cable internet mac spoofing

[phishphreek]

My buddy called with a problem with his router.
Linksys vpn 4port router. (not sure of exact model)

Everything worked fine before last weekend... "the router just stopped working"...

I'm in the area... so I stop by to troubleshoot.

He could get his PC to access the internet without the router... but not with it.

He could get other PCs to access the internet with the router... but just not one PC.

I look at the config of the router and see its not getting a WAN ip. The MAC had been reset to 00-00-00-00-00-00. So, I click on the clone mac address so it can access the internet. I copy down the MAC that it cloned. I look at the PC that can't access the internet and notice that they have the SAME MAC address. Both devices having the same MAC were causing a conflict.

Why would it clone that PC's mac when its just a host on the network?
Shouldn't it clone the MAC of the cable modem?

I put a second NIC in the PC and all was fine...

Just had me a bit confused. But I rarely work with cable... (Comcast)

Any insight?

[Tiger Shark]

Comcast isn't consistent with this and it would also depend upon the cable modem they have issued you. They gave me a "SurfBoard" modem one time after an upgrade and it would not, under any circumstances allow me to place anything other then a computer on the other end of the cable, thus my linksys was a doorstop. I bawled them out, got it changed to a different make of modem and away I went.

With regard to the MAC spoofing, I have people within a mile or so of my house that require the linksys to spoof the MAC address of a PC previously connected while I actually don't need to at home. Comcast often seems to upgrade the firmware of the modems serruptitiously at night resulting in MAC spoofing is required I have reached the stage where I set up MAC spoofing anyway for friends since it saves me getting a call later saying that their cable doesn;t work....

I'm not sure I'm entirely understanding the router config part but I can assure you that different modems handle the cable connection and the connection back to the customers device quite differently. For the most past the connection is pretty transparent but some of them make you jump through a load of silly hoops.

Thinking back though, I see less of the hoops today than I did a year or so ago. I know I bawled them out more than once about preventing people from using firewalls/routers and I think their motivation back then was to sell additional IP's. I think that strategy may have changed since they have realized that making it too difficult for the average user to adequately protect themselves is more contentious than not getting the $5/month for an additional IP address.

[phishphreek]

A firmware upgrade makes sense. Too bad you can't get access to that modem to find out...

I'm not sure of the make/model... I didn't take note.

I wonder if they did that because he was running a web server behind it...

He doesn't get many hits... but just has it up for sample webpages he does for clients.

Maybe I'll get him to change the webserver to operate on different ports.

Thanks for the insight.

[Zonewalker]

phish - regarding the MAC spoofing many routers allow it so that you can set up a home network. For example - officially I am supposed to set up a seperate cable for each computer I have connected tot he net - clearly this is damn expensive. The router allows me to take on the MAC of the PC which I have registered with the cable company - thus fooling the cable company that I only have one PC connected to the cable when in fact I have anything up to 4 (but currently only 2) connecting. Clearly then the router is supposed to take on the MAC from the registered PC not from the cable modem.

Tiger is right - this used to be common so that cable companies could sell more IP addresses - but with the ever decreasing costs of bandwidth these days this is not so much of a problem as it used ot be. Many cable companies are therefore allowing you to set up home LANs with 5 computers (my cable company for example now allows me to register up to 5 MAC addresses - it used to only allow one to be registered)

I'd go with Tigers suggestion of upgrading the firmware as it sounds like the router has its brains muddled a little - it shouldn't cause a conflict like that just by spoofing the MAC

Z

[phishphreek]

It now makes more sense to me. When he first got his cable, he wasn't using a router.

But, after he got the router it worked fine until last weekend.

Maybe they upgraded the firmware in the modem...

I'll suggest that he upgrade the firmware in the router.

However, we have fixed the problem. I just put in another NIC and disabeld the onboard he was using before. Now everything works just fine.

Very strange indeed.

Thanks for the suggestions though.