Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

How can I view a list of devices that are connected to my Apple laptop via Internet Sharing (when it's enabled)? If a list doesn't exist, does Internet Sharing log DHCP requests and if so, where? Thanks.

share|improve this question
1  
Good question!! –  daviesgeek Mar 15 '12 at 21:49

2 Answers 2

up vote 6 down vote accepted

You can try arp on the command-line:

NAME

arp -- address resolution display and control

DESCRIPTION

The arp utility displays and modifies the Internet-to-Ethernet address translation tables used by the address resolution protocol (arp(4)). With no flags, the program displays the current ARP entry for hostname. The host may be specified by name or by number, using Internet dot notation.

E.g. for internet-sharing from Ethernet to Airport I use:

arp -i en1 -a

This will list all clients connected via WLAN.

share|improve this answer
    
Thanks @iolsmit. My WiFi adapter is en0 on my MB Air, so that's the interface I use with the provided arp command. –  getWeberForStackExchange Mar 19 '12 at 21:09
1  
Just a tip: if you're unsure which interface is being used, you can always type ifconfig to list all of them. My MBP is connected to the internet via wifi, and I'm sharing internet to a raspberry pi over an ethernet cable. I had to use -i bridge0 to see the device's IP address. –  smessing Jan 4 '13 at 22:51
    
arp command will give you a snapshot of a state which might be rapidly changing, most notably if you are looking to a Wi-Fi network where devices may intermittently connect because they are on the border of the wireless sphere of access. –  daniel Azuelos Jul 18 '13 at 22:34
    
I think a useful place to start here might be a bare arp -a. You probably don't have that many interfaces that are translated! –  Dav Clark Sep 26 at 21:43

InternetSharing does log which address gets a DHCP lease within:

/var/log/system.log

Technically it is the bootpd daemon which does take care of this part of the network access.

You can track who is getting access to your network now with this command:

tail -f /var/log/system.log | grep 'bootpd.*\[en.\]'

You can display who connected and when to your network with this command:

grep 'bootpd.*\[en.\]' /var/log/system.log

If you need to track it further in the past, the command is:

bzgrep 'bootpd.*\[en.\]' `ls -tr /var/log/system.log.*.bz2`

Finally if you'd like to immediately distinguish in these logfiles known devices from uninvited ones, the method is to fill the configuration file of bootpd which is:

/etc/bootptab

with all known MAC addresses.

share|improve this answer
    
As of (at least) Mavericks, bootpd logs connections to a bridge rather than to the physical network device, so you'll want to grep for 'boodpf.*[bridge.*]' in order to find connection attempts. arp will still list connections to e.g. '-i en1', as well as to e.g. '-i bridge100'. –  Olfan Mar 28 at 10:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.