On my router at home, I use a MAC address whitelist to restrict access for wireless connections. The only wireless connections are my brother in law's laptop, my XBox, and PS3, so I don't care about anyone snooping on those.

Is that a good way to keep people off of my home network?

Sure, its a great step. And for what its worth, switch to WPA from WEP if you havent so far, use a non-standard frequency, and disable the public advertisement of the network name.

Do I still need to run WPA or WEP if I'm using a whitelist? A majority of my wireless traffic is to the X Box, for both games and Netflix videos. I was trying to keep as little overhead as possible on that lag sensetive traffic.

Its a risk assessment question really. I can spoof mac addresses in under 30 or 40 keystrokes on most popular operating systems, and since there are a finite number of frequencies WAPs broadcast over IIRC, it simply become a question of hours instead of minutes for me to find the one your WAP is broadcasting over, and either advertise myself as your access point to cull MAC addresses or probably just passively monitor the traffic itself and harvest them from ARP transactions and the like.

The thing is, that all sounds fairly exotic and all but there are so many home-spun kits floating around, it seems unlikely that there arent half a dozen out there as we speak that do this exactly. So yeah if you want to be a little paranoid, stick with WPA and drop an ethernet cable to the Xbox to offset the computational expense of encryption, methinks.

Honestly, unless you think someone is trying REALLY hard to snoop or steal your internet connection, this is a waste of time.

Note that it is not automatic that people can snoop on your computer just because they access your router. In most cases, they can't.

I find that MAC address filtering is just a nuisance when you have friends come over and they want to use your internet.

Any standard password protection to your connection is typically fine. In most cases, people will go for the soft target (a router with zero security).

Also change the password on the router as well, the "standard" passwords are well know and can be found on the internet...