Wireless Network Monitoring

[Jay42]

I have a Mac Mini hard wired into my linksys (wired/wireless) network. I live in a close, urban neighborhood, and I would like to see which other neighbors are using are using my wifi, and possibly what they are doing since it is my network. (We don't have the best relationship.) It isn't illegal to spy on those piggybacking on your network, is it? I know you can look at router logs, but I'm not sure how on my WRT54G.

I know about WEP and WPA and stuff, and turn it on when I need it. However, I have a 1Ghz TiBook that does not seem to be able to use Wifi with WPA enabled, so I can't leave it on. Any thoughts on this also? Thanks.

 

[dadio2002]

I have the same question also and would like to know!

 

[Mitthrawnuruodo]

Please search the forums. Wireless security and monitoring is among the most usual thread topics, and I don't think we need yet another thread...

 

[Jay42]

I actually did search before posting, and did a little research on this topic on google. I guess that makes me more of an idiot to still have not answered my own question! I can't find an answer to my specific quesiton(s). Could you post a link? sorry....

 

[Jay42]

Anyone(?) C'mon these criminals are *stealing* from me...and it would be fun.

 

[mintlivedotcom]

I would like to know, too. I'm too lazy to search.

 

[ChrisBrightwell]

Look for an app called "Snort"

 

[simon-says]

I have the same router as you. If you aren't using the wireless why not just turn it off. That would seem to be the easiest way at keeping them out. If you just want to check on your router log in to the web interface. Go to the "Wireless" tab, in the mini menu click "Wireless Mac Filter", if this is not turned on you really should have it enabled. There should be a button for "Wireless Mac Filter List", click it and a window will appear. Click "Wireless Client Mac List" this will show you all the wireless clients that have been on your network. You should only allow your computers to access your network. There might be a better way to tell, but this is how I do it.

 

[mkrishnan]

I have the same router as you. If you aren't using the wireless why not just turn it off. That would seem to be the easiest way at keeping them out. If you just want to check on your router log in to the web interface. Go to the "Wireless" tab, in the mini menu click "Wireless Mac Filter", if this is not turned on you really should have it enabled. There should be a button for "Wireless Mac Filter List", click it and a window will appear. Click "Wireless Client Mac List" this will show you all the wireless clients that have been on your network. You should only allow your computers to access your network. There might be a better way to tell, but this is how I do it.

1) Your (OP's) TiBook should be able to run WPA with the Linksys -- are you sure you are entering the key in the correct format?

2) MAC filtering, as Simon describes, is really a good thing, especially if you're most worried about people "stealing" your "bandwidth." The MAC address is a hard-coded address that is a feature of the ethernet adaptor and is not readily changeable or spoofable by most people. If you lock out all alien MACs, your network should have a lot of protection from casual users even without WPA.

 

[annk]

I posted a question about this the other day after searching without finding answers I understood. I with there could be a sticky explaining this for noobs, I sure need it.

I did understand about WEP/WAP making it possible to encrypt the signal (my router has only WEP, unfortunately), SSID broadcasting (hope I´m remembering the acronym correctly) so that the network is not visible, and MAC addresses to only allow certain machines onto the network. But every time I try to save my changes in the web interface of my D-Link DI-514, my router crashes. I have to restart it, and am then back to zero.

Another thing that confuses me, is the MAC-address issue. Someone wrote an answer to my other post telling me which commands to use to identify the MAC addresses for our two Powerbooks and one Linux machine, which I will soon try (have never used terminal, but the explanation was clear, so I think I´ll manage). But when I go to the web interface of my D-Link, when only my Powerbook is connected (wirelessly), I see that the MAC address listed for LAN and Wireless is the same, while a different (only by the last digit) address is listed for WAN. This confuses me, since I thought a MAC address was specific to one machine, and didn´t change. If my PB is the only machine on my network, shouldn´t there only be one MAC address listed in the Status page of the web interface for my router?

I checked out Snort, as one poster here suggested, but it´s way over my head.

I think I´ll probably figure this out eventually with many hours of trying and reading, and help from IT-savvy friends, but I´d love to be able to figure it out myself - with a BASIC set of instructions that start from square one. I´m not a complete noob, but my knowledge is picked up along the way and has holes in it. I´m sure I´m not the only one in that situation. This forum is fantastic, I´ve gotten SO much help, but sometimes the answers I find when searching are just far enough over my head that I can´t make use of them.

Sorry for the long post, but my wireless broadband is so slow I have to assume my neighbors are using it - and I´m going nowhere fast

 

[ChrisBrightwell]

System Profiler will give you MAC addresses in OS X.

Linux should be a command like this:
ifconfig | grep addr

Also -- Linksys routers have an "active MAC" table in /Wireless.htm that'll show a list of active MAC addresses using the router. Once you setup MAC filtering, you'll see approved MACs highlighted in green and denied MACs in red.

Sorry snort was over your head.

Hope this helps.

 

[annk]

System Profiler will give you MAC addresses in OS X.

Linux should be a command like this:
ifconfig | grep addr

Also -- Linksys routers have an "active MAC" table in /Wireless.htm that'll show a list of active MAC addresses using the router. Once you setup MAC filtering, you'll see approved MACs highlighted in green and denied MACs in red.

Sorry snort was over your head.

Hope this helps.

So many posts are about Linksys routers, that I just may end up getting one of those if nothing else works. Most of my questions would then be asked and answered in existing posts

One question - why would denied MAC addresses show up at all in a list over "active MAC"? Isn't the point of filtering to ensure that only the approved addresses are allowed on the network? Or are the addresses in red machines that have tried to use my network, but been denied because of the filter?

Thanks for the tip about finding the MAC in system profiler.

In the end, none of this will help if my router keeps freezing up each time I try to make a change and save it (the "system is updating" window never goes away, and if I finally click "continue", the router crashes). But I do appreciate the help, thanks!!