Apple - Show Active Connections to "Internet Sharing"

You can try arp on the command-line:

NAME

arp -- address resolution display and control

DESCRIPTION

The arp utility displays and modifies the Internet-to-Ethernet address translation tables used by the address resolution protocol (arp(4)). With no flags, the program displays the current ARP entry for hostname. The host may be specified by name or by number, using Internet dot notation.

E.g. for internet-sharing from Ethernet to Airport I use:

arp -i en1 -a

This will list all clients connected via WLAN.

InternetSharing does log which address gets a DHCP lease within:

/var/log/system.log

Technically it is the bootpd daemon which does take care of this part of the network access.

You can track who is getting access to your network now with this command:

tail -f /var/log/system.log | grep 'bootpd.*\[en.\]'

and for Mavericks, Yosemite & El Capitan:

tail -f /var/log/system.log | grep 'bootpd.*\[bridge.\]'

You can display who connected and when to your network with this command:

grep 'bootpd.*\[en.\]' /var/log/system.log

and for Mavericks, Yosemite & El Capitan:

grep 'bootpd.*\[bridge.\]' /var/log/system.log

If you need to track it further in the past, the command is:

bzgrep 'bootpd.*\[en.\]' `ls -tr /var/log/system.log.*.bz2`

and for Mavericks, Yosemite & El Capitan:

bzgrep 'bootpd.*\[bridge.\]' `ls -tr /var/log/system.log.*.bz2`

Finally if you'd like to immediately distinguish in these logfiles known devices from uninvited ones, the method is to fill the configuration file of bootpd which is:

/etc/bootptab

with all known MAC addresses.