3 ms·

Who decides if it's the ISP's problem? What if it's "Both"? About 20 years ago I got escalated to high-tier Comcast support for an issue that turned out to be

Who decides if it's the ISP's problem? What if it's "Both"? About 20 years ago I got escalated to high-tier Comcast support for an issue that turned out to be a little of A, a little of B: Comcast (Might have been @Home, based on the timing) required that your MAC address be whitelisted as part of their onboarding process. Early home routers had a "MAC Address Clone" feature for precisely this reason. At some point, the leased network card got returned to Comcast. Our router continued to work just fine... until about a year later, when the local office put that network card into some other customer's home. We started getting random disconnects in the middle of the day, and it took forever to diagnose, as the other customer was not particularly active with their internet use. Whose fault was it? Ours, for ARP Spoofing? Theirs, for requiring the spoofing?

saagarjha 6y ago
How did you even manage to figure this out? I’ve never gotten anyone on the phone who could possibly help in a situation like this.
- GauntletWizard 6y ago
  Wireshark and escalation to a competent tech. I believe they saw weird traffic from their DHCP server, and we were able to attach an ethernet hub (Not switch, a 10-Base-T Hub that repeated the signal on each port) along with a laptop that was running Ethereal (Before the name changed! How long ago that was now) and see the arp packets fighting.
  - jlgaddis 6y ago
    > I believe they saw weird traffic from their DHCP server, ... That makes sense. When the cable modem issued a DHCP request, the CMTS would have been configured to insert some additional information (a "circuit-id") into the DHCP request as it relayed it to the DHCP server. The short version is that the "competent tech" looked at the logs from the DHCP server, which would have showed that the "same" cable modem (i.e., MAC address) was physically connected to either 1) two different CMTS boxes or 2) two different interfaces of the same CMTS. How would one cable modem be physically present in two different locations at the same time? Obviously, it wouldn't. At that point, either 1) there are two cable modems with the same burned in address or 2) one of the two cable modems is cloning/spoofing its MAC address. Which one of those is more likely? (If you're interested in the details, try "DHCP Option 82" as your search term.)

saagarjha 6y ago

How did you even manage to figure this out? I’ve never gotten anyone on the phone who could possibly help in a situation like this.

GauntletWizard 6y ago
Wireshark and escalation to a competent tech. I believe they saw weird traffic from their DHCP server, and we were able to attach an ethernet hub (Not switch, a 10-Base-T Hub that repeated the signal on each port) along with a laptop that was running Ethereal (Before the name changed! How long ago that was now) and see the arp packets fighting.
- jlgaddis 6y ago
  > I believe they saw weird traffic from their DHCP server, ... That makes sense. When the cable modem issued a DHCP request, the CMTS would have been configured to insert some additional information (a "circuit-id") into the DHCP request as it relayed it to the DHCP server. The short version is that the "competent tech" looked at the logs from the DHCP server, which would have showed that the "same" cable modem (i.e., MAC address) was physically connected to either 1) two different CMTS boxes or 2) two different interfaces of the same CMTS. How would one cable modem be physically present in two different locations at the same time? Obviously, it wouldn't. At that point, either 1) there are two cable modems with the same burned in address or 2) one of the two cable modems is cloning/spoofing its MAC address. Which one of those is more likely? (If you're interested in the details, try "DHCP Option 82" as your search term.)