A network architecture for blocking access to mobile pay per use Internet services is provided that comprises an Internet Protocol (IP) sniffer that pings the network devices to determine presence of a network device and which further communicates the presence thereof to a server such that access to the Internet services by the network device may be blocked. Generally, the IP sniffer sweeps all possible combinations of addresses in a LINKLOCAL network to detect the addition of a network device on a port and reconfirms for a period of time to verify the presence thereof. Once the network device is confirmed, a signal is transmitted to the server such that the sharing violation may be further investigated or terminated. The IP sniffer is preferably in the form of a module within a seat electronics box of a mobile platform.