Normally the command "rwho" (=remote who) serves this purpose. However, it may be deactivated for security reasons (spoofing). You could also try checking your bandwidth consumption. Fire up 'Activity Monitor' and go to 'Network'. You may want to stop all internet activity for that moment. If there is still significant traffic going on, someone/two/three... is/are leaching.<br><br>