[techtalk] MAC addr from Cable Modem

[Courtney M Eckhardt]

In message <3885F0D4.FC9C2E1C at usa.net>, Michael Carson writes:
>    Aren't cable modems effectively bridges, repeating everything they see on
>one interface to
>the other?  As such it wouldn't necessarily *have* a MAC address... (not that
>is doesn't, but it
>might not)
>
>C.


Cablemodems do in fact have MAC addresses.

In message <Pine.SUN.3.96.1000119021228.24770F-100000 at grendel.csc.smith.edu>, s
rl writes:
>To the original poster:
>
>are you trying to make the cable modem your gateway to the net for all the
>computers? if so, here's what you want:
>
>            -------
>--cable----->eth0 |      ---->box4
>            |     |      |
>            |BOX1 |      | ---->box3
>	    |     |      |/
>            |eth1 <------hub----->box2
>            -------
>
>you make box1 either a router or an IP masquerading box, depending on
>whether your cable modem provider gives you multiple IPs.
>Finding your MAC address on box1 requires only ifconfig.

The explanation above is correct, as far as it goes.  A possible way
to find the MAC address of the cablemodem itself is to log into the
machine represented by box 1, above (you may have to do this as root,
I'm not sure) and run tcpdump, telling it to listen to your local
network on the ISP (as opposed to the local network set up with IP
masquerading or by routing by box 1, if there is any).  Tcpdump
probably requires an option or two for this, as it may default to
listening to the local network that box 1 sees through eth1 rather
than the ISP's local network seen through eth0.  I don't know what
these options might be offhand, but my boyfriend figured out what they
were from the manpage, so I'll refer you there. :)

The idea with running tcpdump on the local section of the ISP's
network is that you can see the arp requests, which will be (roughly)
in the form of "who-is foo tell bar" with foo being an IP address and
bar being the MAC address of the requesting party.  Admittedly, this
method involves an awful lot of noise, since you only want one small
datum... and matching up your IP with your MAC address would probably
take until some machine cared about you and made an arp request...so I
think the method I would have to reccomend is talking to your ISP, as
they will almost certianly know. :) 

(I am pretty sure your ISP knows because Mediaone (our ISP) sent us
mail recently warning us in loud hyperbole that our email address with
them was the same as the hostname that we had with them and that this
was a potentially severe spam hazard and that unless they heard from
us in two weeks they would automatically change the hostname for our
IP with them to the MAC address of our cablemodem. :)

(If you're interested in how I know that you can see the MAC addresses
of the cablemodems fly by... well, routing failed totally for our
segment of Mediaone one night for several hours, and to confirm that
it wasn't our poor battered NAT box or our hub or a collective
hallucination my boyfriend logged into our NAT box and listened to the
Mediaone subnet with tcpdump... and there was nothing but unanswered
arp requests.  Funny that, when all of the routers are down. :)

Courtney

************
techtalk at linuxchix.org   http://www.linuxchix.org