how can I tell if someone has hacked into my network?

Question

how can I tell if someone has hacked into my network?

is there a way to monitor who is on, and who has been on the network? Mine is hidden, and password protected. I have checked the logs and find a strange line that shows connection accepted from fe80::21d::4fff:fef8...etc...... is this the internet lease from the dsl modem? I am curious because my MacBook has not connected to the network after waking from sleep on a few occasions. It will sign on, but it does not see the preferred network without my help, and requires me to enter a password.

Macbook
10.5.1

MacBook, Mac OS X (10.5.1)

Posted on Feb 8, 2008 5:06 PM

Reply

Answer 1

Henry B.

Level 9

78,731 points

Feb 8, 2008 6:14 PM in response to Red Gravenstein

Only wireless connections are monitored, so the DSL modem's connection won't count.

What I suggest you do is implement WPA/WPA2 wireless security with a password not in any dictionary and then rest comfortably with the knowledge that your wireless network cannot be hacked into. And then, don't bother with monitoring who is on or off the wireless network, because the only people who are "on" are the ones you provided the password to.

Reply

Answer 2

Feb 8, 2008 6:41 PM in response to Henry B.

Thanks for the response.
I have WPA security with what I consider to be a rather obscure password, and I also have the network hidden. Things were acting a bit strange which is what made me a bit on the paranoid side. We have 4 macs on the network and 2 of those are via ethernet cables, but the ID I see does not belong to any of the 4 of them, besides when I last checked the airport log, 3 of the macs were powered down.

Reply

Answer 3

Feb 8, 2008 7:29 PM in response to Henry B.

I think I may have found the issue. I believe it is related to the IPv6 address for the machines. This is way above my knowledge, but after a brief search of the archives, it appears that shutting the whole IPv6 option down may solve the little problems I am having.
anyone....?
Bueller...?

Reply

Answer 4

Henry B.

Level 9

78,731 points

Feb 8, 2008 9:13 PM in response to Red Gravenstein

Sorry - I don't know the answer to your question. It's not something I've tried playing around with previously.

Reply

Answer 5

iFelix

Level 8

35,167 points

Feb 9, 2008 12:01 AM in response to Red Gravenstein

It will sign on, but it does not see the preferred network without my help, and requires me to enter a password.

This could be because you are not broadcasting your SSID (closed network), unhide your network (you will still be safe as you are using WPA) and see if that makes a difference.

Even without broadcasting your SSID, your wireless network is still broadcasting and detectable, however WPA protection will protect you from unauthorised wireless users accessing your network.

iFelix

Reply

Answer 6

iFelix

Level 8

35,167 points

Feb 9, 2008 12:01 AM in response to Red Gravenstein

Red Gravenstein wrote:
I think I may have found the issue. I believe it is related to the IPv6 address for the machines. This is way above my knowledge, but after a brief search of the archives, it appears that shutting the whole IPv6 option down may solve the little problems I am having.

Turn it off, unless you have a specific need for IPv6 there is no advantage to having it on.

See if it makes a difference.

Some people have reported that connection issues have been resolved when they turn off IPv6.

iFelix

Reply

Answer 7

Feb 9, 2008 9:50 AM in response to iFelix

Thanks, I have turned off the IPv6, and I'll see if that helps.

I have considered un-hiding the network, I understand that it will still be password protected. I just figured that this was one more layer of protection since someone would have to : 1. Know that there was a network there. 2. Hack the name of the network. 3. Hack the password.

My MacBook was not having any problems for 2 months, neither was my older iBook. If I continue to have problems, I think that (un-hiding the network) will be my next step.

Thank you all for your input!

Reply

Answer 8

iFelix

Level 8

35,167 points

Feb 9, 2008 11:23 AM in response to Red Gravenstein

Red Gravenstein wrote:
1. Know that there was a network there.

If you use it, then it's broadcasting therefore it can be detected.

2. Hack the name of the network.

The network name is passed in the clear (ie unencrypted) when an authorised client joins the network therefore that's quite simple.

Think about it, when you join the network you have to identify the network name and that is sent unencrypted.

3. Hack the password.

If you are using a non-dictionary word as a password and WPA then this isn't going to happen.

Think of hiding your SSID (network name) in the same manner as hiding your wireless router in a brown paper bag as a security measure.

You know it's there, others know it's there, it may make you feel better, but adds no security.

Reply