Detect users when using Internet Sharing?

Question

My wireless died months ago, so I've gone back to a wired ethernet connection for my TiBook. When my friends come to visit, I turn on my AirPort card and activate Internet Sharing. This all works well and good, with no tweaking necessary. Thank God for Apple, Inc.
The problem is, I would like to monitor who is using the internet connection. If my neighbors (I live in a condo) are leeching my access or, worse yet, attempting to hack my laptop, I would like to know about it. I can't find any app included in the OS to monitor such connections (which, btw, seems really insane, since this sharing functionality can be flipped on by clicking a single button). Any ideas on what software I should be using?
Thanks.
TiBook G4   Mac OS X (10.4.8)  

Answer 1

Nice try, but fails if they simply assign themselves a different network address, or if they get one from DHCP. No, since his laptop is now effectively the wireless access point and NAT routing device, the thing to do is check the arp cache. I'll bet there are third-party programs to do this, but being a homebrew kinda guy, I'd write a script like:
<pre>
#!/bin/bash -l
currarp=`arp -a`
if [ -f /tmp/arpcache ]
then
anychange=`echo "$currarp"|diff -q - /tmp/arpcache`
if [ "$anychange" ]
then
change=`echo "$currarp"|diff - /tmp/arpcache`
echo "someone new is on the network $change"|wall
echo "$change"|syslog -s
echo "$currarp" > /tmp/arpcache
fi
else
echo "$currarp" > /tmp/arpcache
fi
exit 0
</pre>
And then make it execute every minute with cron:
$crontab -e
(add a line to file with $EDITOR:)
* * * * * /path/to/script
And then as long as I've got a Terminal or xterm or other cli window up, I'll get a notification if there's any change on my network. Since my laptop is the access point, anybody connecting to the network is going to be in my arp cache, so we can examine that for any change.
It's not a pretty script, just whipped it up, but it should prove the concept.
-Phil
Powerbook G4, iMac (Intel), and tons of hardware sitting in the closet   Mac OS X (10.4.9)