From: ps56k on

"ps56k" <pschuman_no_spam_me(a)interserv.com> wrote in message
news:i27mc2$69e$1(a)news.eternal-september.org...
>
> "Fuller" <fuller_w(a)Use-Author-Supplied-Address.invalid> wrote in message
> news:i27e0v$9fo$1(a)tioat.net...
>>
>> You guys are a suspicious bunch. I guess you're that way by nature. :)
>>
>> What I'm trying to do is find computers on MY network.
>>
>> I figured I'd ask the more general question of how to find computers on
>> ANY
>> network. But apparently that made you all jump to the conclusion that I'm
>> breaking into networks. Think about that. If I was, I'd be really bad at
>> it
>> as I can't even find MY computers on MY own home network!
>>
>> Given your knowledge, and nature, I realize now the same question would
>> have better been posed as:
>>
>> - Why don't I see MY computers on MY network?
>> Specifically, if an intruder has attached to MY network, how do I see HIM
>> on MY network (if I can't even see my own computers known to be on MY
>> network)!
>>
>> BTW, the same thing would happen at a hotspot - but I realize this makes
>> you all jumpy:
>> - How would I know if an intruder has attached to MY computer at the
>> hotspot (it seems hotspots get you guys all worked up so please just
>> concentrate on how I would find if someone had attached to MY computer at
>> the hotspot).
>>
>> Thanks in advance.
>> I'm following Jeff's astute information; the rest so far were less than
>> helpful (and probably misunderstood the question).
>
> you keep asking a variety of different questions
> that have different answers
> using different tools
>
> Looking around a network to see things....
>
> Netstumbler - displays WAPs existence - nothing more
>
> To see "other computers" -
> Windows "sharing" neighborhood will show others that have it turned on....
> won't if it is turned off
> NET VIEW only shows my computer, but there are others on the LAN
> ARP -a nothing shows
> NBTSTAT -n only shows my own computer & group msbrowse - but no others
>
> That's if you want to reach out and touch another drive on some elses
> computer.
>
> For your other question, about those reaching out to touch your
> computer...
> you have to enable your computer for "sharing" - if not, then nothing is
> there to touch.
>
> For the TCP/IP aspect - again you can reach out to ther IP ports and "try"
> things,
> same as they can try and connect to any TCP/IP "services" you have running
> on your computer.
>
> There ya go - you can now hack into others - or be hacked - your choice.
>
> IP scanner - basically Ping the range - and listen for replies
>


forgot another great command
to see your IP connections to the outside world

NETSTAT -?


From: Shadow on
On Wed, 21 Jul 2010 13:51:10 +0000 (UTC), Fuller
<fuller_w(a)Use-Author-Supplied-Address.invalid> wrote:

>Is there a way to see all the computers on a network?
Wireshark or kismet or airdump-ng. Last two are for linux.

So I suppose wireshark

www.wireshark.org


You need some kind of gateway to use netscan or nmap properly,
ie, set your computer to use the gateway of the network you want to
scan.

I'm simplifying. Study up on it.
[]'s
From: DanS on
Fuller <fuller_w(a)Use-Author-Supplied-Address.invalid> wrote
in news:i27h3s$a8t$1(a)tioat.net:

> On Wed, 21 Jul 2010 11:41:14 -0700, John Navas wrote:
>>>You guys are a suspicious bunch. I guess you're that way
>>>by nature. :) What I'm trying to do is find computers on
>>>MY network.
>> Because...
>
> Because I want to know if anyone else is connecting to my
> network.
>
> So I first looked to see what computers were on my network
> (of which I have a few in the house).
>
> I couldn't even see my own computers on my own network, let
> alone someone elses' computer breaking into my network.
>
> So, if I could see my own computers on my own network, that
> would be the first step. The second step would be to see if
> a rougue (to use a term you guys seem to use) to see if a
> rougue computer was attaching to my network.
>
> NOTE: So far I tested "net view" "arp -a" and "nbstate -n",
> none of which can see the other computers that I know are
> on my network because they are my own computers. I'll keep
> digging given the hints Jeff and Mike provided and report
> back the results when I can finally see my own computers on
> my own network.

If you think you are going to be able to 'see' everything from
one computer, you are wrong.

The only way to do that would be to read the link Navas
posted, and then buy or setup some packet sniffer thing that
automatically looks for 'suspicious' packets.

That would involve putting a *HUB* between your modem and the
rtr, as a 'switch' most likely allow proper sniffing of
everything.

You have a NAT rtr. If no ports are mapped to an inside PC,
there's virtually no chance that anyone from the outside will
be able to get inside w/o already being inside, as in through
a spyware/malware/trojan infected PC.

As for the wireless, use the latest authentication and
encryption protocol.
From: Jeff Liebermann on
On Wed, 21 Jul 2010 20:01:32 +0000 (UTC), Fuller
<fuller_w(a)Use-Author-Supplied-Address.invalid> wrote:

>> 2. What are you trying to accomplish?
>A: I want to know if/when a rogue computer connects to my network.

AirSnare:
<http://home.comcast.net/~jay.deboer/airsnare/>

Arpwatch for Linux, comes with distribution...

WinAPR:
<http://www.windowsreference.com/free-utilities/arp-skwinarp-watch-arpwatch-for-vistaxp20032000/>
<http://sid.rstack.org/arp-sk/>

Wallwatcher
<http://www.wallwatcher1.com>

LinkLogger ($50)
<http://www.linklogger.com>

If you're really into monitoring, there are tons of SNMP based tools
for monitoring your WRT54G. The catch is that you'll need to install
alternative firmware in your WRT54G that supports logging and SNMP
(such as DD-WRT). See MRTG, PRTG, RRDTool, etc.

Sorry, but I really don't want continue guessing your network topology
and equipment. Y'er on your own for why common diagnostic commands do
not work on your machine.

--
# Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
# 831-336-2558
# http://802.11junk.com jeffl(a)cruzio.com
# http://www.LearnByDestroying.com AE6KS
From: Jeff Liebermann on
On Wed, 21 Jul 2010 09:03:49 -0700, Jeff Liebermann <jeffl(a)cruzio.com>
wrote:

>Nmap will also scan for IP's in use with:
> nmap -w -sP 192.168.1.0/24
>which will produce something like:
> Host 192.168.1.1 appears to be up.
> MAC Address: 00:16:01:97:FD:A6 (Buffalo)
> Host 192.168.1.11 appears to be up.
> Host 192.168.1.110 appears to be up.
> MAC Address: 00:01:E6:32:6B:0E (Hewlett-Packard Company)
> Host 192.168.1.120 appears to be up.
> MAC Address: 00:24:36:96:13:E6 (Unknown)
> Nmap done: 256 IP addresses (4 hosts up) scanned in 14.844 seconds


One more tool, fping:
<http://fping.sourceforge.net>

Note the weird -g syntax for the range of IP addresses. Change the
address range to match your network.

C:\>fping -g 192.168.1.1/192.168.1.254

Fast pinger version 2.16
(c) Wouter Dhondt (http://www.kwakkelflap.com)
Pinging multiple hosts with 32 bytes of data every 1000 ms:
Reply[1] from 192.168.1.1: bytes=32 time=1.2 ms TTL=64
Reply[2] from 192.168.1.2: bytes=32 time=2.9 ms TTL=255
192.168.1.3: request timed out
192.168.1.4: request timed out
192.168.1.5: request timed out
192.168.1.6: request timed out
192.168.1.7: request timed out
192.168.1.8: request timed out
(...)

You can remove the timeouts from the output with:
fping -g 192.168.1.1/192.168.1.254 | find "Reply"
and to speed things up a bit (from 1 sec to 0.5 sec):
fping -t 500 -g 192.168.1.1/192.168.1.254 | find "Reply"
You'll have to wait for all 254 pings to finish to see the output.

nmap is probably easier and better.

--
# Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
# 831-336-2558
# http://802.11junk.com jeffl(a)cruzio.com
# http://www.LearnByDestroying.com AE6KS