Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I just asked a question I think someone else has access to my wireless network. What next?. I have changed wireless security to WPA2, changed the password, disabled file sharing etc as =suggested in the answers. I even restarted my modem to that the DCHP leases expire. (Being a old modem, there is no option, at least from what can see, to reset leases)

Now, out of curiosity I downloaded Wireshark to see what is really happening on my network.

I still see 192.168.1.6 doing something on the network. Worse, I see my machine, 192.168.1.2 talking to it!
Wireshark

Now,

  1. How is this possible? The modem's DCHP leases say there is no 192.168.1.6.
  2. Could it be that my Mac somehow remembers a old address and tries to connect to it? Then why is there an response?
  3. Why would my mac connect at all? File sharing is off. Web sharing is off. Is this something to worry about or am I freaking out without reason?
share|improve this question
    
@Arjan, yes I have multiple computers at home. At thins point my Mac is on. The Windows machine is sleeping for sometime. Its IP was 192.168.1.5 when it was last active. But I have restarted my modem so that the DCHP leases expire immediately (wrong?). The Windows box does use DCHP. –  Nivas Aug 28 '11 at 10:53

2 Answers 2

up vote 7 down vote accepted
  1. How is this possible? The modem's DCHP leases say there is no 192.168.1.6.

DHCP just assigns IP addresses. It is completely advisory, and any host may choose its own address with or without DHCP.

2.Could it be that my Mac somehow remembers a old address and tries to connect to it? Then why is there an response? 3. Why would my mac connect at all? File sharing is off. Web sharing is off. Is this something to worry about or am I freaking out without reason?

From what we can see in this part, your Mac initiates a TCP connection and wants to speak NetBIOS. NetBIOS is often used for name resolution, not necessarily file sharing. Your Mac indeed remembered the NetBIOS remote endpoint and now connects to it. 192.168.1.6 speaks NetBIOS, but refuses the connection. That traffic in itself is not a problem.

possible intruder's machine

First, find out the router's IPv4 address. It's probably 192.168.1.1, but if it's .6, the mystery is solved. Then, disable WLAN temporarily and connect via cable. Make sure no other computer is connected, neither via cable nor WLAN (WiFi LED should be off). Then, set a new WPA2 password, first on the router, and then on all machines. Check the IP addresses on all machines connected to the network to make sure 192.168.1.6 is not an ancient file-server in your closet. If you can still detect the intruder (and I'd wager you're facing a misconfiguration, not an intruder - a knowledgeable intruder would probably not speak NetBIOS), ask a new question and make sure your computers are not compromised.

share|improve this answer

If someone has connected to your system it is possible for them to manually set whatever IP address they like bypassing the DHCP server.

Since there is traffic both to and from the .6 address there is obviously something there. Are you sure there is nothing else connected to your network, a NAS or some other network connected device like a TV or possibly a digital video recorder, games console, ipod, iphone etc.

I'm not sure how bonjour would show up in wireshark but it could be itunes sharing it's media.

share|improve this answer
    
I have changed my wireless protocol and restarted my modem. Is it still possible that someone is still connected to the network? –  Nivas Aug 28 '11 at 10:55
    
It seems unlikely if it happened straight away, you don't have any wired in network devices? –  Col Aug 28 '11 at 10:57
    
No. No wired in devices. –  Nivas Aug 28 '11 at 11:01
    
I'm not sure if the MAC supports this but try doing arp -a 192.168.1.6 which should return the mac address of the device then blocking that mac address from the router. –  Col Aug 28 '11 at 11:03
    
On a Mac: either arp -a to show a complete list of MAC addresses, or arp 192.168.1.6 to show only that entry. –  Arjan Aug 28 '11 at 13:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.