HeyImJason
Interesting question.
There are a number of challenges here. And for the most part, it looks like "John" is pretty secure in his strategy if he follows certain guidlines. Then, there is always the one off that can snag him.
First, let's review what he is doing. His home has a standard router with a hardline. He does all of his legitimate stuff from there. Then he disconnects his legitimate connection, plugs in his wireless, and he turns into Neo, riding on someone elses unsecured wireless network.
When he rides on someone elses (Jim's) network, all traffic (legitimate and rogue) has to go through Jim's router which is running Network Address Translation. So what the ISP sees is one IP address that their DHCP has leased to the front end of Jim's router (actually, it's to Jim's modem and the modem has it's own private network that leases an IP address to the front end of Jim's router) and that IP/modemMAC is noted at the ISP. That is what they can track.
So if "John" is riding on "Jim's" network, "John" is a part of "Jim's" network and all traffic is seen as going to the front end (the modem) of Jim's network. The ISP has no way of knowing what individual machine is requesting or getting traffic because of Network Address Translation. They have no insight into the IP allocation on the backside of Jim's router.
Now Jim can log into his router and check his logs, but that will only tell him if there is a rogue IP address on his network that doesn't match his machines (I'm assuming here that Jim is running around his house to see which machines are logged in).
He can see what activity has hit his DHCP, what IP addresses have been requested, which of the internal IP addresses have requested it and even which MAC addresses have made the request.
But he has no way of pinpointing the owner of the MAC address.
So here is something for your friend John: Is he doing this from a laptop or a desktop? And how many wirless adapters does he have?
If John is doing this from his laptop, then he is free to roam around the neighborhood and hit any wireless network he can gain access to. Chances are good that quick hit and runs will remain unknown for a long time.
On the other hand, if he is using his desktop (aka stationary) he is creating a pattern on a few accessible wireless networks leaving him open to a trap (unless his has a pocket full of wirles adapters that he can use to change MAC addresses or he can use one wireless adapter and spoof a MAC address).
As pointed out in one of the other posts, some of these "Information sites" can only gather so much information (information contained in you browser), some stuff left behind in tracking cookies and whatever the ISP has on the leased IP address. But the ISP Leased IP address is an artifact of Jim's network, not of John's machine.
The only info given up by John's machine is stuff like OS type, browser type, screen resolution, etc... but nothing that says "Hey, this is John's machine" unless he is actually required to put in information identifying him (as in logging in to some sales and marketing websites that have paid memberships like the Mckinsey Quarterly). Then his identifying information can be linked to the IP address that the ISP has on file.
But Jim has no idea of how to get that information and I don't think Mckinsey or the ISP is going to release something like that unless the FBI gets involved.
Now, if I were Jim and I were slightly software savvy and extremely devious, there is a way to find out who is logging into my network.
Let's say Jim is software savvy and discovers someone on his network (for the moment, let's ignore the fact that he's left his network completely open for everyone to use). Jim could go to his closet, pull out one of his "retired" wireless routers and set it up with an open network while encrypting and closing down his "real" network.
Then Jim would take one of his retired machines or maybe even an old laptop, connect it to the front end of the router (the WAN side), install the Apache webserver, create a decent and interesting website and poison it with some downloadable malware (trojan horse, rootkit or somethig small that will install a keylogger, virus or anything that is capable of collecting and sending out information on a system).
Now Jim has two wireless networks, one hidden and one advertised and open for anyone to use, only this one is a closed system with a trap on the inside waiting for unsuspecting users.
The idea isn't new. These arrangements are called "honeypots" (using something sweet and enticing to attract unsuspecting critters) and system administrators and network administrators in large organizations make use of them to divert network intruders long enough for tracking and identifying.
So for the typical user, it's almost impossible to determine who is accessing their network. But there is that small percentage