Cut unwanted connection

[Farabi]

Hi,
Im using a local WLAN connection, I want to retrieve all of IP address of all connection and delete unwanted connection, how to do that?

[clive]

Im using a local WLAN connection, I want to retrieve all of IP address of all connection and delete unwanted connection, how to do that?

A wireless network (wifi?), people connecting to you, or traffic in general? Generally your network card will only actively receive packets directed to your MAC address or multicast. Seeing as the transport medium is half duplex, even if the packets aren't directed at you they will consume your perceived bandwidth.

Have you tried something like NetStumbler or WireShark?

Do you have access to a router or access-point that would permit you to identify and block MAC addresses?

[Farabi]

Yeah, a wifi, people does not connect to me but to a wifi device. I tried to use wireshark but dont know how to delete unwanted IP address. I need to know this so I can limit the traffic on a wifi device (Is that device called a router?)

[ecube]

Get peerblock, it's a free open source IP blocker that runs at kernel level(works 2k-win7). Wireshark is just a packet sniffer it can't block connections like peerblock can  http://www.peerblock.com/ also a good list of IP lists I use to block countries and stuff is http://www.iblocklist.com/lists.php

[sinsi]

If you have access to the router, there should be an option for MAC address filtering, you can only connect via wireless if you're on the list.

[clive]

Get peerblock, it's a free open source IP blocker that runs at kernel level(works 2k-win7). Wireshark is just a packet sniffer it can't block connections like peerblock can  http://www.peerblock.com/ also a good list of IP lists I use to block countries and stuff is http://www.iblocklist.com/lists.php

I realize that WireShark/NetStumbler won't block, but they will permit you too identify localized traffic, and the MAC addresses of transmitting devices within the local network. Knowing the IP addresses of people thousands of miles away probably won't help much for a WiFi network. Another good tool for watching WiFi traffic is the BackTrack package with things like Kismet.

http://www.backtrack-linux.org/

Your "gateway" to the internet is usually a router, wireless-router, or access-point. Hopefully configured to limit the amount of rouge traffic entering your local network, and at a wireless level providing the ability (if enabled) to block/allow specific MAC addresses to associate with it, beyond knowing the SSID and passphrase. That said it's real easy to jam a wireless network regardless of whether you are permitted access to it or not.

[Farabi]

Can I get the IP address table from the router? Or I need to scan from IP range 192.168.1.1 to 192.168.255.255, that would be sucks.

[clive]

Can I get the IP address table from the router? Or I need to scan from IP range 192.168.1.1 to 192.168.255.255, that would be sucks.

The router would typically hand them out dynamically via DHCP, and be able to provide a list of machine names when available, along with MAC address (DHCP Status, or such). As the IP addresses are often reallocated you really want to know the MAC address of the transmitter, not the IP temporally assigned to to it.

[Farabi]

Can I get the IP address table from the router? Or I need to scan from IP range 192.168.1.1 to 192.168.255.255, that would be sucks.

The router would typically hand them out dynamically via DHCP, and be able to provide a list of machine names when available, along with MAC address (DHCP Status, or such). As the IP addresses are often reallocated you really want to know the MAC address of the transmitter, not the IP temporally assigned to to it.

How can I get MAC address, is it unique each computers? Is retrieving the address table can be used using IPLHLP.dll?

[clive]

How can I get MAC address, is it unique each computers? Is retrieving the address table can be used using IPLHLP.dll?

The MAC address is a globally unique address for each ethernet transceiver, and is typically only useful/available on the local 802.x network.

Perhaps you want to look at ARP (Address Resolution Protocol)? http://technet.microsoft.com/en-us/library/cc961394.aspx

Code Select Expand

C:\>arp

Displays and modifies the IP-to-Physical address translation tables used by
address resolution protocol (ARP).

ARP -s inet_addr eth_addr [if_addr]
ARP -d inet_addr [if_addr]
ARP -a [inet_addr] [-N if_addr]

  -a            Displays current ARP entries by interrogating the current
                protocol data.  If inet_addr is specified, the IP and Physical
                addresses for only the specified computer are displayed.  If
                more than one network interface uses ARP, entries for each ARP
                table are displayed.
  -g            Same as -a.
  inet_addr     Specifies an internet address.
  -N if_addr    Displays the ARP entries for the network interface specified
                by if_addr.
  -d            Deletes the host specified by inet_addr. inet_addr may be
                wildcarded with * to delete all hosts.
  -s            Adds the host and associates the Internet address inet_addr
                with the Physical address eth_addr.  The Physical address is
                given as 6 hexadecimal bytes separated by hyphens. The entry
                is permanent.
  eth_addr      Specifies a physical address.
  if_addr       If present, this specifies the Internet address of the
                interface whose address translation table should be modified.
                If not present, the first applicable interface will be used.
Example:
  > arp -s 157.55.85.212   00-aa-00-62-c6-09  .... Adds a static entry.
  > arp -a                                    .... Displays the arp table.

Code Select Expand

C:\>arp -a

Interface: 192.168.3.188 --- 0x2
  Internet Address      Physical Address      Type
  192.168.3.1           00-1b-11-6a-21-17     dynamic
  192.168.3.213         68-7f-74-7d-1c-50     dynamic