> I believe they saw weird traffic from their DHCP server, ... That makes sense. When the cable modem issued a DHCP request, the CMTS would have been configur

> I believe they saw weird traffic from their DHCP server, ... That makes sense. When the cable modem issued a DHCP request, the CMTS would have been configured to insert some additional information (a "circuit-id") into the DHCP request as it relayed it to the DHCP server. The short version is that the "competent tech" looked at the logs from the DHCP server, which would have showed that the "same" cable modem (i.e., MAC address) was physically connected to either 1) two different CMTS boxes or 2) two different interfaces of the same CMTS. How would one cable modem be physically present in two different locations at the same time? Obviously, it wouldn't. At that point, either 1) there are two cable modems with the same burned in address or 2) one of the two cable modems is cloning/spoofing its MAC address. Which one of those is more likely? (If you're interested in the details, try "DHCP Option 82" as your search term.)