How do I get more information on a potential network freeloader?

Question

I have a home network set up, complete with a relatively good password. I'm in Mac OS X 10.6 (Snow Leopard) and have been noticing, on occasion, a computer showing up in my Finder's Shared section, that is not one of my own (the "pe-xpjalle" box pictured below). He has a tendency to come and go.

How can I figure out his MAC address or something, so I can block him? I checked my "Logs and Statistics" in the Airport Utility, and didn't see that computer under DHCP clients. I'd rather not change my password, since I have quite a few devices I'd have to update. Is there any other reason he's show up on my network besides having guessed my password?

Update: I fixed the Dropbox URL above (how embarrassing, I'm new to Dropbox. Thanks for the heads up, Doug.)

Update 2: I tried clicking on "Connect as..." just for the hell of it, and got the dialog below. Now I have even less an idea what's going on than before. I don't have Parallels of VMware running, just the following: Transmission, NetNewsWire, Mail, Things, Safari, iTunes, Photoshop, Pages, Yojimbo, Preferences, AppleScript Editor, Software Update, Airport Utility, and Terminal. I don't think any of those create a virtual network machine, right? And no VMware machine of mine has ever had a name resembling "pe-xpjalle".

Update 3: I just changed my passwords on both my N- and G-only networks, and I'm still seeing this, so I highly doubt that it's someone who's figured out my password (twice now). I'm really stumped.

Answer 1

If he's already broken your encryption, MAC address filtering won't get you anywhere. The easiest and safest way to harden your network is to change the password to your network and enable WPA2 encryption.

Answer 2

If it doesn't show up under the DHCP clients, are you sure that it's on your local network?

I've noticed that the Finder's Shared section's cache doesn't refresh too often. If you computer is a laptop, I think it's possible that this pe-xpjalle was found on another network and then still showed up when you came back home.

Alternately, perhaps your machine roamed onto another network.

Possible?

Answer 3

On a somewhat related note, you can use the arp command to determine the MAC address of any IP address your machine has communicated with recently.

arp -a will show you your entire MAC table.

More info can be found here: http://developer.apple.com/mac/library/documentation/Darwin/Reference/ManPages/man8/arp.8.html

Answer 4

From updates 2 and 3, it really sounds like you've got something weird running on your computer. Here are a couple of tricks to look into this possibility: first, you can get the IP address of the phantom with the command findsmb:

$ findsmb

                                *=DMB
                                +=LMB
IP ADDR         NETBIOS NAME     WORKGROUP/OS/VERSION 
---------------------------------------------------------------------
192.168.0.12    PE-XPJALLE    [ WORKGROUP     ]

If that does come back with your Mac's IP address (as Update 2 suggests), try running lsof to see what program's doing netbios/microsoft networking on your computer:

$ sudo lsof -i | egrep "netbios|microsoft"
Password: [enter your admin password here]
launchd       1           root  103u  IPv4 0x07af52d4      0t0    TCP *:microsoft-ds (LISTEN)
launchd       1           root  105u  IPv4 0x05914740      0t0    TCP *:netbios-ssn (LISTEN)
nmbd      11168           root    6u  IPv4 0x0755b370      0t0    UDP *:netbios-ns
nmbd      11168           root    7u  IPv4 0x064f8054      0t0    UDP *:netbios-dgm
nmbd      11168           root    8u  IPv4 0x05a48e14      0t0    UDP 192.168.0.12:netbios- ns
nmbd      11168           root    9u  IPv4 0x056f3810      0t0    UDP 192.168.0.12:netbios-dgm
smbd      11175           root   19u  IPv4 0x05914740      0t0    TCP *:netbios-ssn (LISTEN)
smbd      11175           root   20u  IPv4 0x07af52d4      0t0    TCP *:microsoft-ds (LISTEN)

In the example above, I have Samba file sharing turned on, so I'm seeing its smbd (SMB daemon) and nmbd (name binding daemon), as well as the system launchd (which starts smbd when needed) active on the relevant network ports. Note that if you do somehow have a VM running on your Mac, I don't think lsof will show it, as they hook into the network at a lower level.

Answer 5

It seems conclusive at this point that this whole thing was caused by remnants of my Parallels Desktop installation (specifically some networking daemon) that didn't get uninstalled properly when I switched to VMware Fusion. Since completely removing Parallels, as described here, I haven't seen "pe-xpjalle" in my sidebar. Thanks for all of the help.

Answer 6

The 'PE-XP' part of that name makes me think of WinPE, such as found on Windows boot/recovery CDs. You haven't run any of those lately? Maybe this is just a dormant entry from that? (shot in the dark..)

Also, what happens when you reboot the router? Does this rogue reconnect right away? Have you disconnected as many devices on your network as you can (network storage, other laptops, printers, etc) to ensure it isn't something within one of your systems?

Answer 7

If the user is indeed connected to your network (which some people here indicate may be doubtful), then you should be able to see traffic coming from them if you run a packet sniffer for a while. Just look for any traffic originating from an IP other than those which you have assigned to computers in your house. Or, if you don't have any devices on during certain parts of the day, try running a capture then. Any traffic which shows up is probably your intruder. Once you capture some traffic, you've got their MAC address and can take action accordingly.