First of all, there’s probably no reason to worry about this! There are a number of normal things happening in the background on your home network, out across the internet at large, and between your cable modem and your ISP that make it look like there’s a ton of traffic even if all of your computers and equipment are turned off.
We’re assuming the lights you’re concerned with are the send/receive or “traffic” lights—not the power, uplink, or PC connection lights. Power should be on if the device is plugged in, uplink should be on and steady if you have a connection to your ISP, and the PC connection light should be on whenever there’s an ethernet cable to a computer or router. Remember, the send/receive light on your cable modem or router is just an indicator of activity—not how much. Here’s what’s probably going on:
Your ISP Is Checking That Your IP Address Is In Use
Even if all of your equipment is turned off and unplugged from your cable modem or router, you’ll still see some traffic coming from your ISP. Most frequently, your ISP is sending your cable modem ARP requests, or attempting to see if the IP address they’ve assigned to you via DHCP is still in use. If it is, they won’t touch it. If they detect your cable modem offline, they’ll assign it to their block of available addresses to give out to users coming online who need IPs. How frequently that process takes place varies from ISP to ISP, but most large service providers do this automatically, and do it very frequently. Photo by shaymus22.
Your ISP is Checking That Your Connection Is Healthy
Another reason those lights are flashing all the time is that your ISP may be checking to see if your connection is healthy—regularly scanning online modems and gateways to make sure everything is alive and running properly. ISPs do this a bit less frequently than scanning for available IP addresses to retrieve, but it happens, and it’s another reason why you may see some traffic even if all of your computers or routers are turned off. Again, it’s just another way ISPs keep an eye on the health of their networks.
You’re Being Port-Scanned by Botnets and Other Would-Be Intruders (But Don’t Worry!)
Don’t panic, but a large portion of the traffic you’re seeing, even when your computers are turned off and your router is disconnected, is probably your IP address and network being blindly port-scanned by botnets or other potential attackers who are looking for systems with known vulnerabilities they can easily exploit. Seriously: This has been true for years, and there are only more would-be attackers around now than there used to be.
That said, when we say don’t panic, we mean it: if the first thing you do when you put a new computer on the internet is download the latest updates for it, you’re usually in good shape. Even better shape when you’re behind a computer with a firewall running (even the built-in Windows firewall is good enough. Here’s how to use it.) and a router that has a firewall built-in (or more accurately, does Network Address Tranlation, like almost all consumer routers do.) As long as your computer is up to date and you’re safely behind a router or firewall, those random, sweeping port scans are nothing for you to worry about or lose any sleep over. However, they do represent traffic coming across the internet at all times—don’t stress over this though: there’s nothing you can do about them except practice good computer habits and hygeine.
Log In to Your Router and Check What’s Using Your Connection
In most cases, as long as you know what computers and wireless devices are using your internet connection, and you know they’re all off, then these reasons can explain why your router or cable modem’s connection lights are flashing. If you’re still not sure though, it always possible there’s a device connected to your network that you don’t know about. Your router could be the problem (in which case, you may need to troubleshoot it), or maybe there’s another device on your network you don’t remember (or don’t know about.)
Log in to your router (if you’re not sure how, our night school will get you familiar with your home network) and check to see which devices are currently online. Almost every router lets you see a list of computers, tablets, smartphones, and other devices connected via wired ethernet or wireless networking. You may only see them listed by IP address or MAC or hardware address, but you should be able to tell which one are which—set-top boxes like Apple TVs or Rokus are usually noted as such, and you should be able to tell which devices are your computers. Most modern routers will even tell you the computer’s network name.
Smartphones and tablets might be a little trickier, but a quick look at the device itself should tell you its IP address or MAC address (here’s how to find it in IOS and in Android) and you can match it up with what you see in your router’s Admin page. If you see something out of the ordinary, you can always boot it from the network and wait to see if someone in your household complains their phone or laptop isn’t connected. Ideally though, nothing should look out of the ordinary. You never know, there may be a tablet or set-top box upstairs that’s online when you thought everything was turned off. Worst case, someone else may be using your wireless network behind your back. If that’s the case, it’s time to change your Wi-Fi password and your router’s admin password (which should be a strong password anyway—if it’s not, use this occasion to make sure it is!)
Check Your Computer to See What’s Communicating Behind Your Back
Alternatively, it may not be a sneaky device on your network making your router or modem’s lights flash—it could be an application on one of your computers. Even when all of your applications are closed, there may be services or applications with processes running in the background that are calling home, or at least communicating with the internet to make sure they have the most up-to-date versions of themselves. To find out, try Little Snitch (Mac) or previously mentioned Radio Silence (Mac) to see what applications are talking to the web. Then you can block or allow them as you choose. On the Windows side, try a standard firewall like Comodo Firewall (Win) or an app like NetLimiter (Win) to uncover which applications are talking to the internet and when.
In most cases, flashing lights on your router are a good thing. They indicate your connection is up and healthy. Just because your computers may be off or your router unplugged doesn’t mean that those lights should stop flashing altogether, or that there’s something wrong if they’re still going even when you’re not doing anything on the internet. As long as you keep your computers safe and protected, those lights are likely normal processes out on the internet that you shouldn’t worry about.
