Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This is what I believe to be an interesting challenge :)

A relative (that lives a bit too far to go there in person) is complaining that their WIFI/Internet network performance has gone down abysmally lately. She'd like to know if some of the neighbors are using her wifi network to access the internet but she's not too technically savvy.

I know that the best way to prevent issues would be to change the Router password, but it's a bit of a PITA having to re-configure all wifi devices... and if the uninvited guest broke the password once, they can do it again...

Her wifi router/internet connection is provided by the telco, and remotely managed so she can log-on to their telco account's page and remotely change the router's Wifi password, but doesn't have access to the router status page/config/etc unless she opts out of the telco's remote support and mainteinance service...

So, how could she check if there are guests in the wifi with this restrictions and in the most "point and click way"?

In this case I'd probably use nmap to look for other devices in the network, but I'm not sure if that's the easiest way to do it. I'm not a wifi expert, so I don't know if there are any wifi-scanning utils that can tell us who's talking to the router... Lastly, she's a Windows user as I guess that'll influence the choice of tools available

Any suggestions more than welcome

Regards!!

EDIT: Thanks @GdD for the ping/arp -a suggestion; it looked like a viable option, but I've tried it on my own WIFI network, and I'm not getting the expected resutls.

I do:

>arp -d

>arp -a
No ARP Entries Found.


>ping 192.168.1.255

Pinging 192.168.1.255 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 192.168.1.255:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

>arp -a

Interface: 192.168.1.42 --- 0xc
  Internet Address      Physical Address      Type
  192.168.1.1           64-68-xx-xx-xx-xx     dynamic
  192.168.1.255         ff-ff-ff-ff-ff-ff     static
  224.0.0.251           01-00-xx-xx-xx-xx     static
  224.0.0.252           01-00-xx-xx-xx-xx     static
  239.255.255.250       01-00-xx-xx-xx-xx     static

So it'd look like there was no other host on the network, but nmap says otherwise:

>nmap -sn 192.168.1.1/24

Starting Nmap 6.25 ( http://nmap.org ) at 2012-12-02 16:31 Romance Standard Time
Stats: 0:00:15 elapsed; 0 hosts completed (0 up), 42 undergoing ARP Ping Scan
Parallel DNS resolution of 42 hosts. Timing: About 25.00% done; ETC: 16:32 (0:00:42 remaining)
Nmap scan report for 192.168.1.1
Host is up (0.046s latency).
MAC Address: 64:68:xx:xx:xx:xx (Comtrend)
Nmap scan report for 192.168.1.39
Host is up (0.033s latency).
MAC Address: 3C:74:xx:xx:xx:xx (RIM)
Nmap scan report for 192.168.1.40
Host is up (0.098s latency).
MAC Address: 34:51:xx:xx:xx:xx (Apple)
Nmap scan report for 192.168.1.41
Host is up (0.083s latency).
MAC Address: 30:39:xx:xx:xx:xx (Sony Ericsson Mobile Communications AB)
Nmap scan report for 192.168.1.42
Host is up.
Nmap scan report for 192.168.1.43
Host is up (0.092s latency).
MAC Address: F0:A2:xx:xx:xx:xx (Private)
Nmap done: 256 IP addresses (6 hosts up) scanned in 58.20 seconds

I'm sure I'm doing something wrong, or there is some reasonable reason for the arp ping not to work; in any case it looks like the nmap solution is going to be the most reliable one :)

Regards and thanks to all!!!

share|improve this question
1  
How hard can running nmap -sn network address be? –  Terry Chia Dec 1 '12 at 10:00
    
Hi! It's not too hard - as long as you know what nmap is, how to run it from the command line, etc.. I know it's the way I'd do it, but was hoping to avoid installing software, etc... but I'm seeing that it's going to be the most reliable way to do it, thanks for validating my hunch!!! –  JJarava Dec 2 '12 at 14:06
add comment

2 Answers

I'm a bit confused why nmap would not be the weapon of choice, an nmap ping sweep would be my very first step. However, an alternative is you could simply ping the broadcast address and then do an arp -a. If the network is a /24 as most wireless networks are, say 192.168.0.0 with a 255.255.255.0 subnet mask, then pinging 192.168.0.255 will get all the systems on the network to respond and the arp table will show all devices on the network. An arp -a will list all those systems.

Really the best way to go about preventing unauthorized use would be to change the password and change the wireless security to WPA2 instead of WEP or WPA. That will kick any freeloaders off and make it much, much more difficult for anyone to break the key again. There's very good reasons for doing this as it will prevent your relative from being accused of software piracy and having a massive legal headache.

share|improve this answer
    
Hi, @GdD, thanks a lot for the hint; it looks much simpler than an nmap ping sweep (at least for those that don't have nmap) I've tried the ping , arp -a trick on my own wifi network and came up dry - see the edit to my question for more info (it's difficult to paste command output in the comments! :D) –  JJarava Dec 2 '12 at 15:21
    
Also, I agree with @GdD that probably the best would be to change the WIFI password, and ensure they're using WPA2 (instead of WPA-PSK) to secure the network - it's what I first suggested and will push for as a reasonable suggestion regardless of whether they have freeloaders or not... but as they'd have to go through the telco's managed support for that, and modify 6-8 devices, I'm sure it's more likely they'll pay attention if they turn to have "visitors" :D –  JJarava Dec 2 '12 at 15:48
    
Did you actually ping the broadcast address? If the network isn't a /24 then .255 isn't the broadcast address. In any case it's only a substitute for nmap. If you do an ipconfig /all you'll see the actual network config and can figure out the broadcast address. –  GdD Dec 2 '12 at 16:30
    
Hi, GdD. My wifi setup is pretty simple, and I'm running a /24 network so the broadcast is/should be .255. I've just tried again and in this case I got one response, from my InOut mediacenter, but nmap -sn reports 8 hosts up... I guess most modern OSs don't answer to broadcast ping, to avoid ping floods? –  JJarava Dec 4 '12 at 2:30
    
It's not necessarily OS, it could be the wireless router controlling broadcasts. –  GdD Dec 4 '12 at 9:13
add comment

Why not use a MAC address filter and assign the devices used by the relative to be able to access the wifi network.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.