Welcome to the MacNN Forums.

Buck_W · Jul 2, 2008, 06:35 PM

This may belong in the Networking forum, but since it is showing up in Leopard's Finder, I decided to post in here. Whenever I am connected to the web at home, besides the other personal computer in my home which is connected to my home network. . . in the Finder, under Shared, I have someone else showing up identified as mac00112...(there are seven more numbers and letters).

Who or what is this? If I right click on it and Get Info, it says, Kind: PC Server

I'm connected to the web wirelessly through a router in my home which is connected to a cable modem. Is this a neighbor down the street who is sharing the cable? If so, is this a potential security issue?

turtle777 · Jul 2, 2008, 06:43 PM

Originally Posted by Buck_W

I'm connected to the web wirelessly through a router in my home which is connected to a cable modem. Is this a neighbor down the street who is sharing the cable? If so, is this a potential security issue?

Is the neighbour down the street directly connected to your cable modem or connected to your wrieless router ? Only then he could show up.

Are you sure your WLAN is secured, and nobody can leech off of it ?

-t

Cold Warrior · Jul 2, 2008, 06:47 PM

what sort of router is it and do you have any other devices connected?

mduell · Jul 2, 2008, 08:30 PM

It could be another device... like a printer or a time capsule doing SMB sharing.

Buck_W · Jul 2, 2008, 08:55 PM

The Linksys WRT54GS router is secured using WPA Personal security. No one outside my house is directly connected to my modem or router. I have one iMac connected to the LAN and an Epson printer connected to the iMac. How would I find out if the printer is the culprit? I looked at the back of the printer and none of the ID numbers matched.

Buck_W · Jul 2, 2008, 09:49 PM

Evidently it has something to do with the router because I just changed the password on the router and the next time I connected wirelessly there was an additional user under the shared portion of the Finder. It only shows up on my laptops that are connected wirelessly. It does not appear in the Finder of the iMac which is wired directly the router... weird...

besson3c · Jul 2, 2008, 10:13 PM

Originally Posted by Buck_W

The Linksys WRT54GS router is secured using WPA Personal security. No one outside my house is directly connected to my modem or router. I have one iMac connected to the LAN and an Epson printer connected to the iMac. How would I find out if the printer is the culprit? I looked at the back of the printer and none of the ID numbers matched.

You could try turning the printer off

Buck_W · Jul 2, 2008, 10:17 PM

Originally Posted by besson3c

You could try turning the printer off

That's the first thing I did, including unplugging the USB cable from the iMac. It didn't change a thing.

besson3c · Jul 2, 2008, 10:19 PM

I would look at your router admin pages to find out the IP address of this device, and then run a netstat on it to find out what ports it has open. This way, you can figure out what this machine or device does and what OS it is running.

frdmfghtr · Jul 3, 2008, 12:34 AM

Do you have yur MacBook set to share its Internet connection? Perhaps somebody is connecting to your MacBook that way. (Just an idea)

mduell · Jul 3, 2008, 01:42 AM

It's not the printer since your printer isn't networked. Do you have any cell or VOIP phones that use wifi?

Buck_W · Jul 3, 2008, 07:37 AM

No, I do not have sharing turned on, nor do I have VoIP or cell phones that use WiFi... I wonder if Apple's tech support (I have Apple Care) could help me figure it out?

ginoledesma · Jul 3, 2008, 06:13 PM

What about right-clicking (contextual menu) on the device and choosing Get Info? what does it say under More Info? It's not Back to My Mac, is it (in case you have that enabled).

Buck_W · Jul 3, 2008, 06:33 PM

Originally Posted by ginoledesma

What about right-clicking (contextual menu) on the device and choosing Get Info? what does it say under More Info? It's not Back to My Mac, is it (in case you have that enabled).

It says the following...

General:
Kind: PC Server
Label:
More Info:
--
Preview:
(It has the icon of a PC monitor with a blue screen with tiny writing [too small too decipher] in white font - blue screen of death perhaps?)

ginoledesma · Jul 3, 2008, 07:57 PM

The name "mac00112" is basically a generic name for a network device, the full name of which is a combination of "mac" and the MAC address of the device (a series of hexadecimal characters). Each MAC address is unique to the device (though this can be spoofed).

You could find out the full MAC address by either resizing the sidebar to show the whole MAC address. You can determine the vendor by putting the string (excluding "mac") here. The partial string 00112 shows that Apple is one of the possible vendors of the MAC address.

Once you have the MAC address, you can try to see if it's been given an IP address on your network (or if your computer can reach it). Simply ping the broadcast: (e.g. ping 192.168.0.255, assuming your computer is given the 192.168.0.0 space). Once you've pinged the broadcast, you should see a bunch of replies. You can then lookup the MAC addresses associated with the IP address using arp:

Code:
~ gledesma$ ping 192.168.0.255
PING 192.168.0.255 (192.168.0.255): 56 data bytes
64 bytes from 192.168.0.13: icmp_seq=0 ttl=64 time=0.092 ms
64 bytes from 192.168.0.1: icmp_seq=0 ttl=64 time=1.409 ms (DUP!)
64 bytes from 192.168.0.13: icmp_seq=0 ttl=64 time=1.986 ms (DUP!)
^C

~ gledesma$ arp -a
? (192.168.0.1) at 0:1c:f0:52:19:86 on en0 [ethernet]
? (192.168.0.255) at ff:ff:ff:ff:ff:ff on en0 [ethernet]

You can use Network Utility to do a portscan of the device to determine what services are running. Or you can ask the router who this address was assigned to.

When you do have the MAC address though, you could simply try to match this with all the devices on your network that you know of. Mac OS X has this information in Network Utility (under Info) or the Network Preference pane. This is also printed on some surface of the device.

Buck_W · Jul 3, 2008, 11:12 PM

I spoke with a phone rep from Apple earlier tonight and he said that my wireless was picking up someone else on our cable line that probably has file sharing turned on. He sent me the following info:

Ad hoc mode allows users to spontaneously form a wireless LAN. For example, a group of people with 802.11-equipped laptops may gather for a business meeting at their corporate headquarters. In order to share documents such as presentation charts and spreadsheets, they could easily switch their NICs to ad hoc mode to form a small wireless LAN within their meeting room. Another example is when you and your associates are waiting for a flight at the airport, and you need to share a relatively large PDF file. Through ad hoc mode, you can easily transfer the file from one laptop to another. With any of these applications, there's no need to install an access point and run cables.

forumhound · Jul 4, 2008, 12:20 AM

this ad hoc thing blows me away, i am trying to set up a network right now for our studio using a wireless router, with security, and mac access list...does adhoc go around all that just because you have two macs in the room? more info needed...

ps. i came to this thread hoping to find a mac tool to show me who is on the network, in an easy to understand map, like with the pc program from network magic. I have intermapper (old version) and it rots and the upgrade is way too much pisa. i am looking for a map tool that shows ip assigned, mac address, and some friendly computer name. i also would like a tool that would allow me to send admin messages to all who is on the lan. anyone know of something? thx...

besson3c · Jul 4, 2008, 12:33 AM

I don't buy the Apple guy's theory about an ad hoc network. Regardless of the existence of ad hoc networks, your Mac can only be associated with one subnet at a time on a single network interface (although it is possible to do this with multiple interfaces, e.g. ethernet and wifi). Therefore, it is only going to be able to detect other machines on your LAN. It will provide you with the option of joining this person's ad hoc wifi network within your Airport menu, but you can only be joined to one network at a time on a single interface. Therefore, if you are certain you are behind a router and that this router is properly protecting your network, this has to be on your network.

Again, like I said above, the way to tell for sure what is going on is log in to your router admin pages and find the list of machines that are connected to your router and receiving a DHCP lease. If this person is connected to your network, you'll have his IP address, and you can scan this computer to determine roughly what it might be doing using netstat.

You might also want to verify your network settings to see that you are indeed receiving a DHCP lease from your router. You can do this by looking at your gateway IP that is assigned to you, and comparing this to the IP address assigned to the router.

forumhound · Jul 4, 2008, 12:45 AM

Originally Posted by besson3c

I don't buy the Apple guy's theory about an ad hoc network. Regardless of the existence of ad hoc networks, your Mac can only be associated with one subnet at a time on a single network interface (although it is possible to do this with multiple interfaces, e.g. ethernet and wifi). Therefore, it is only going to be able to detect other machines on your LAN. It will provide you with the option of joining this person's ad hoc wifi network within your Airport menu, but you can only be joined to one network at a time on a single interface. Therefore, if you are certain you are behind a router and that this router is properly protecting your network, this has to be on your network.

Again, like I said above, the way to tell for sure what is going on is log in to your router admin pages and find the list of machines that are connected to your router and receiving a DHCP lease. If this person is connected to your network, you'll have his IP address, and you can scan this computer to determine roughly what it might be doing using netstat.

You might also want to verify your network settings to see that you are indeed receiving a DHCP lease from your router. You can do this by looking at your gateway IP that is assigned to you, and comparing this to the IP address assigned to the router.

yes that makes sense, u would have to switch networks to go into any sorta "adhoc" mode, one would think. Anyway, thanks for the tip about netstat, but my SMC modem/router firmware has severe problems with the log among other things, and SMC is not forthcoming in providing new firmware. I need a tool that allows me to see everyone, but having a hard time finding that.

besson3c · Jul 4, 2008, 01:27 AM

Does your SMC router not have a set of administrative web pages? What happens when you go to the IP address of your router in a browser?

forumhound · Jul 4, 2008, 10:03 AM

Originally Posted by besson3c

Does your SMC router not have a set of administrative web pages? What happens when you go to the IP address of your router in a browser?

hi besson, yes but i have rotten SMC firmware. it shows, if i am lucky, the mac address and IP assigned. Most macs show a name too, but not all. PCs never show a name. And I have folks coming and going all day, and administering by mac address is just a pain. So i just hand out a friendly WPA password and leave it at that. So I am looking for some mapping software that gens a map on the fly. Intermapper says it does this, but in reality the version i have does not. It gives me just what the router does. Plus, I want something that allows me to send admin notes to all on the network, like you do in Windoze using the built in messaging service. Does mac not have that? thanks!!!

Cold Warrior · Jul 4, 2008, 10:24 AM

Thread title changed slightly to accommodate interest in messaging LAN clients.

forumhound · 10:37 AM

Originally Posted by Cold Warrior

Thread title changed slightly to accommodate interest in messaging LAN clients.

very cool, thx. starting to think i need to get out some tin cans and string... ha! my next thought was slightly more constructive, maybe i need to explore the use of OSX server? surely that must have lan messaging no? I have never even seen a copy running, so dunno.

ide3308 · Jul 4, 2008, 11:55 AM

Have you considered using Remote Desktop? That is a great way to message clients in your network. I just don't know if Apple Remote Desktop is compatible with Windows RD. Good luck!

besson3c · Jul 4, 2008, 12:01 PM

Originally Posted by forumhound

hi besson, yes but i have rotten SMC firmware. it shows, if i am lucky, the mac address and IP assigned. Most macs show a name too, but not all. PCs never show a name. And I have folks coming and going all day, and administering by mac address is just a pain. So i just hand out a friendly WPA password and leave it at that. So I am looking for some mapping software that gens a map on the fly. Intermapper says it does this, but in reality the version i have does not. It gives me just what the router does. Plus, I want something that allows me to send admin notes to all on the network, like you do in Windoze using the built in messaging service. Does mac not have that? thanks!!!

All we need are the IP addresses, like I said.

So, what IP addressses are connected to your network right now?

forumhound · Jul 4, 2008, 10:08 PM

Originally Posted by ide3308

Have you considered using Remote Desktop? That is a great way to message clients in your network. I just don't know if Apple Remote Desktop is compatible with Windows RD. Good luck!

Hi, I have both Remote Desktop Connection:mac(beta) and CoRD and as far as I can tell they are not messaging tools, they are just like screen share, but for use between Macs and PCs. I don't want to take over the user's screen, just have an admin message box pop up on their screen. cheers!

forumhound · Jul 4, 2008, 10:14 PM

Originally Posted by besson3c

All we need are the IP addresses, like I said.

So, what IP addressses are connected to your network right now?

Besson, please say more. I CAN see all the IP addresses connected. What can I do with that? They are distributed thru DHCP, so they are always changing.

besson3c · Jul 5, 2008, 12:07 AM

Originally Posted by forumhound

Hi, I have both Remote Desktop Connection:mac(beta) and CoRD and as far as I can tell they are not messaging tools, they are just like screen share, but for use between Macs and PCs. I don't want to take over the user's screen, just have an admin message box pop up on their screen. cheers!

There is no standardized protocol supported on all platforms for sending messages that way, but you can block them from using your network.

besson3c · Jul 5, 2008, 12:09 AM

Originally Posted by forumhound

Besson, please say more. I CAN see all the IP addresses connected. What can I do with that? They are distributed thru DHCP, so they are always changing.

Take the list of IP addresses that are connected, compare them to the ones that you know should be on your network (i.e. the ones you own), find the one that shouldn't belong, and either block this MAC address from your network using the router admin (if they provide such a tool), or if you are unsure what the machine might be doing, conduct a netstat of the IP address (netstat -a <ipaddress>). Share the output of this terminal command here.

forumhound · 03:47 AM

Originally Posted by besson3c

Take the list of IP addresses that are connected, compare them to the ones that you know should be on your network (i.e. the ones you own), find the one that shouldn't belong, and either block this MAC address from your network using the router admin (if they provide such a tool), or if you are unsure what the machine might be doing, conduct a netstat of the IP address (netstat -a <ipaddress>). Share the output of this terminal command here.

Aw geez I think I am convoluting this thread

- so let me start over, I know how to:
* configure a basic lan network using the SMC 7904wbra2 modem/router
* see IP and MAC addresses for those logged in
* configure security for those I don't want on the lan.

What I want to know how to do is:
* see what computernames are associated with these IP/Mac addresses; my firmware in my router does not do this well, if at all. (Although the cheesy program in windows called Network Magic seems to do it pretty darn well.)
* communicate with all IPs logged in, or heck, just let me communicate with the apples logged in, if there is no cross-platform support. There has to be some support like this for apples logged in!
Thanks,
FH

PS. Here is what I want but with messaging and for OSX:

turtle777 · Jul 5, 2008, 12:41 AM

Block the MAC address.

An don't be shocked if something suddenly stops working in your home.

-t

forumhound · Jul 5, 2008, 01:35 AM

Originally Posted by turtle777

Block the MAC address.

An don't be shocked if something suddenly stops working in your home.

-t

uh, turtle, wuz that supposed to mean? I live in nepal, i am not shocked by anything that does not work. I am shocked when something does.

Ozz_man · Jul 5, 2008, 08:57 AM

Lol. by the way, just unplugging something doesn't mean it's folder will just disappear.

forumhound · Jul 5, 2008, 09:31 AM

Originally Posted by Ozz_man

Lol. by the way, just unplugging something doesn't mean it's folder will just disappear.

not sure what this thread has become, but if I make this app for leopard will u buy a copy?

fesdds · Jul 5, 2008, 12:15 PM

I have noticed the same issue the last couple of months, but wasn't too worried about it. I have a lot of macs and figured it was just one of them giving a secondary signal. So after reading this thread I looked into it and I have a pic of a monitor in my shared portion of my finder windows, as well as a pic of an iMac with the computer's name. The monitor says mac001... I opened up system profiler on my main iMac in the house and under Locations began comparing all of the MAC addresses to the one in Shared with the monitor pic and sure enough one of them matched up. It is the Ethernet of the iMac. So for what ever reason my other computers over my network show both the iMac and this Monitor with the Ethernet MAC address. When selecting Get Info for the ethernet Mac address it just lists it as PC Server.

Any thoughts?

turtle777 · Jul 5, 2008, 12:19 PM

Originally Posted by forumhound

uh, turtle, wuz that supposed to mean? I live in nepal, i am not shocked by anything that does not work. I am shocked when something does.

Log into your router, and find the tab that lets you enter a POSITIVE list of MAC addresses.
Put in this list all MAC addresses of your devices. Anything else will be shut out. In Linksys routers, it's found in the security tab.

-t

forumhound · Jul 5, 2008, 12:37 PM

Originally Posted by turtle777

Log into your router, and find the tab that lets you enter a POSITIVE list of MAC addresses.
Put in this list all MAC addresses of your devices. Anything else will be shut out. In Linksys routers, it's found in the security tab.

-t

Hi turtle, yes, i do that in most cases. but I don't want to restrict by mac id, as that requires me to be here to give someone access. I'd rather just leave them with WPA login info. I am in a village, and there are not many other computers in range...

forumhound · Jul 5, 2008, 12:41 PM

Originally Posted by fesdds

I have noticed the same issue the last couple of months, but wasn't too worried about it. I have a lot of macs and figured it was just one of them giving a secondary signal. So after reading this thread I looked into it and I have a pic of a monitor in my shared portion of my finder windows, as well as a pic of an iMac with the computer's name. The monitor says mac001... I opened up system profiler on my main iMac in the house and under Locations began comparing all of the MAC addresses to the one in Shared with the monitor pic and sure enough one of them matched up. It is the Ethernet of the iMac. So for what ever reason my other computers over my network show both the iMac and this Monitor with the Ethernet MAC address. When selecting Get Info for the ethernet Mac address it just lists it as PC Server.

Any thoughts?

Hey fes, I was going to bring that one up too, later...but that's the way it is here just on macs running 10.5.2+, one mac is running 10.5 and it just shows up in my finder list once. go figure.
cheers!

forumhound · Jul 5, 2008, 12:48 PM

Ha, here is a discovery and one more reason to find a decent network tool and not rely on crap router firmware: On the SMC, if a machine is attached by manually assigning IP addresses from the mac side, it will never show up in the router firmware anywhere else but the dinky tiny security log box (login success), but not on any other panels, like Wireless Access Management or other places that a machine with an IP assigned by the router will show up - then u get 1) mac id, 2) Ip address, and 2) friendlycomputer name. that is so bogus.

Cold Warrior · Jul 5, 2008, 12:50 PM

Originally Posted by forumhound

What I want to know how to do is:
* see what computernames are associated with these IP/Mac addresses; my firmware in my router does not do this well, if at all. (Although the cheesy program in windows called Network Magic seems to do it pretty darn well.)
* communicate with all IPs logged in, or heck, just let me communicate with the apples logged in, if there is no cross-platform support. There has to be some support like this for apples logged in!

Get a router that does let you see this. Like turtle mentioned, a Linksys router's security page lets you see computer name, MAC, and IP. Everything you want.

You won't be able to communicate with machines that are logged in unless they have Bonjour on through something like iChat or the Windows messaging service. I don't know why you'd expect users to open up services just to talk to the network sysad.

The best way to message all clients -- given your limited setup and the individual and unknown configurations of many clients -- is to set the router so that it pops up a window when a client connects. Type in whatever you want, like 'welcome to my network' or anything. Take down the network for a few seconds if you have something important, then it forces all clients to reconnect and see the new message.

forumhound · 01:12 PM

Originally Posted by Cold Warrior

Get a router that does let you see this. Like turtle mentioned, a Linksys router's security page lets you see computer name, MAC, and IP. Everything you want.

You won't be able to communicate with machines that are logged in unless they have Bonjour on through something like iChat or the Windows messaging service. I don't know why you'd expect users to open up services just to talk to the network sysad.

The best way to message all clients -- given your limited setup and the individual and unknown configurations of many clients -- is to set the router so that it pops up a window when a client connects. Type in whatever you want, like 'welcome to my network' or anything. Take down the network for a few seconds if you have something important, then it forces all clients to reconnect and see the new message.

Ha! thanks for that cold warrior, i guess i am stuck then, as getting a decent router here is like trying to get petro - sol. the best we could get is this smc, which does what u say kinda. i think the firmware just is buggy and no one from SMC has responded to emails.

On communications, understood. We just have a small music studio and allow clients to come in with laptops and get to the internet for whatever. I was just thinking there might be a way to send messages to everyone or to an ip without having to log into some chat program, but perhaps that's the best way. thanks!!!

Ps.BTW, that pc program posted above does all the mapping that I wanted (PCs and Macs), and even has a plugin for port forwarding without opening up the router page. Why can't I have that on the mac?

randolphpeters · Jul 8, 2008, 06:42 AM

I'm pretty sure the extra "computer" on your network is the Windows machine you are running through Parallels.

turtle777 · Jul 8, 2008, 11:47 AM

Originally Posted by forumhound

Hi turtle, yes, i do that in most cases. but I don't want to restrict by mac id, as that requires me to be here to give someone access. I'd rather just leave them with WPA login info. I am in a village, and there are not many other computers in range...

My advice was more geared towards the OP, who doesn't have (want) anyone else connected to his Mac.

-t

turtle777 · Jul 8, 2008, 11:51 AM

Originally Posted by forumhound

Ha! thanks for that cold warrior, i guess i am stuck then, as getting a decent router here is like trying to get petro - sol. the best we could get is this smc, which does what u say kinda. i think the firmware just is buggy and no one from SMC has responded to emails.

In case you ever get around to get a new router, get one that can easily be updated with open / patched firmware.

Many of the newer linksys routers are like that.

-t

fesdds · Jul 8, 2008, 08:03 PM

Did you compare the MAC address from the icon with your MAC addresses listed under the Network portion of your system profiler to see if it was something internal like my iMac?