Documentation menu
Local network changes
NetworkTuna learns which devices use your local network from what this PC sees on it. It tells you when a new device appears, and it looks for patterns that can mean someone is redirecting traffic on the network, as ARP spoofing tools do.
The events appear on the Security Events page.
Events
| Event | Level | What it means |
|---|---|---|
| New device on network | Info | A device joined your local network for the first time. |
| Gateway MAC changed | Notice | The hardware (MAC) address behind your router's IP address changed. See Router monitoring. |
| IP address conflict | Warning, or High when it is your router's address | Two hardware addresses were confirmed for the same IP address within a short time. |
| One device claims many IPs | Warning, or High when one of the addresses is your router's | One hardware address was confirmed for at least four IPv4 addresses within 10 minutes. |
| Unexpected router appeared | Warning | A device began to present itself as a router, but it is not your known router. |
When you install NetworkTuna, it first records the devices that are already on the network, so they are not reported as new.
New devices
A New device on network event shows the device's IP address and hardware (MAC) address. Phones and laptops often use a different random hardware address for each network, and sometimes change it. The same phone can then appear as a new device again.
If you do not recognize a device, find it in your router's list of connected devices or on the Devices page in NetworkTuna.
Signs of ARP spoofing
Devices on a local network find each other through their hardware addresses. A device that answers for addresses that are not its own can put itself between other devices and the router and read their traffic. This is called ARP spoofing, or neighbor spoofing on IPv6 networks. NetworkTuna looks for its traces:
- IP address conflict: two devices claim the same IP address within a short time. NetworkTuna waits for confirmed observations of both devices, so an ordinary change, where one device leaves and the router gives its address to another, is not reported.
- One device claims many IPs: one hardware address answers for many IPv4 addresses. Spoofing tools do this to intercept several devices at once.
- Unexpected router appeared: a device that is not your router starts to present itself as one. Devices on the network may then send their traffic through it.
These events are rare on a home network. When one involves your router's address, NetworkTuna reports it as High.
Some ordinary equipment can cause the same patterns. A Wi-Fi range extender can answer for the devices connected through it, which looks like one device with many IPs. Two devices set up with the same fixed IP address cause an address conflict. Open the event to see the hardware addresses involved, and compare them with the devices you know.