How do I get more information on a potential network freeloader?

How do I get more information on a potential network freeloader? I have a home network set up, complete with a relatively good password. I'm in Mac OS X 10.6 (Snow Leopard) and have been noticing, on occasion, a computer showing up in my Finder's Shared section, that is not one of my own (the "pe-xpjalle" box pictured below). He has a tendency to come and go.
Asked by: Guest \| Views: 317

Total answers/comments: 3

Comments display order:

bert [Entry]

"On a somewhat related note, you can use the arp command to determine the MAC address of any IP address your machine has communicated with recently.

arp -a will show you your entire MAC table.

More info can be found here: http://developer.apple.com/mac/library/documentation/Darwin/Reference/ManPages/man8/arp.8.html"

bert [Entry]

"The 'PE-XP' part of that name makes me think of WinPE, such as found on Windows boot/recovery CDs. You haven't run any of those lately? Maybe this is just a dormant entry from that? (shot in the dark..)

Also, what happens when you reboot the router? Does this rogue reconnect right away? Have you disconnected as many devices on your network as you can (network storage, other laptops, printers, etc) to ensure it isn't something within one of your systems?"
"The 'PE-XP' part of that name makes me think of WinPE, such as found on Windows boot/recovery CDs. You haven't run any of those lately? Maybe this is just a dormant entry from that? (shot in the dark..)

Also, what happens when you reboot the router? Does this rogue reconnect right away? Have you disconnected as many devices on your network as you can (network storage, other laptops, printers, etc) to ensure it isn't something within one of your systems?"

bert [Entry]

If the user is indeed connected to your network (which some people here indicate may be doubtful), then you should be able to see traffic coming from them if you run a packet sniffer for a while. Just look for any traffic originating from an IP other than those which you have assigned to computers in your house. Or, if you don't have any devices on during certain parts of the day, try running a capture then. Any traffic which shows up is probably your intruder. Once you capture some traffic, you've got their MAC address and can take action accordingly.