# How to detect/list rogue computers connected to a WIFI network without access to the Wifi Router interface?

This is what I believe to be an interesting challenge :)

A relative (that lives a bit too far to go there in person) is complaining that their WIFI/Internet network performance has gone down abysmally lately. She'd like to know if some of the neighbors are using her wifi network to access the internet but she's not too technically savvy.

I know that the best way to prevent issues would be to change the Router password, but it's a bit of a PITA having to re-configure all wifi devices... and if the uninvited guest broke the password once, they can do it again...

Her wifi router/internet connection is provided by the telco, and remotely managed so she can log-on to their telco account's page and remotely change the router's Wifi password, but doesn't have access to the router status page/config/etc unless she opts out of the telco's remote support and mainteinance service...

So, how could she check if there are guests in the wifi with this restrictions and in the most "point and click way"?

In this case I'd probably use nmap to look for other devices in the network, but I'm not sure if that's the easiest way to do it. I'm not a wifi expert, so I don't know if there are any wifi-scanning utils that can tell us who's talking to the router... Lastly, she's a Windows user as I guess that'll influence the choice of tools available

Any suggestions more than welcome

Regards!!

EDIT: Thanks @GdD for the ping/arp -a suggestion; it looked like a viable option, but I've tried it on my own WIFI network, and I'm not getting the expected resutls.

I do:

>arp -d

>arp -a
No ARP Entries Found.

>ping 192.168.1.255

Pinging 192.168.1.255 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 192.168.1.255:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

>arp -a

Interface: 192.168.1.42 --- 0xc
192.168.1.1           64-68-xx-xx-xx-xx     dynamic
192.168.1.255         ff-ff-ff-ff-ff-ff     static
224.0.0.251           01-00-xx-xx-xx-xx     static
224.0.0.252           01-00-xx-xx-xx-xx     static
239.255.255.250       01-00-xx-xx-xx-xx     static


So it'd look like there was no other host on the network, but nmap says otherwise:

>nmap -sn 192.168.1.1/24

Starting Nmap 6.25 ( http://nmap.org ) at 2012-12-02 16:31 Romance Standard Time
Stats: 0:00:15 elapsed; 0 hosts completed (0 up), 42 undergoing ARP Ping Scan
Parallel DNS resolution of 42 hosts. Timing: About 25.00% done; ETC: 16:32 (0:00:42 remaining)
Nmap scan report for 192.168.1.1
Host is up (0.046s latency).
Nmap scan report for 192.168.1.39
Host is up (0.033s latency).
Nmap scan report for 192.168.1.40
Host is up (0.098s latency).
Nmap scan report for 192.168.1.41
Host is up (0.083s latency).
MAC Address: 30:39:xx:xx:xx:xx (Sony Ericsson Mobile Communications AB)
Nmap scan report for 192.168.1.42
Host is up.
Nmap scan report for 192.168.1.43
Host is up (0.092s latency).
Nmap done: 256 IP addresses (6 hosts up) scanned in 58.20 seconds


I'm sure I'm doing something wrong, or there is some reasonable reason for the arp ping not to work; in any case it looks like the nmap solution is going to be the most reliable one :)

Regards and thanks to all!!!

• How hard can running nmap -sn network address be? – user10211 Dec 1 '12 at 10:00
• Hi! It's not too hard - as long as you know what nmap is, how to run it from the command line, etc.. I know it's the way I'd do it, but was hoping to avoid installing software, etc... but I'm seeing that it's going to be the most reliable way to do it, thanks for validating my hunch!!! – JJarava Dec 2 '12 at 14:06