[LAN] How i can search for ilegal connection in my Lan?

[JoshPeru]

HI, i have 8 user in my lan, is 512kb/sg, in different appartment in my building, i get internet service to my neigthborgs, but, i think that someone connect for a HUB, 2 or more computers. I use search program ADVANNCED LAN SCANNER, and only detect a HUB, but dont detect how machines connet on it... any idea?... thank

Topic Title edited. Please follow the posting rules.

Edited April 23, 2006 by Gouki

[mark strelecki]

Check out Look@LAN for a great (FREE!) app that inventories networks.

[RogueSpear]

Take a look at your DHCP client list. Look at your arp table, etc..

[Gouki]

What are you using to share the Internet connection?

I'll go with the RogueSpear. If you have anyone 'illegally' connecting to your network the best place to look at is DHCP Lease logs. Just make sure you know wich MAC addresses are the 'legal' ones to be connected tho.

If you are looking for an inventory application, then I suggest you look at the Network Section of the F/OSS List. There may be some applications there you'll find useful.

[doakwolf]

How about you collect a list of your 8 friends MAC addresses and set some security like MAC address filtering? This will help to stop people from accessing the connection.

Doak.

[rendrag]

until they use mac-spoofing and bypass it

[RogueSpear]

I have never once in all my years talked to someone who has encountered MAC address spoofing that resulted in a successful attack. This is the kind of thing that DoD worries about, and rightfully so, but I don't think it's anything Joe Sixpack should concern himself with.

[JoshPeru]

HI AGAIN, and thans so much for their replies, well, i use a Lan search, and appear that...

192.168.1.1 (not logged in) Ports (scanned 66, opened: 3, closed: 63)

192.168.1.33 (JUAREZ) (logged in) Ports (scanned 66 of 66, opened: 3, closed: 63)

192.168.1.36 (Not logged in) Ports (scanned 66, opened: 2, closed: 64)

Thes first is my router, i have a ADSL Internet servide, and i use i HUB, for delivery my internet connection .

the second is my machine.

and the last, is another router, but i cant see the machine,

how i can check this? (DHCP Lease logs) i dont know. what means, or how work,.

[rendrag]

if .36 is another router, you'll have to check its dhcp logs to see what connections it has, because 192.168.1.1 will not know what DHCP leases .36 gave out