Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a home network set up, complete with a relatively good password. I'm in Mac OS X 10.6 (Snow Leopard) and have been noticing, on occasion, a computer showing up in my Finder's Shared section, that is not one of my own (the "pe-xpjalle" box pictured below). He has a tendency to come and go.

Freeloader

How can I figure out his MAC address or something, so I can block him? I checked my "Logs and Statistics" in the Airport Utility, and didn't see that computer under DHCP clients. I'd rather not change my password, since I have quite a few devices I'd have to update. Is there any other reason he's show up on my network besides having guessed my password?

Update: I fixed the Dropbox URL above (how embarrassing, I'm new to Dropbox. Thanks for the heads up, Doug.)

Update 2: I tried clicking on "Connect as..." just for the hell of it, and got the dialog below. Now I have even less an idea what's going on than before. I don't have Parallels of VMware running, just the following: Transmission, NetNewsWire, Mail, Things, Safari, iTunes, Photoshop, Pages, Yojimbo, Preferences, AppleScript Editor, Software Update, Airport Utility, and Terminal. I don't think any of those create a virtual network machine, right? And no VMware machine of mine has ever had a name resembling "pe-xpjalle".

Dialog

Update 3: I just changed my passwords on both my N- and G-only networks, and I'm still seeing this, so I highly doubt that it's someone who's figured out my password (twice now). I'm really stumped.

share|improve this question
    
If he's not showing up on the DHCP clients table I doubt he is on your network. –  rodey Dec 16 '09 at 15:35
1  
@rodey It's pretty easy to determine usable addresses from sniffing traffic and then just statically assign. I'd expect someone trying to be sneaky to do that rather than taking DHCP (so they wouldn't show up in the table). If you crack the key, this is also very easy. Not something computer clueless Joe Random freeloading neighbor would typically do though. –  Brian Knoblauch Dec 16 '09 at 18:13

7 Answers 7

If he's already broken your encryption, MAC address filtering won't get you anywhere. The easiest and safest way to harden your network is to change the password to your network and enable WPA2 encryption.

share|improve this answer
    
Consider dumping wireless completely if possible. Obviously if you move around with a laptop, you'd need it, but if it's just a "I don't feel like installing the wiring" situation with fixed machines, you might want to reconsider! –  Brian Knoblauch Dec 16 '09 at 15:53
    
I guess also it's tough for me to imagine that someone's broken my encryption. I live in a suburban area, and probably have less than half a dozen neighbors even within range of my network. My G network is served by a single Airport Express, and my 2-Airport-Extreme network is N-only, which makes potential clients even more scarce. –  Dov Dec 16 '09 at 18:49
    
As mentioned in my latest update, I've now changed my passwords and have always had WPA2 turned on. So it looks like it may not be an actual person on my network. Any ideas? –  Dov Dec 19 '09 at 11:41

If it doesn't show up under the DHCP clients, are you sure that it's on your local network?

I've noticed that the Finder's Shared section's cache doesn't refresh too often. If you computer is a laptop, I think it's possible that this pe-xpjalle was found on another network and then still showed up when you came back home.

Alternately, perhaps your machine roamed onto another network.

Possible?

share|improve this answer
    
I don't think that would be the case, since the machine I'm noticing this on is a Mac Pro, and the foreign computer will appear and disappear repeatedly. I am connected via Ethernet, with my Airport shut off in my network settings, so I shouldn't be roaming at all. –  Dov Dec 16 '09 at 18:39

On a somewhat related note, you can use the arp command to determine the MAC address of any IP address your machine has communicated with recently.

arp -a will show you your entire MAC table.

More info can be found here: http://developer.apple.com/mac/library/documentation/Darwin/Reference/ManPages/man8/arp.8.html

share|improve this answer
    
I ran that command, and I get 6 responses. 5 are on my local 192.168.0.* subnet, the other is on 169.254.255.255, which doesn't look familiar at all. Of the 5 192.168.0.* addresses, 192.168.0.1 is my router, and I can account for all the rest in the DHCP list, except for one. 192.168.0.255 is not in my DHCP Clients list, and is in fact outside of my DHCP range, since I have the ending address set at 192.168.0.200. That certainly looks suspicious... –  Dov Dec 16 '09 at 18:34
    
That is usually the broadcast address. It is not a real device, but an IP provided by the router which has its packets forwarded all the other devices connected. This is normal and should not be changed, as it is required for DHCP clients to work. –  marcusw Dec 16 '09 at 19:51
    
Then what about that 169.254.255.255 address that's completely out of my local network's range altogether? –  Dov Dec 16 '09 at 21:42
    
169.254.x.x are autoconfiguration IP addresses. Namely, when I client can't get an IP address via DHCP, it gives itself one from that range. 169.254.255.255 is the broadcast address for that network. –  Christopher Karel Dec 17 '09 at 0:04
    
OK, so then the result of the "arp -a" didn't really give me any information on my potential intruder. Thanks anyways though, that's good to know. –  Dov Dec 17 '09 at 14:06

From updates 2 and 3, it really sounds like you've got something weird running on your computer. Here are a couple of tricks to look into this possibility: first, you can get the IP address of the phantom with the command findsmb:

$ findsmb

                                *=DMB
                                +=LMB
IP ADDR         NETBIOS NAME     WORKGROUP/OS/VERSION 
---------------------------------------------------------------------
192.168.0.12    PE-XPJALLE    [ WORKGROUP     ]

If that does come back with your Mac's IP address (as Update 2 suggests), try running lsof to see what program's doing netbios/microsoft networking on your computer:

$ sudo lsof -i | egrep "netbios|microsoft"
Password: [enter your admin password here]
launchd       1           root  103u  IPv4 0x07af52d4      0t0    TCP *:microsoft-ds (LISTEN)
launchd       1           root  105u  IPv4 0x05914740      0t0    TCP *:netbios-ssn (LISTEN)
nmbd      11168           root    6u  IPv4 0x0755b370      0t0    UDP *:netbios-ns
nmbd      11168           root    7u  IPv4 0x064f8054      0t0    UDP *:netbios-dgm
nmbd      11168           root    8u  IPv4 0x05a48e14      0t0    UDP 192.168.0.12:netbios- ns
nmbd      11168           root    9u  IPv4 0x056f3810      0t0    UDP 192.168.0.12:netbios-dgm
smbd      11175           root   19u  IPv4 0x05914740      0t0    TCP *:netbios-ssn (LISTEN)
smbd      11175           root   20u  IPv4 0x07af52d4      0t0    TCP *:microsoft-ds (LISTEN)

In the example above, I have Samba file sharing turned on, so I'm seeing its smbd (SMB daemon) and nmbd (name binding daemon), as well as the system launchd (which starts smbd when needed) active on the relevant network ports. Note that if you do somehow have a VM running on your Mac, I don't think lsof will show it, as they hook into the network at a lower level.

share|improve this answer
    
I had stopped using Parallels Desktop a long time ago, but apparently I didn't completely uninstall it, so a couple of its daemons were still running. I didn't get a chance to run findsmb first, but that probably would have helped point to it. Since uninstalling it, I have yet to see "pe-xpjalle" in my sidebar. I still don't know where that name came from, but that seemed to do it. –  Dov Dec 21 '09 at 11:48

It seems conclusive at this point that this whole thing was caused by remnants of my Parallels Desktop installation (specifically some networking daemon) that didn't get uninstalled properly when I switched to VMware Fusion. Since completely removing Parallels, as described here, I haven't seen "pe-xpjalle" in my sidebar. Thanks for all of the help.

share|improve this answer
    
For those following, it did just show up now for the first time since December. And I haven't reinstalled Parallels at all, and haven't even run (or updated) VMWare recently. –  Dov Mar 7 '10 at 13:13

The 'PE-XP' part of that name makes me think of WinPE, such as found on Windows boot/recovery CDs. You haven't run any of those lately? Maybe this is just a dormant entry from that? (shot in the dark..)

Also, what happens when you reboot the router? Does this rogue reconnect right away? Have you disconnected as many devices on your network as you can (network storage, other laptops, printers, etc) to ensure it isn't something within one of your systems?

share|improve this answer
    
No, I haven't run anything at all Windows-related in a while. In terms of other devices, all of my devices connect through DHCP, and they all show up in the DHCP Clients List in the Airport Utility. My only network storage is the USB drive connected to my Airport Utility, and my only printer is connected through USB to my computer. –  Dov Dec 16 '09 at 19:19

If the user is indeed connected to your network (which some people here indicate may be doubtful), then you should be able to see traffic coming from them if you run a packet sniffer for a while. Just look for any traffic originating from an IP other than those which you have assigned to computers in your house. Or, if you don't have any devices on during certain parts of the day, try running a capture then. Any traffic which shows up is probably your intruder. Once you capture some traffic, you've got their MAC address and can take action accordingly.

share|improve this answer
    
I've never used a packet sniffer before - are there any easy-to-use ones for OS X (preferably with some sort of GUI)? –  Dov Dec 17 '09 at 14:06
    
The one I see used most is WireShark. You can download it for free from <a href="wireshark.org/download.html">their website</a>. It has a GUI and is easy enough to use if you read the documentation. –  nhinkle Dec 20 '09 at 17:50
    
Sorry about that - apparently html links don't work in comments. Let me try again... wireshark.org/download.html –  nhinkle Dec 20 '09 at 17:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.