Can I monitor who is using my Mac OS X Internet Sharing?

I'm running Snow Leopard and I'm sharing my Verizon connection via my Mac's built-in AirPort. Is there any way for me to identify who/what is using my shared connection?

System Preferences » Sharing » Internet Sharing: sharing my Internet access from my Verizon USB Modem (aka Pantech USB Modem) to other computers, through my AirPort card.

alt text

I'm sharing my AirPort out to others as an Access Point.

(For Windows, see How can I find out who is using my Windows Internet Connection Sharing (ICS)?)

Jason

Posted 2009-09-29T17:12:35.740

Reputation: 1 029

By the way: if you're concerned about this (rather than just curious) then note that Internet Sharing uses WEP-security at best. And that's not secure at all. So, if concerned then do not use your Mac's Internet Sharing. – Arjan – 2009-09-30T16:42:42.130

Yeah, that's a bit of a downer but I'm only using sharing while I'm at a conference so it's not a long term solution. – Jason – 2009-09-30T18:02:45.633

Just in case you don't know: there's also hardware access points that work with (some kinds of) these dongles (like the €79 http://www.fon.com/en/product/fonera2nFeatures or http://gizmodo.com/5192430/review-clear-spot-portable-wimax-wi+fi-hotspot and http://gizmodo.com/5243552/verizon-mifi-2200-ev+do-router-delivers-portable-wifi-with-a-hefty-fee).

– Arjan – 2009-09-30T18:38:27.060

Answers

Well, if your Airport is the only wireless router you have, you can always find out who is connected to it.

To do that :

Start Airport Utility
Double-click your Airport
Start Manual Setup mode
Navigate to Airport > Summary
Choose "Wireless Clients"

You should now see a complete list of the clients connected to your Airport.

alt text

Alternatively, you might want to run a network sniffer program such as KisMAC or iStumbler.

EDIT : Question asked is actually referring to Internet Sharing using a Mac + in-build Airport as gateway.

In that case, since your Mac is the gateway + router, you can use a network mapper utility to "map" out the network, thus finding out who is connected. You can try NMap, an opensource network mapping utility.

caliban

Posted 2009-09-29T17:12:35.740

Reputation: 18 979

1@Jason: I want to do the same as you, but I'm not happy with the conclusion of this discussion. The solution is just hinted but it's not clear. Can you update your original post with a definite answer how to use nmap to get a list of connected clients? – mislav – 2011-02-01T20:38:48.367

iStumbler does not give any information about connected clients. While KisMAC can get you the information you've obtained from Airport but is primarily designed for finding access points. – Chealion – 2009-09-29T18:43:46.193

Additionally the MAC addresses can be used to figure out what kind of device is connected by using the first bit of the MAC Address. See the Server Fault Question: http://serverfault.com/questions/12296/a-nice-tool-to-look-up-make-model-via-mac-address

– Chealion – 2009-09-29T18:46:21.243

1Maybe I asked the question wrong...I'm trying to find who is using my shared connection (System Preferences...Sharing...Internet Sharing shared from Airport to Verizon card) I'm sharing my Airport out as an Access Point. When I open the airport utility there is nothing listed. – Jason – 2009-09-30T00:33:06.607

Just got in and saw the updated question - oh! :) Okay now that explains better. Since your Mac is the gateway, you can just use a network mapping software. Refer to my edited answer for details. – caliban – 2009-09-30T16:35:33.300

NMap seems to get me everything I wanted and more...Thanks – Jason – 2009-09-30T18:02:04.870

I've figured out that the list of DHCP leases for the wifi that AirPort on the Mac publishes is kept in "/private/var/db/dhcpd_leases". This is not a list of currently connected clients, however. To figure out which "hosts" are still "up", I use the nmap utility (easily installed with Homebrew):

grep ip_address /private/var/db/dhcpd_leases | cut -d= -f2 | nmap -iL - -sn

Sample output:

...
Nmap scan report for 10.0.2.3
Host is up (0.74s latency).
Nmap scan report for 10.0.2.4
Host is up (0.11s latency).
Nmap done: 23 IP addresses (4 hosts up) scanned in 18.36 seconds

Next, lookup the same IPs back in the "dhcpd_leases" file to find out the client name and MAC address.

mislav

Posted 2009-09-29T17:12:35.740

Reputation: 1 670

worked for me but needed to use sudo for nmap – Jean Paul – 2019-11-27T14:58:24.733

If you want to graphically display all your local network connections, you may be interested in etherape. Otherwise, I'd go with @caliban

alt text

DaveParillo

Posted 2009-09-29T17:12:35.740

Reputation: 13 402

there is a way of listing dhcp addresses if you enter in terminal:

arp -i en1 -a

sample output (10.0.2.1) is your mac's default address as an airport router :

? (10.0.2.1) at 60:33:4b:20:2e:e2 on en1 ifscope permanent [ethernet]
? (10.0.2.2) at (incomplete) on en1 ifscope [ethernet]

Bjuncek

Posted 2009-09-29T17:12:35.740

Reputation: 41

I like iftop, which you can install with MacPorts

enter image description here

John Douthat

Posted 2009-09-29T17:12:35.740

Reputation: 581

arp -i bridge0 -a

If you are using Internet Sharing on Mac OS X

marjinn

Posted 2009-09-29T17:12:35.740

Reputation: 21

1could u elaborate little how the arp helps in internet sharing – BlueBerry - Vignesh4303 – 2013-10-08T09:24:08.707

this helps in my case, just that i had to check for bridge100 and not bridge0. can be found using ifconfig – avk – 2014-05-15T08:31:35.623