4 ms·

It's so easy to change a MAC address though. Also in the past (different cable provider) they had it MAC authorised so I couldn't use my new modem. But then I

by dalore 9y ago

It's so easy to change a MAC address though. Also in the past (different cable provider) they had it MAC authorised so I couldn't use my new modem. But then I set the new modem to use the MAC of the old one and it worked. So same

blackflame7000 9y ago
Yea but if you change your MAC address to an unregistered one (what happened when you connected a new modem) you won't get internet and if you change it to a duplicate one your account will be suspended (unless you're doing a swap like in your case). You can't have 2 modems using the same MAC simultaneously.
MertsA 9y ago
It's not as easy as it sounds. We're talking about the MAC address of the modem itself. In any current DOCSIS network you're going to need to use BPI+ which encrypts everything between the modem and the CMTS as well as authenticates the modem itself. Basically there's a cert on the modem that's signed by the manufacturer and the manufacturers cert is added to the CMTS. In short you can't just impersonate a modem and even just rooting a modem and getting at that certificate is difficult enough, not to mention once you do that you can only impersonate the modem that you've already rooted.
- milankragujevic 9y ago
  I'm not an expert by any means, but for VDSL2, I think you only need to get the DSL login data (username and password) and then your modem will work. I used a friend's login details when I bought a different modem and my provider didn't give me my DSL login. But it's all linked to the physical port on the DSLAM so that you cannot get faster speeds or anything like that.
  - dfox 9y ago
    The authentication in DSL is essentially an backward compatibility hack. Original motivation for that was compatibility with Radius/Diameter based AAA systems of ISPs (and to lesser extent the fact that the link the looks from both sides like faster dialup connection). Today it is used mostly because it is default. In many cases ISP (or even the underlying telco) either uses one login/password for all customers or simply accepts anything. All DSL lines have same L2 interface as ATM and thus there is no authentication. How the authentication works is that PPP gets tunelled through this, either by running PPP directly on AAL5 (PPPoA), or more commonly and somewhat nonsensically by tuneling by wrapping PPP in ethernet frames that are then transfered inside AAL5 channel (PPPoE, or more correctly PPPoEoA). Interestingly this is usually used only on the first virtual channel (ie. the "Internet" one) and not on the additional channels that you typically get today (IPTV, VoIP, free hotspots...), these additional channels are usually straight Ethernet over AAL5 with the modem behaving like simple L2 bridge (often these channels form relatively large broadcast domains that are typically NATed to the Internet). [Edit:] In contrast, DOCSIS variants for Internet over CaTV are derived directly from IEEE 802 family of technologies and there are no telco-style ATM/X.25/whatever protocols in between. Good first approximation is that the DOCSIS segment handled by one CMTS behaves like one big ethernet switch. But beacuse of the nature of shared medium, data on the coaxial cable is encrypted as otherwise it would be trivial to eavesdrop on anyone else on the same segment. The encryption even involves PKI to mutually authenticate modem and CMTS. On DSL there is clear physical interface on the network side, that can be turned on or off, shaped and metered which is everything that the ISP cares about from the charging and authentication PoV. CaTV does not have anything like that and thus there has to be relative complex authentication and confidentiality mechanism (that is, somewhat paradoxically, usually completely invisible to the end user).

by dalore 9y ago

blackflame7000 9y ago

Yea but if you change your MAC address to an unregistered one (what happened when you connected a new modem) you won't get internet and if you change it to a duplicate one your account will be suspended (unless you're doing a swap like in your case). You can't have 2 modems using the same MAC simultaneously.

MertsA 9y ago

It's not as easy as it sounds. We're talking about the MAC address of the modem itself. In any current DOCSIS network you're going to need to use BPI+ which encrypts everything between the modem and the CMTS as well as authenticates the modem itself. Basically there's a cert on the modem that's signed by the manufacturer and the manufacturers cert is added to the CMTS. In short you can't just impersonate a modem and even just rooting a modem and getting at that certificate is difficult enough, not to mention once you do that you can only impersonate the modem that you've already rooted.

milankragujevic 9y ago
I'm not an expert by any means, but for VDSL2, I think you only need to get the DSL login data (username and password) and then your modem will work. I used a friend's login details when I bought a different modem and my provider didn't give me my DSL login. But it's all linked to the physical port on the DSLAM so that you cannot get faster speeds or anything like that.
- dfox 9y ago
  The authentication in DSL is essentially an backward compatibility hack. Original motivation for that was compatibility with Radius/Diameter based AAA systems of ISPs (and to lesser extent the fact that the link the looks from both sides like faster dialup connection). Today it is used mostly because it is default. In many cases ISP (or even the underlying telco) either uses one login/password for all customers or simply accepts anything. All DSL lines have same L2 interface as ATM and thus there is no authentication. How the authentication works is that PPP gets tunelled through this, either by running PPP directly on AAL5 (PPPoA), or more commonly and somewhat nonsensically by tuneling by wrapping PPP in ethernet frames that are then transfered inside AAL5 channel (PPPoE, or more correctly PPPoEoA). Interestingly this is usually used only on the first virtual channel (ie. the "Internet" one) and not on the additional channels that you typically get today (IPTV, VoIP, free hotspots...), these additional channels are usually straight Ethernet over AAL5 with the modem behaving like simple L2 bridge (often these channels form relatively large broadcast domains that are typically NATed to the Internet). [Edit:] In contrast, DOCSIS variants for Internet over CaTV are derived directly from IEEE 802 family of technologies and there are no telco-style ATM/X.25/whatever protocols in between. Good first approximation is that the DOCSIS segment handled by one CMTS behaves like one big ethernet switch. But beacuse of the nature of shared medium, data on the coaxial cable is encrypted as otherwise it would be trivial to eavesdrop on anyone else on the same segment. The encryption even involves PKI to mutually authenticate modem and CMTS. On DSL there is clear physical interface on the network side, that can be turned on or off, shaped and metered which is everything that the ISP cares about from the charging and authentication PoV. CaTV does not have anything like that and thus there has to be relative complex authentication and confidentiality mechanism (that is, somewhat paradoxically, usually completely invisible to the end user).