2

I've recently installed NetCut (from Arkai corp.) on my PC. I've already successfully executed the app and tested it several times. I can see the MAC addresses of all network users, kick them out of the Wi-Fi, see their IP, etc.

However, this afternoon, when I launched the app, as the usernames began to appear, I saw the name of my ex-girlfriend's phone (iPhonedeCoralie). I could also see her phone's MAC address, and the IP address. The problem is that she and her phone are not in my house (she lives in another village, 5-6 kilometers away). She is not even close to my house.

Why and how can her phone be connected to my Wi-Fi if she and the phone are not even physically near my house? And is there a way to track the phone's location to see where it is?

Patrick Jaunin
  • 21
  • 2
  • 3
    Change your wifi password. She may (although unlikely) be connected to your wifi from outside your house. As for trying to track her phone, probably not a good idea. Change your password and your ssid and move on with your life. – TheJulyPlot Sep 05 '15 at 13:42
  • Mountain radio propagation may be to blame (unlikely) . – Deer Hunter Sep 05 '15 at 13:49
  • 3
    I'm not sure how this "Netcut" works but what if her device's MAC address was just in your computer's ARP cache ? Pinging the IP would confirm whether the device is actually here or if it's just a stale ARP cache entry. – André Borie Sep 05 '15 at 13:50
  • 8
    @TheJulyPlot: Most probably it is not really her phone, but some neighbour spoofing its MAC address in order to access the WifiNetwork. In all case, in this situation the password change remains the wisest thing to do, but be sure to choose a password long enough. – WhiteWinterWolf Sep 05 '15 at 13:52
  • 1
    She has left, but she placed her phone on the bookshelf making a video of you. Have you heard of the Truman Show? – ott-- Sep 06 '15 at 21:19

3 Answers3

1

enter image description here

Without understanding how NetCut works for certain, we have to account for the possibility that it's not actually "scanning" your network for this information. It could very well just be querying your system or infrastructure devices, which may still have this information cached from the last time your girlfriend's phone was nearby.

Try turning off everything - home gateway, router, switch, access point (may be all-in-one), and PC. Unplug it all and let it sit for a minute without any power. (For some devices, including newer home gateway systems - especially those with VoIP - this may also require removing a battery.) Then boot the devices one at a time, in sequence following the connection from your ISP (start with the home gateway) to the furthest end (your PC), waiting for each device to come fully online and stabilize before booting the next.

After your computer has booted, don't run NetCut just yet. Open an elevated command prompt, and run the following commands:

ipconfig -release
ipconfig -renew
ipconfig -flushdns
netsh interface ip delete arpcache

Then, log on to your router and look around for its list of connected devices. There should be a refresh/flush option somewhere in there - hit that and wait for it to finish. (Note: This should be a button that just resets/flushes the discovered devices list - not a "factory reset" or similar operation.)

Then try NetCut again.

Iszi
  • 27,127
  • 18
  • 101
  • 163
0

When confronted with strange information that conflicts with other more well established information, always try to find a 2nd source of information to confirm or deny which is right.

I'd suggest simply running a wifi sniffer like Kismet, and seeing if the suspect MAC address appears to be sending/receiving traffic. If it is, then there's SOME device nearby with that Mac address. It still could possibly be a neighbor spoofing, but that's unlikely.

Most likely scenario is that NetCut is just wrong, and doing something unexpected.

Steve Sether
  • 21,620
  • 8
  • 51
  • 78
0

She could be lurking in your area for the free wifi, or to eavesdrop on the network - if she is so inclined. Most likely, as is the case with my router, it stores resolved addresses in its arp-cache for a configurable amount of time. You should be able to flush the cache from the routers web server config page. As someone else mentioned in the comments, it's also possible for some network cards to identify as being attached to other devices.

voices
  • 1,779
  • 8
  • 23
  • 36