0

The Finder displays nearby Computers and Devices in the left column whenever a network connection is present.

Sometimes we let clients use our network when we discuss projects in meetings (aka they bring their Notebooks along). In some cases we would prefer if they couldn't see all the machines and devices in our network.

Is there a way to prevent the discovery of other network clients on the infrastructure side? I tried blocking Bonjour traffic, however, the Macs are still able to see who's around?

1

It's possible to block Bonjour traffic by configuring pf to disallow:

  • MAC addresses:
    01:00:5E:00:00:FB – IPv4
    33:33:00:00:00:FB – IPv6
  • IP addresses:
    224.0.0.251 – multicast IPv4 address
    FF02::FB – multicast IPv6 address
  • UDP port 5353

However, this will also impact your own regular and "desirable" hosts.

One possibility is to configure a VLAN and set it up as default network for your clients. A VLAN - properly set up - spans its own broadcast domain which can't be bypassed or bridged by Bonjour traffic.

You need appropriate devices in your network environment to be able to create VLANs.

-1

The computers are not being discovered by Bonjour; they're being discovered by NetBIOS.

NetBIOS is a common network protocol that all IP-based devices use to announce themselves on the network. That includes printers, security cameras, phones, etc. It cannot be disabled on the infrastructure side (well, technically it can but this would break one of the core components of TCP/IP).

The only way to prevent someone from "sniffing" other computers is to isolate them on a different network. Since we're talking about laptops here, that means they're connecting via WiFi. The best course of action would be to set up a guest WiFi network.

If you want to make the attempt, the ports you need to block are:

  • TCP port 139
  • UDP ports 137 and 138
  • Did you notice that the OP is talking about Macs and Finder? These don't use NetBios to announce themselves or to discover devices (not by default, anyway), but Bonjour to discover services. And Bonjour is just Apple's marketing name for their implementation of ZeroConf via DNS-SD (DNS-based Service Discovery alongside Service Announcement) over mDNS (Multicast DNS). – Kurt Pfeifle May 20 '16 at 23:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .