How to Check Router Logs for Suspicious Activity
Router logs can reveal failed logins, strange connections, DNS abuse, and other early warning signs of a network compromise.
If you know what to look for, they can help you spot problems before they spread across your devices.
This guide explains how to access router logs, identify suspicious entries, and separate normal network noise from real security threats.
Why router logs matter for home and small office security
A router is the gateway between your local network and the internet, so it often records events that never appear on individual devices.
These records can help you detect brute-force login attempts, repeated connection failures, unexpected reboots, firewall blocks, and traffic to unfamiliar destinations.
Many routers from manufacturers such as Netgear, ASUS, TP-Link, Linksys, D-Link, and Ubiquiti keep system logs, security logs, DHCP logs, and administrative logs.
Even if the interface is basic, those logs can still reveal patterns that point to misuse or compromise.
- Repeated admin login failures
- Unexpected remote management access
- New devices joining at odd times
- DNS requests to suspicious domains
- Frequent firewall denies from unknown sources
- Sudden configuration changes
How to access router logs?
Most routers provide log access through a web administration panel.
Open a browser, enter the router IP address, and sign in with the administrator credentials.
Common gateway addresses include 192.168.0.1, 192.168.1.1, and 10.0.0.1, though your device may use a different address.
Once logged in, look for sections labeled System Log, Event Log, Security Log, Administration, or Advanced Settings.
On business-class or open-source platforms such as pfSense, OpenWrt, or Ubiquiti UniFi, logs may be more detailed and easier to filter.
If the interface does not show much history, check whether the router supports remote syslog forwarding.
Sending logs to a dedicated syslog server or SIEM platform such as Splunk, Graylog, or Elasticsearch makes it easier to preserve records before they roll over.
What suspicious router log entries look like
Normal router logs often include DHCP leases, periodic internet status updates, and routine connection events.
Suspicious activity usually stands out because it repeats, arrives at strange times, or references unknown IP addresses and services.
1. Repeated failed admin logins
Multiple failed attempts to access the router admin panel may indicate password guessing or automated attack traffic.
This is especially concerning if the source IP is external, if the attempts happen rapidly, or if they continue after you change the password.
2. Remote management enabled without permission
If the log shows that remote administration, WAN access, or management from the internet was turned on unexpectedly, treat it seriously.
Attackers who gain access to the router often try to keep a foothold by enabling remote control features.
3. DNS changes or unusual DNS queries
Logs that show DNS configuration changes, queries to unfamiliar resolvers, or repeated lookups to suspicious domains can point to malicious redirection.
This may indicate phishing, adware, or more serious forms of malware trying to manipulate traffic.
4. Unknown devices joining the network
Review DHCP logs and client lists for unfamiliar hostnames, MAC addresses, or device names.
A new device may be legitimate, but if it appears at an odd hour or uses random-looking identifiers, it deserves closer inspection.
5. Frequent firewall blocks
Firewall entries are useful because they show traffic the router rejected.
Repeated denies from the same IP range, especially involving ports associated with remote access, file sharing, or malware command-and-control, can indicate scanning or probing.
6. Unexpected reboots or configuration resets
Router reboots, factory resets, or configuration changes that you did not initiate can be signs of tampering, instability, or attempted exploitation.
Compare log timestamps with your own activity and power events.
How to distinguish normal activity from threats
Not every strange-looking entry means an attack.
Internet service provider maintenance, firmware updates, device reconnects, and smart home devices can all generate noisy logs.
The key is to look for repetition, timing, and context.
- Match events against known device behavior
- Check whether activity started after a firmware update or outage
- Look for patterns across several log categories, not just one entry
- Compare internal IP addresses with your device inventory
- Focus on events that repeat or escalate over time
For example, one failed login from your own phone may be harmless, but dozens of failures from an external address are not.
Likewise, a single blocked connection to a cloud service may be normal, while constant DNS lookups to an unknown domain are more concerning.
Step-by-step method to review router logs
Use a structured process so you do not miss important details.
A quick scan is useful, but a methodical review gives you better evidence if you need to troubleshoot or escalate the issue.
- Save the current logs. Export them or copy the entries before they roll over.
- Check the time range. Identify when the suspicious behavior began and whether it aligns with a change in network use.
- Review admin and security events. Focus on login attempts, privilege changes, and remote access settings.
- Inspect DHCP and client lists. Confirm that every active device is known and expected.
- Examine firewall and WAN logs. Look for repeated inbound scans or unusual outbound traffic.
- Compare with firmware and system updates. Some events are triggered by normal maintenance, not attacks.
What to do if you find suspicious activity
If the logs show clear signs of compromise, act quickly.
Start by changing the router administrator password to a long, unique value and enabling multi-factor authentication if the platform supports it.
Then review the Wi-Fi password, remote management settings, DNS configuration, and connected devices.
If you suspect malware or unauthorized access, update the router firmware from the vendor’s official site or admin panel.
Disable features you do not use, such as WPS, UPnP, and remote admin access, especially if they are not required for your environment.
- Reboot the router after saving a copy of the logs
- Disconnect unfamiliar devices
- Reset the router if compromise is confirmed
- Reconfigure the network with strong credentials
- Check endpoint security on laptops, phones, and IoT devices
If the router is managed by an internet service provider or business IT team, contact them with the log timestamps, source addresses, and affected settings.
Detailed timestamps make troubleshooting faster and help separate attacks from misconfiguration.
Best practices for ongoing router log monitoring
Router logs are most useful when you review them regularly rather than only after a problem appears.
Monthly checks are a good baseline for home users, while small businesses may benefit from weekly reviews or automated alerts.
To make log review easier, keep firmware updated, back up router settings, and document your normal device list.
If your router supports syslog, NetFlow, or SNMP, consider enabling those features so you can see longer-term trends and more precise activity data.
- Use a strong admin password and unique Wi-Fi credentials
- Turn off unused services such as UPnP or Telnet
- Keep firmware current on routers, access points, and mesh systems
- Store logs externally when possible
- Review logs after outages, password changes, and new device setups
Learning how to check router logs for suspicious activity gives you a direct view into the health of your network.
Once you know which entries matter, the router becomes a practical security sensor instead of just a gateway device.