How to detect/list rogue computers connected to a WIFI network without access to the Wifi Router interface?

Question

This is what I believe to be an interesting challenge :)

A relative (that lives a bit too far to go there in person) is complaining that their WIFI/Internet network performance has gone down abysmally lately. She'd like to know if some of the neighbors are using her wifi network to access the internet but she's not too technically savvy.

I know that the best way to prevent issues would be to change the Router password, but it's a bit of a PITA having to re-configure all wifi devices... and if the uninvited guest broke the password once, they can do it again...

Her wifi router/internet connection is provided by the telco, and remotely managed so she can log-on to their telco account's page and remotely change the router's Wifi password, but doesn't have access to the router status page/config/etc unless she opts out of the telco's remote support and mainteinance service...

So, how could she check if there are guests in the wifi with this restrictions and in the most "point and click way"?

In this case I'd probably use nmap to look for other devices in the network, but I'm not sure if that's the easiest way to do it. I'm not a wifi expert, so I don't know if there are any wifi-scanning utils that can tell us who's talking to the router... Lastly, she's a Windows user as I guess that'll influence the choice of tools available

Any suggestions more than welcome

Regards!!

EDIT: Thanks @GdD for the ping/arp -a suggestion; it looked like a viable option, but I've tried it on my own WIFI network, and I'm not getting the expected resutls.

I do:

>arp -d

>arp -a
No ARP Entries Found.


>ping 192.168.1.255

Pinging 192.168.1.255 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 192.168.1.255:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

>arp -a

Interface: 192.168.1.42 --- 0xc
  Internet Address      Physical Address      Type
  192.168.1.1           64-68-xx-xx-xx-xx     dynamic
  192.168.1.255         ff-ff-ff-ff-ff-ff     static
  224.0.0.251           01-00-xx-xx-xx-xx     static
  224.0.0.252           01-00-xx-xx-xx-xx     static
  239.255.255.250       01-00-xx-xx-xx-xx     static

So it'd look like there was no other host on the network, but nmap says otherwise:

>nmap -sn 192.168.1.1/24

Starting Nmap 6.25 ( http://nmap.org ) at 2012-12-02 16:31 Romance Standard Time
Stats: 0:00:15 elapsed; 0 hosts completed (0 up), 42 undergoing ARP Ping Scan
Parallel DNS resolution of 42 hosts. Timing: About 25.00% done; ETC: 16:32 (0:00:42 remaining)
Nmap scan report for 192.168.1.1
Host is up (0.046s latency).
MAC Address: 64:68:xx:xx:xx:xx (Comtrend)
Nmap scan report for 192.168.1.39
Host is up (0.033s latency).
MAC Address: 3C:74:xx:xx:xx:xx (RIM)
Nmap scan report for 192.168.1.40
Host is up (0.098s latency).
MAC Address: 34:51:xx:xx:xx:xx (Apple)
Nmap scan report for 192.168.1.41
Host is up (0.083s latency).
MAC Address: 30:39:xx:xx:xx:xx (Sony Ericsson Mobile Communications AB)
Nmap scan report for 192.168.1.42
Host is up.
Nmap scan report for 192.168.1.43
Host is up (0.092s latency).
MAC Address: F0:A2:xx:xx:xx:xx (Private)
Nmap done: 256 IP addresses (6 hosts up) scanned in 58.20 seconds

I'm sure I'm doing something wrong, or there is some reasonable reason for the arp ping not to work; in any case it looks like the nmap solution is going to be the most reliable one :)

Regards and thanks to all!!!

Answer 1

I'm a bit confused why nmap would not be the weapon of choice, an nmap ping sweep would be my very first step. However, an alternative is you could simply ping the broadcast address and then do an arp -a. If the network is a /24 as most wireless networks are, say 192.168.0.0 with a 255.255.255.0 subnet mask, then pinging 192.168.0.255 will get all the systems on the network to respond and the arp table will show all devices on the network. An arp -a will list all those systems.

Really the best way to go about preventing unauthorized use would be to change the password and change the wireless security to WPA2 instead of WEP or WPA. That will kick any freeloaders off and make it much, much more difficult for anyone to break the key again. There's very good reasons for doing this as it will prevent your relative from being accused of software piracy and having a massive legal headache.