I'm using a ISP with router of Linksys E900 model. During the last three month someone anonymous has been using my internet. I can see the MAC address using different IP address. Right now it needs to stop. How can I trace the customer and launch an complaint against them?
A simple solution if the MAC address is not being spoofed, add the MAC address to the Router's blacklist.
If it is being spoofed, then you should change the network name (SSID) on the router, change the password etc. and make the network hidden (e.g. turn off broadcast SSID).
Once it is hidden you would need to be able to connect to it by entering it manually in your wifi setup.
I don't think you will be able to find the person introuding on your network using the MAC-address. The address could be spoofed (i.e. set to something random by the freeloader). If it is not spoofed in theory the company manufacturing the network card with the MAC-address used by the freeloader could know who they sold it to, but you don't even what company to ask and even if they did there is no way they would answer your question. So the MAC-address doesn't help you very much.
What could you do instead? I see two options:
- Use a directional antenna to find out where the signal is coming from. (I assume here that the freeloader is using Wi-Fi.)
- Use a program like Wireshark to look at the freeloaders traffic and see if you can find any information in it that helps you identify her.
But what do you do once you know who it is? That person is not a "customer" of your ISP, and there is no one you could lodge a complaint to. You could call the police - hacking someones Wi-Fi is illegal in most parts of the world - but I doubt they would give it hight priority.
No, tracking the person down is a lot of effort for very little gain. If I were you, I would just focus on making sure the freeloader stays out of your network in the future. Here are some tips:
- If you yourself are not using the Wi-Fi, just disable it. (If you disable Wi-FI, you can ignore the below points.)
- Change your admin password for the routers config page. Or perhaps do a factory reset on the router if you suspect the freeloader has been messing with your settings.
- Make sure you are using WPA2.
- Change your Wi-Fi password to something more complex than
- Disable WPS.
If you want to read more about how to secure your router, check out this page.
You could try to collect as much information as you can about this person,
you should wait for him to connect and then use nmap:
sudo nmap -O 192.168.1.129 // 192.168.1.129 <- his current IP
if you are successful you could detect:
- MAC with type of pc (es:Apple), unless he has changed the MAC (with macchanger )
- Device type (es: phone)
- OS : (es: Apple Mac OS X 10.7.X)
- open ports (es: 62078/tcp open iphone-sync), with this you could try emm.. other path.. more.. invasive.. but not advised
After that you should :
- change you password!
- add a MAC filter (whitelist) but still he could pretend to have your MAC
- check if the router is vulnerable to Pixie Dust Attack
You appear to have a way to identify the culprit - is that by the addresses they connect to?
If so, I recommend redirecting those addresses to another page that indicates that they have been discovered and that you are monitoring them and actively tracking them. This would be pretty simple to do if the things they are connecting to are not used by legitimate users on your network.
In your case tracing the owner of that MAC address may not be a viable option since MAC address can be spoofed. (as pointed by @Julie Pelletier in comments)
There are few latest pretty easy to exploit attacks that can crack the password of the router even if its WPA2.One of them is Pixie Dust Attack. So, even if you change the password, the attacker can crack it again in few minutes.
Also, I suggest you to do a few things in your Router.
- Use WPA2 in your router.
- Use MAC Address binding in your Router.
- Disable WPS on your router.
Some,additional information on Pixie dust attack can be found here
You can get the MAC adress of the anonymous by sending a ping containing his IP adress or his SSID and when the ping will be successful ,you must send the arp command line "arp -a" containing the ip adress of the anonymous (for example : arp -a 192.168.11.2 ).This command line will give u the MAC adress which you will add it in the denied MAC adress list.