Can I monitor who is using my Mac OS X Internet Sharing?

Question

I'm running Snow Leopard and I'm sharing my Verizon connection via my Mac's built-in AirPort. Is there any way for me to identify who/what is using my shared connection?

System Preferences » Sharing » Internet Sharing: sharing my Internet access from my Verizon USB Modem (aka Pantech USB Modem) to other computers, through my AirPort card.

I'm sharing my AirPort out to others as an Access Point.

(For Windows, see How can I find out who is using my Windows Internet Connection Sharing (ICS)?)

Solution 1

Well, if your Airport is the only wireless router you have, you can always find out who is connected to it.

To do that :

1. Start Airport Utility
2. Double-click your Airport
3. Start Manual Setup mode
4. Navigate to Airport > Summary
5. Choose "Wireless Clients"

You should now see a complete list of the clients connected to your Airport.

Alternatively, you might want to run a network sniffer program such as KisMAC or iStumbler.

EDIT : Question asked is actually referring to Internet Sharing using a Mac + in-build Airport as gateway.

In that case, since your Mac is the gateway + router, you can use a network mapper utility to "map" out the network, thus finding out who is connected. You can try NMap, an opensource network mapping utility.

Solution 2

I've figured out that the list of DHCP leases for the wifi that AirPort on the Mac publishes is kept in "/private/var/db/dhcpd_leases". This is not a list of currently connected clients, however. To figure out which "hosts" are still "up", I use the nmap utility (easily installed with Homebrew):

grep ip_address /private/var/db/dhcpd_leases | cut -d= -f2 | nmap -iL - -sn

Sample output:

...
Nmap scan report for 10.0.2.3
Host is up (0.74s latency).
Nmap scan report for 10.0.2.4
Host is up (0.11s latency).
Nmap done: 23 IP addresses (4 hosts up) scanned in 18.36 seconds

Next, lookup the same IPs back in the "dhcpd_leases" file to find out the client name and MAC address.

Solution 3

If you want to graphically display all your local network connections, you may be interested in etherape. Otherwise, I'd go with @caliban

Solution 4

there is a way of listing dhcp addresses if you enter in terminal:

arp -i en1 -a

sample output (10.0.2.1) is your mac's default address as an airport router :

? (10.0.2.1) at 60:33:4b:20:2e:e2 on en1 ifscope permanent [ethernet]
? (10.0.2.2) at (incomplete) on en1 ifscope [ethernet]

Solution 5

I like iftop, which you can install with MacPorts

View more solutions

Comments

[Admin]

By the way: if you're concerned about this (rather than just curious) then note that Internet Sharing uses WEP-security at best. And that's not secure at all. So, if concerned then do not use your Mac's Internet Sharing.

[Admin]

Yeah, that's a bit of a downer but I'm only using sharing while I'm at a conference so it's not a long term solution.

[Admin]

Just in case you don't know: there's also hardware access points that work with (some kinds of) these dongles (like the €79 fon.com/en/product/fonera2nFeatures or gizmodo.com/5192430/… and gizmodo.com/5243552/…).

[Chealion]

Additionally the MAC addresses can be used to figure out what kind of device is connected by using the first bit of the MAC Address. See the Server Fault Question: serverfault.com/questions/12296/…

[Eugene Morozov]

Maybe I asked the question wrong...I'm trying to find who is using my shared connection (System Preferences...Sharing...Internet Sharing shared from Airport to Verizon card) I'm sharing my Airport out as an Access Point. When I open the airport utility there is nothing listed.

[caliban]

Just got in and saw the updated question - oh! :) Okay now that explains better. Since your Mac is the gateway, you can just use a network mapping software. Refer to my edited answer for details.

[Eugene Morozov]

NMap seems to get me everything I wanted and more...Thanks

[mislav]

@Jason: I want to do the same as you, but I'm not happy with the conclusion of this discussion. The solution is just hinted but it's not clear. Can you update your original post with a definite answer how to use nmap to get a list of connected clients?

[BlueBerry - Vignesh4303]

could u elaborate little how the arp helps in internet sharing

[avk]

this helps in my case, just that i had to check for bridge100 and not bridge0. can be found using ifconfig

[Jean Paul]

worked for me but needed to use sudo for nmap