Detecting a Visit from a Wireless Snoop

Most routers have a function that logs information about each computer that has connected to it.

Tip

If you ever use an external adapter to connect your TV or printer to your network, an easy way to find its MAC address is by flipping the device upside down. It's usually written on the bottom.

What you are looking for is the DHCP log. DHCP is short for Dynamic Host Configuration Protocol. It sounds complicated, but it's not really. You can think of DHCP like a restaurant hostess. She guides you to a table where you will eat a meal. That table has a number and the wait-staff use that number to identify your table and to keep track of what dishes ordered from the kitchen belong to what tables. It's a temporary assignment. When you leave, someone else gets that table.

DHCP does something similar. When a computer joins a network, it needs an Internet address called an Internet Protocol (IP) address so information it asks for (such as email or a web page) gets sent to the right place. This IP address is called an internal IP address because the address is only used inside the home network.

To the Internet, a home router looks like one computer because it has one public IP; however, it can be the keeper of several computers and it manages all their needs using these internal IP addresses assigned by DHCP.

Caution

A savvy visitor to a wireless network can easily hide his tracks by logging on to your router (if the manufacturer's initial settings have not been changed) and clearing the log.

Inside your router is a log of DHCP clients . This is a list of people who have visited the network and used an internal IP address. To see who's been visiting, all you need to do is locate the log and read through it.

On a D-Link router's Home screen, click the Status tab, and then click Log on the left menu. The log shows a computer's visit to the network and lists its name , the time of the first access, and the IP address assigned by your router (see Figure 6.20).

Figure 6.20. This is a log of visitors to a D-Link wireless router. It's my router, so you can see visits by my computer, noted as andylaptop. Notice the visitor called Lappy, who is an uninvited guestprobably one of the guys who lives downstairs from me.

You'll see that it also lists the visiting computer's MAC address. No two MAC addresses are the same, so this is a unique way to know if a computer has been on your network. Of course, to verify this you'd need to get your hands on the computer's network card to compare its MAC address to the one in your router's log.