[SOLVED] Router MAC Address

[pezplaya]

I just moved into an apartment the other day, and my roommates have a router which I want to replace with mine (mine has wireless, theirs doesn't). The only problem is, their router is spoofing an MAC address of one of the old roommates computers because that specific MAC address is registered with comcast as the main computer. They lost the username/password for the current router. I need to find a way to get the spoofed MAC address off the router without logging in...

I tried arping 192.168.0.1 (routers ip) and it returns a MAC address. I typed it into my router, and it is unable to get network information from comcast, meaning it didn't work, or it's the wrong MAC address. Would arping return the real MAC address of the router, or the spoofed one?

I guess my question is, how can I figure out the spoofed MAC address of the router without logging in?

[infiniphunk]

Can't you just call Comcast and let them know of the situation? You'd think things would be easier to fix from their end.

[the mitzman]

Chances are that comcast (like many cable companies used to do) restricts to one computer. If they find out there's a router, they may make pez pay more. I doubt that's the case now but whenever I had Bellsouth or Adelphia and had to switch up a router, I would just power down my cablemodem (and unplug it form the wall) and let it sit for a few. Then power up the modem and then once all the lights are solid, plug the new router in.

In the case where they actually record the MAC on the server side, I'd just call and say that you got a new pc and that it isn't working on the cablemodem.

[infiniphunk]

Right on, I never knew that about cable, have always had ADSL here.

[the mitzman]

Yeah, I've had cable for ages. Back in 98 when we first had cable, we just hooked up a simple old Linksys hub and we were receiving multiple external IP's. Then that changed but they didn't lock down by MAC. When I moved out, various providers did things differently but usually what I've experienced is this; the cablemodem was recording the MAC but once it had a full loss of power (usually about 2 minutes being unplugged from the AC outlet), it would clear. Occasionally I had to do a full hard-reset (holding in the reset button, etc).

[pezplaya]

Yes, comcast does restrict to one computer (MAC address). Comcasts deal with routers is, if you have one, they don't offer you any support for it... they want you to pay for multiple IP's. I know when you register for comcast, the MAC address of the computer your register from gets recorded, therefore only that specific computer can be used with the cable line.

Another issue is the account is under an old roommates name that signed up for the service a few years ago... he no longer lives there. Therefore if I call comcast, I probably don't have permission to do anything. We pay the bill, it's just under his name. I guess we should get a hold of him.. if we can find him.. and try to get it changed, that is if nobody has any ideas.

[bwkaz]

Here's a thought, though I don't know whether it'll work or not. ;)

Unplug all the network connections from the router. Then plug its WAN port into your computer. Then ... uh oh.

Well, OK, here's where it gets hard; the router is probably going to want to get a DHCP lease, and since your computer is the only one it can talk to, that means it'll try to get a lease from your computer. If you run Linux on this computer, you can probably just install a DHCP server and have it work (but make sure it doesn't screw up your normal network connection: you'll probably have to assign a static IP to that NIC for the duration of the testing period). Windows, you're on your own. :p

Anyway, if the router will come up and get an IP address on its WAN port, then just ping that address and look in your ARP cache (or look in the DHCP server logs) to get the MAC address. :)

[pezplaya]

Interesting... I should try that and see if it works. Can I use a normal straight through, or does it have to be a crossover? Or that may depend on the modem...

[Mr_B]

If you want to know what MAC your router's wan is spoofing or sending out. Grab a hub and plug your computer and the router only into the hub. Then run ethereal and sniff the traffic. You'll see the mac addy being sent from the router. Problem solved.

[je_fro]

perhaps you could just run ethereal on the interface and then plug that interface into the router...perhaps the mac will be contained in whatever link negotiation they do...

[bwkaz]

perhaps the mac will be contained in whatever link negotiation they do... Ooooh, yeah, that's a better idea. Any traffic that it sends (including DHCP request packets) will have the source MAC on it. :)

(As for crossover or straight-through cable: You'll need a crossover cable unless one port or the other does auto-negotiation of MDI or MDI-X. I doubt that either port will do that, though.)

[pezplaya]

So, ethereal is now called wireshark. I ran it, and it gave me the same MAC address that arping did. Still didn't work when I put it in my router. One strange thing is the MAC address differs from the one written on the router itself by one number. The last octet in the MAC address that arping/ethereal report is 46, the last octet written on the router is 47. All of the other octets are the same. I tried both MAC addresses in my router, still don't get anything from comcast. It's possible that the MAC address isn't spoofed, and comcast just has the routers MAC. Maybe I'm missing something? I haven't tried restarting the modem... Maybe I should try that.

[JRefL5]

Dosen't the Router present 1 MAC to the "local network" and another to the Modem?
I think you need to try the hub, idea or somthing simular. The MAC on the router would be the one it should show to the modem, at least that the case on mine.

[IsaacKuo]

That's right, the MAC address will only be spoofed on the Internet side. That's why everyone is suggesting to connect the computer to the Internet/WAN/"out" side.

[edit added:]
Oh, in case it's not obvious WHY the MAC address is only spoofed on the "out" side, it's because the computer with the original MAC address is usually going to still be around--on the "in" side. You wouldn't want the internal network to see both the router and the original computer with the same MAC address...

[mrrangerman43]

pezplaya

We pay the bill, it's just under his name. I guess we should get a hold of him.. if we can find him.. and try to get it changed, that is if nobody has any ideas.

Here's a thought, if you've been paying the bill up untill now, give comcast a call and have it put in your name.

[je_fro]

Here's a thought, if you've been paying the bill up untill now, give comcast a call and have it put in your name.
Because "stickin' it to da man" is a lot more fun.

[mrrangerman43]

je_fro

Because "stickin' it to da man" is a lot more fun.

But they are already paying for the servise, just not in their name, so in reality if they pay faithfully, comcast gets their money and they are helping the x-roomate get good credit. So I guess they be stickin it to them selves.:rolleyes:

[pezplaya]

But they are already paying for the servise, just not in their name, so in reality if they pay faithfully, comcast gets their money and they are helping the x-roomate get good credit. So I guess they be stickin it to them selves.:rolleyes:


Ya, we like to stick it to the man. haha, that's what being a 'good citizen' is all about :)... but you do have a point.

So I got my router connected to the internet. I plugged the old routers wan port directly into my computer and ran wireshark and got the MAC address. Now everything is working.

Thanks for the help guys :D