Is Someone Using My Network?

Discussion in 'Mac OS X Server, Xserve, and Networking' started by modit, Jan 22, 2012.

  1. modit macrumors 6502

    Apr 8, 2008
    I have my airport extreme and I was wonder how likely is someone else been leaching off my network?

    I'm looking at DHCP Clients (not to sure what that means...) but I noticed that the MAC address of my sibling's MacBook client ID is repeated twice with one having no name and another with a name like this "FIRSTLASTAD3D". Is it being spoofed? It has two different IP addresses. Secondly, that computer was not at the house either but at another adjacent house.

    I use WPA2 security with a strong password and MAC filtering with a small list of allowed devices. Is my wireless network secure or am I vulnerable?

    Thank you!
  2. parapup macrumors 65816


    Oct 31, 2006
    If you are using WPA2 with a strong password and have update the Airport's firmware to latest - I don't think you have anything to worry about. Unless your sibling knows your WPA2 password there is no way he/she is going to be able to get on your network.

    If still in doubt - generate a highly secure password and use it instead of the current one, reboot the router and be safe :)
  3. modit, Jan 22, 2012
    Last edited: Jan 22, 2012

    modit thread starter macrumors 6502

    Apr 8, 2008
    I actually allow my sibling's laptop on my network (I got his MAC address and entered the password in myself). My concern was that each time I look at the airport utility app on my iPhone, the name of the users on my network are either numbers (IP address) or like the name of my sibling's laptop with "AD3D" attached. I recognize the MAC addresses so maybe I wrong about seeing other people on my network.

    Can a single MAC address have two different IP address? Lastly, can a MAC address be spoofed?

  4. prisstratton macrumors 6502a


    Dec 20, 2011
    Winnipeg, Manitoba, Canada
    If you entered the password yourself and have not divulged this to anyone else, then it is very highly unlikely that someone else is using your network (did you allow guest networking??). If you use the link that parapup provided you are virtually guaranteed that no one will be hacking your network. If you are in doubt about the strength of these passwords do some more reading on Steve Gibson's pages. He is a mathematician and he explains how and why his passwords are so strong.

    In answer to your questions, yes, it is possible for a single MAC address to have two different IP's. If you have a system that is hard wired and also has a wireless connection to your network, then they would show up twice. You can see this for yourself, go to System Preferences >> Network and click on the Wireless connection on the left and look at the assigned IP on the right, then click on the Ethernet connection and look at that IP address. Also, if you had a computer attached and have since turned it off, the IP address will still show as being assigned, as they are usually valid for a set period of time (e.g. 24 hours). This can make it look like there is some phantom connection.

    Yes, a MAC address can be spoofed, but someone has to have physical access to your hardware or access to your network before they can "get to it".

    As parapet stated - if you are still in doubt, employ a new password from the GRC web site.
  5. rwwest7 macrumors regular

    Sep 24, 2011
    The person doing the spoofing would have to know the MAC address and the password. DHCP logs are not the greatest place to look for snoopers, I'd do random network scans when you know your sibling is not on. iNet from the App store works good. And when in doubt change your password.

    MAC filtering and WPA2 is pretty solid for home use, I think you may be just a little paranoid. But changing your password regularly is always a good idea.
  6. BreakGuy macrumors 6502a


    Nov 23, 2009
    NZ, South Pacific
    Anything that connects to the network will show up. Perhaps you have devices you've forgotten you have connected, such as TVs, gaming consoles, phones, iPods, etc.
  7. belvdr macrumors 603

    Aug 15, 2005
    No longer logging into MR
    That would be two different MAC addresses. A wireless adapter and wired adapter are two NICs, so they have different MAC addresses. Still a single NIC (i.e. one MAC address) can have two IPs bound to it.

    No, for wireless, you can see the MAC addresses flying across the air unencrypted, even on an encrypted network. That's why MAC address filtering is practically useless. For all intents and purposes, consider a MAC address public information.
  8. DustinT macrumors 68000


    Feb 26, 2011
    Agreed, that's why it amuses me when people go to the trouble of blurring out their IP and MAC address. If you relying on that to protect yourself, it's a pretty shallow protection.

    Yup, you can absolutely sniff an IP and MAC address out of the air with nothing more than a MacBook and some software.
  9. Mr. Retrofire macrumors 603

    Mr. Retrofire

    Mar 2, 2010
    Yeah, i use it.

    My pleasure!

  10. belvdr macrumors 603

    Aug 15, 2005
    No longer logging into MR
    That started my day off right. Excellent!
  11. David085 macrumors 6502a


    Nov 9, 2009
    Ya I use it too j/k
  12. IvanOhio macrumors newbie

    Jan 7, 2012
    I would be suspicious of a dark colored van sitting at the curb running near your house.

    But seriously, your device has a certain signal range. Unless you have close neighbors or like I mentioned above then I would worry.
  13. wallydavid macrumors newbie

    Jan 24, 2012
    Mac Address - WiFi and Eithernet

    This may be what you are experiencing. I set up my router to filter by Mac Address also, but for my wireless side. If you have a router in the house that is used to physically connect with a eithernet cable, you will get TWO listings in your DHCP users list for the same person. One for the wireless and one for the Ethernet port, as they can not have the same IP Address, but CAN share the same Mac Address because the laptop is one physical device with two different ways to connect to the internet.

    The other thing is, if someone connects wirelessly and via eithernet within a give time frame (a week, month, year or whatever your router is set to).. the router may be hanging on to that dhcp user in the settings. Some routers remember for a long time, so even if it wasn't last week, that device could have been connected via a cable at some point and it just hasn't flushed the user. Usually there is a update, or refresh the dhcp users button.

    Hope that helps.

Share This Page