (the unique hardware ID listed next to each device) and run it through a lookup tool like macvendors.com to see what manufacturer made the device. A "Raspberry Pi Foundation" device you never bought is a serious red flag.
The Speed Test Trick Nobody Mentions
Here's something counterintuitive: your internet feeling slower than usual at odd hours — specifically late at night when you're barely using it — can be a symptom of someone leeching your connection or running traffic through your network.
Run a speed test at fast.com at 11am on a Tuesday. Then run it again at 2am on a Friday. If the 2am result is dramatically lower, and no one in your house is streaming anything, that asymmetry deserves attention.
This isn't definitive proof of spying. But surveillance tools and data exfiltration often run on schedules — automated, quiet, designed to avoid peak hours. The speed drop is the shadow they leave behind.
What "Man-in-the-Middle" Actually Looks Like
The attack my friend's customers experienced has a name: a man-in-the-middle attack. Someone positions themselves between you and the internet, reading everything that passes through. According to the Electronic Frontier Foundation, unencrypted connections — anything that starts with http:// rather than https:// — hand your data to an interceptor on a silver platter.
Check the address bar right now on any site you're using. No padlock icon, or a warning that the connection isn't private? Treat everything you type there as potentially visible to a third party.
The subtler version of this attack happens on networks you trust. Someone on the same Wi-Fi as you can use freely available tools to redirect your traffic through their device without you noticing anything except, occasionally, a slightly slower connection. Your browser won't warn you. Your antivirus won't catch it.
Check What's Actually Leaving Your Computer
Passive surveillance sometimes runs on your device rather than between your device and the internet. A monitoring program quietly installed — through a sketchy download, a phishing email attachment, or physical access to your machine — can send your activity outward continuously.
On Windows, open Command Prompt and type netstat -ano. On Mac, open Terminal and type netstat -an. What you'll see is a live list of every active network connection your computer is making right now. It looks intimidating, but you're scanning for connections on port 4444, 1337, or other non-standard ports connecting to unfamiliar IP addresses.
According to CISA (the Cybersecurity and Infrastructure Security Agency), remote access trojans — software designed specifically to spy on users — frequently communicate on unusual port numbers as a way to avoid detection by standard security software. If you see connections you can't explain, paste the IP address into abuseipdb.com and check whether it's been flagged.
The VPN Misconception
A lot of people hear "use a VPN" and think they've solved the problem. Here's the uncomfortable truth: a VPN protects your traffic from your internet service provider and from anyone watching the network you're on — but it does nothing if the surveillance is already on your device. If someone installed monitoring software on your laptop before you turned on your VPN, the VPN is irrelevant. The spy is already inside.
VPNs are useful and worth using, but they're a layer of protection against network-level snooping, not a cure-all. Treating them as a complete solution is the kind of false confidence that makes the actual problem worse.
The Browser History You Didn't Delete
Your internet service provider sees every domain you visit — not the specific pages, but the destinations. According to the Electronic Frontier Foundation's Surveillance Self-Defense guide, ISPs in many countries are legally permitted to log and sell this browsing data. In the US, that's been legal since 2017. This isn't a hacker spying on you — it's your internet provider doing it openly, with no warning.
The fix here is DNS-over-HTTPS, which encrypts your domain lookups so your ISP can't read them. You can enable it in Firefox under Settings → Privacy & Security → Enable DNS over HTTPS. It takes forty seconds and most people have never heard of it.
One Honest Caveat
Everything above gives you signals to look for — not certainties. A strange device on your network might be your neighbor's phone that accidentally connected years ago. Slow speeds at 2am might just be your ISP throttling. netstat output looks alarming to almost everyone the first time they see it, and most of it is harmless.
The hard truth is that a sophisticated, targeted surveillance operation — state-level, professional — is genuinely difficult to detect without specialized tools and training. If you have specific reason to believe you're being targeted at that level, consumer-grade detection methods aren't enough. You'd need professional help. For everyone else, the steps above catch the vast majority of real-world threats you're likely to actually face.
Sources:
- Electronic Frontier Foundation
- EFF Surveillance Self-Defense
- CISA Cyber Threats and Advisories