Forum Thread

Someone stole the mac address on my modem :(

Rei 1,445 298 October 6, 2011 at 09:33 AM
I have been having issues with my upload speed for about 2 weeks now where my modems download speed would work normal (22mbps) but the upload speed wouldnt load in any of the speed test or would take a really long time to load and then load like 0.20mbps. Initially I thought Comcast was just crapping out agian and waited to see if the issue fixed itself. It didnt so I called Comcast and they sent a technician over after about 4 days (it was the nearest appointment that they had).

The technician checked the signal and said that the signal was fine and that the issue was that my modem had been cloned so the Comcast server automatically banned the mac address. He showed me around 5 other modems from other customers that he had in his truck that he replaced because of the same problem. He asked me if I wanted to rent a modem from Comcast but I refused because I didnt want to pay a $5 rental fee per month + tax.

The modem that I had was a SB6120 which I purchased back in 2009 from Amazon.com (directly from Amazon) so I know that the seller didnt write down the mac address and screwed me over. The only way for the mac address to have been stolen was from Comcast by a technician or through sniffing for macs from their network.

What I wanted to ask by creating this thread is if there is any way for me to protect myself from mac sniffing when I buy a new modem so the same thing doesnt happen agian when I buy another SB6120.

I tried asking Comcast if they could give me some sort of compensation but they said that all they could do was offer me a discount on my bill for the time that I had issues with my service. I tried pushing to get a free month off by saying that a new modem would cost me $60-$80 which is around the same thing that I pay for my bill every month but the billing rep wouldnt budge.

19 Comments

1 2

Sign up for a Slickdeals account to remove this ad.

#2
The forum at the link below might have someone from comcast that could help you.
https://secure.dslreports.com/for...castdirect
Reply Helpful Comment? 0 0
Joined Jan 2006
L10: Grand Master
11,221 Posts
1,465 Reputation
#3
Quote from Rei View Post :
The technician checked the signal and said that the signal was fine and that the issue was that my modem had been cloned so the Comcast server automatically banned the mac address.
If the modem was banned, how did download work?

Quote :
He asked me if I wanted to rent a modem from Comcast but I refused because I didnt want to pay a $5 rental fee per month + tax.
That is ridiculous! What if it was someone at Comcast taking the MACs? They *need* to clean it up at their end somehow

Quote :
What I wanted to ask by creating this thread is if there is any way for me to protect myself from mac sniffing when I buy a new modem so the same thing doesnt happen agian when I buy another SB6120.
You would need to know where it was sniffed for anyone to answer that. If indeed, that is the problem
Reply Helpful Comment? 0 0
Heifer whines could be human cries
Closer comes the screaming knife
Joined Mar 2004
L11: Monkey's Apprentice
17,188 Posts
2,785 Reputation
#4
There shouldn't be any reason why Comcast isn't attempting to track down the culprit. I don't know why an individual would do this except possibly to cover their tracks, or at least create confusion, if they were unthrottling the modem or doing something shady. Buying another modem will temporarily solve your issue, but there's nothing to stop anyone from doing this again. I would lean on Comcast a little harder to track down the person doing this.

That being said, check to see if your cable modem has a config page and see if you can change your MAC address manually.
Reply Helpful Comment? 0 1
Quote :
Reading comprehension isn't just for school children!
#5
Quote from brbubba View Post :
That being said, check to see if your cable modem has a config page and see if you can change your MAC address manually.
2nd you should be able to, also make sure you secure your wifi network and login to your access point. If you dont someone could have connected to your wifi and went it and pulled off the mac address.
Reply Helpful Comment? 0 0
....


...
#6
Web address for the 6120 should be 192.168.100.1
Reply Helpful Comment? 0 0
Joined Nov 2006
I am not a doll
1,445 Posts
298 Reputation
Original Poster
Pro
#7
Quote from brbubba View Post :
That being said, check to see if your cable modem has a config page and see if you can change your MAC address manually.
I went to the ip address that logs into the Motorola modems (http://192.168.100.1/) but it doesnt let you change the mac address there so I asked Motorola customer support if there was any way that I could change the mac address on my modem but they said that its hard coded into the modem and cant be altered.

Quote from mrbobhcrhs View Post :
2nd you should be able to, also make sure you secure your wifi network and login to your access point. If you dont someone could have connected to your wifi and went it and pulled off the mac address.
It could be possible that someone broke into my router but I had WPA/2 with an admin password on it and a really long randomly generated WPA/2 key. It also wouldnt account for all those other modems that tech had in his truck with the same issue.

Quote from brbubba View Post :
There shouldn't be any reason why Comcast isn't attempting to track down the culprit. I don't know why an individual would do this except possibly to cover their tracks, or at least create confusion, if they were unthrottling the modem or doing something shady. Buying another modem will temporarily solve your issue, but there's nothing to stop anyone from doing this again. I would lean on Comcast a little harder to track down the person doing this.
Yeah im ganna try to call them agian to see if they can do anything better. I tried explaining to them that it wasnt my fault that someone sniffed or stole my mac address from their network or stole it from their computers but they tried saying that they dont keep the customer mac addresses on the computer (which is bullshit because you have to tell them the mac address on the modem to activate the modem so that it will work with Comcast).

I thought about buying one from a store and returning the old one that I had to the place where I purchased the new one but I might just buy a SB6121 since and get a squaretrade warranty on it in case the same thing happens within 3 yrs I could return it to squaretrade. The local Best Buys were sold out of the SB6120 (which they have for $110 in Best Buy vs $80 online for other retailers). Amazon doesnt have the SB6120 in stock, only sold by 3rd party sellers so I guess ill pick up a SB6121 with 1 day shipping.

Quote from vivahate View Post :
If the modem was banned, how did download work?
Dont know, but the tech checked the signal and it was good, he said that other customers called for the same issue and when he replaced their modems their connection worked fine. It looks like a corrupt tech stole a bunch of customer macs to sell fixed cable modems that get free internet to people. That got the people who were paying for the internet blacklisted from the comcast servers though, at least their upload.

Quote from vivahate View Post :
That is ridiculous! What if it was someone at Comcast taking the MACs? They *need* to clean it up at their end somehow
I agree, this is ridiculous that they would let something like this happen to its customers and then refuse to refund people affected the cost of the modem that they blacklist or offer a replacement without a rental fee.

Quote from vivahate View Post :
You would need to know where it was sniffed for anyone to answer that. If indeed, that is the problem
It was most likely sniffed from the node or stolen by a technician.
Reply Helpful Comment? 0 0
Last edited by Rei October 6, 2011 at 01:15 PM
Dont forget to +Rep for useful, informative, or helpful post.
#8
I saw someone posted earlier about Comcast Direct on the DSLReports site. I have used them a couple of times and the tech has always been very helpful with my issues.
Reply Helpful Comment? 0 0

Sign up for a Slickdeals account to remove this ad.

Joined Mar 2004
L11: Monkey's Apprentice
17,188 Posts
2,785 Reputation
#9
Quote from Rei View Post :
It could be possible that someone broke into my router but I had WPA/2 with an admin password on it and a really long randomly generated WPA/2 key. It also wouldnt account for all those other modems that tech had in his truck with the same issue.
I doubt that happened. From the brief research I've done it seems to be a theft of service and/or a hiding your tracks issue. Basically people sniff the cable modem network and then pull MAC addresses and clone them to their local cable modem. This could give them service and could throw off the cable modem company when and if they were trying to track someone down for doing something shady. At this stage you could hope the culprit moves on to a new MAC address after a certain amount of time.

I'm surprised the cable company doesn't do more to combat this as it's a potential theft of service issue.
Reply Helpful Comment? 0 0
Joined Nov 2006
I am not a doll
1,445 Posts
298 Reputation
Original Poster
Pro
#10
I called Comcast agian to see if they could give me a better deal, they said that they would discount my internet to $29.99 for 6 months (from $39.99 that im paying now) but they cant replace the modem since it isnt owned by Comcast. The customer service agent said that they can only replace Comcast owned equipment.

Oh well at least $60 off my bill over 6 months is better then nothing, the previous tech only wanted to give me a discount for how long my internet connection was having problems (2 weeks). This time around though I will get a SquareTrade warranty for my modem in case the same thing happens agian when the modem is out of the store return policy time frame that way I could return it to SquareTrade anytime within 3 years from the purchase date.

It kind of sucks now that my SB6120 wont work for me anymore though, it seems like a waste... I wonder if I can sell it online or something and someone else could use it or if it will still be banned on the Comcast network for other states.
Reply Helpful Comment? 0 0
Last edited by Rei October 6, 2011 at 01:41 PM
Joined Jan 2006
L10: Grand Master
11,221 Posts
1,465 Reputation
#11
Quote from Rei View Post :
It kind of sucks now that my SB6120 wont work for me anymore though, it seems like a waste... I wonder if I can sell it online or something and someone else could use it or if it will still be banned on the Comcast network for other states.
I find that *totally* unacceptable. You've done *nothing* wrong here.

Can you give this a try? (don't know if it works for 6120s)... at the 'configuration' part of the modem page click on "reset all defaults"... wait 10 seconds and then click on "restart cable modem". Then watch the logs (keep hitting the page) until you've downloaded the config file.

See if that gets you back temporarily
Reply Helpful Comment? 0 0
Joined Aug 2005
L10: Grand Master
16,562 Posts
3,123 Reputation
#12
Have you asked Comcast to remove the ban?
Reply Helpful Comment? 0 0
Joined Nov 2006
I am not a doll
1,445 Posts
298 Reputation
Original Poster
Pro
#13
Quote from vivahate View Post :
I find that *totally* unacceptable. You've done *nothing* wrong here.

Can you give this a try? (don't know if it works for 6120s)... at the 'configuration' part of the modem page click on "reset all defaults"... wait 10 seconds and then click on "restart cable modem". Then watch the logs (keep hitting the page) until you've downloaded the config file.

See if that gets you back temporarily
I tried that but it still keeps the same mac address on the modem. The mac address on the modem cant be changed, only hacked modems can change their mac address via the hacked firmware.

Quote from kakomu View Post :
Have you asked Comcast to remove the ban?
I tried but they said there wasnt anything they could do about it, the system bans the mac automatically if it sees two modems connected with the same mac address.
Reply Helpful Comment? 0 0
Joined Jul 2007
L10: Grand Master
16,630 Posts
993 Reputation
#14
MAC address is supposed to be a unique, hard-coded number in every network device. It's supposed to be unchangeable because no two devices in the world are supposed to have the same MAC address. You guys are probably thinking of the "MAC Address Clone" feature of routers, which is used so that the router can be put behind the cable modem, which used to expect to support only one device, your PC. Cable modems have not needed the Clone MAC address feature for a long time.
Reply Helpful Comment? 0 0
Joined Jan 2010
Hello, My Name is Mike!
1,488 Posts
325 Reputation
#15
Wait a minute, doesn't a cloned modem MAC address only work on the LOCAL NODE it is pulled from?

Meaning, whoever cloned the Mac address, has to be local to the OP, and on the same node....

Which means Comcrap can sniff it, and find it, then you go after the thief legally by filing a police report.
Reply Helpful Comment? 0 0
Page 1 of 2
1 2
Join the Conversation
Add a Comment
 
Copyright 1999 - 2016. Slickdeals, LLC. All Rights Reserved. Copyright / Infringement Policy  •  Privacy Policy  •  Terms of Service  •  Acceptable Use Policy (Rules)  •  Interest-Based Ads
Link Copied to Clipboard