So you are saying that another user on a different modem would not get the same IP address if they used the same MAC? i.e. the scope of the MAC used for DHCP is per account?
My upgrade experience shows that the modem itself is not part of the calculation, since I got the same address back after switch from the old Ambit 256 to the Superhub, but if the scope for the MAC is limited to the account then no, I guess there isn't a security hole.

As was said the IP is issued according to the MAC of the router or PC connected to the modem and not the actual modem.

I initially thought you'd said you had the same IP with the Superhub in normal mode as you'd had with your old modem/router and that certainly shouldn't happen (at least not immediately but could just by chance once the IP had been released from its association with your old router). Putting the Superhub in modem mode presents the CMTS with your old router MAC once again so it got the same IP again as the old reservation hadn't expired.

Once an IP you have been using has been released then it will get allocated to somebody else eventually. Why do you see that as a security loophole?

I have no idea what would happen if somebody cloned your router MAC while connected to the same CMTS but I ceratinly can't believe they would get the same IP allocated as you. If it was a different CMTS then I don't expect any error would get registered.

In reply to a post by Daemon66:

So you are saying that another user on a different modem would not get the same IP address if they used the same MAC? i.e. the scope of the MAC used for DHCP is per account?
My upgrade experience shows that the modem itself is not part of the calculation, since I got the same address back after switch from the old Ambit 256 to the Superhub, but if the scope for the MAC is limited to the account then no, I guess there isn't a security hole.

If there are two devices with the same MAC address on a single DHCP scope it causes problems, the two devices will knock each other offline repeatedly.

This isn't a security risk any more than the ability to clone a MAC address on any shared media network. There are extremely dynamic IP address ISPs where addresses roll over every few days, it's not an issue unless hosting services at home, in which case dynamic DNS should be used on residential cable as it's a sticky, not static, IP service.

In reply to a post by Ignitionnet:

If there are two devices with the same MAC address on a single DHCP scope it causes problems, the two devices will knock each other offline repeatedly.

I have no idea how the VM network works internally but if you had two devices with the same MAC on the same Ethernet hub then both devices will receive the same IP from the DHCP server and both will receive all the data intended for each other. They certainly would not 'knock each other offline' since the DHCP server and everything else will think they are the same device.
In other words the potential security risk is probably about the same as having an Open Wi-Fi connection, anyone can use it for nefarious purposes, anyone can see the traffic and since the IP is registered on my account I'll be the one getting the infringement notices.
Of course, as previously said, there may be no risk if the scope of the MAC is limited to the account somehow and my guess is that this must be the case or VM would have no way of tracking who had what IP when, as they would be required to, to satisfy a court order.

It doesn't work that way with cable. When there are 2 devices with the same MAC address on the same scope they argue over the IP addresses.

Remember that cable uses DHCP helpers, the routers you connect to, which keep track of MAC address assignments, and indeed will query the DHCP server for information when they need it. When a new device takes the same MAC address of an existing device on the scope it then receives all its' traffic, the old entry is ignored. The CMTS knows which cable modem the DHCP discover came from and differentiates.

The only way to steal traffic is to use a modified cable modem that decodes the entire channel throughput.

Edited by deleted (Mon 18-Jun-12 16:27:03)

In reply to a post by Ignitionnet:

The CMTS knows which cable modem the DHCP discover came from and differentiates.

Many thanks, that's the bit I didn't know.

Surely in the early days of Blueyonder, the IP address was 'tied' to the cable modem's MAC address, but some years ago this was changed so that the IP address was 'tied' to the MAC address of the router, or the PC if there was no router?

At least that was what the Virgin Media engineer told me!

So that might mean the the IP address might stay the same if the old Scientific Atlanta or Motorola cable modem was replaced by a brand-new shiny "Super" Hub, in modem mode.

In reply to a post by JohnGray7581:

So that might mean the the IP address might stay the same if the old Scientific Atlanta or Motorola cable modem was replaced by a brand-new shiny "Super" Hub, in modem mode.

Not might, will.

Well, it didn't for me!

On my much-loved Scientific Atlanta I had 82.33.27.138,
but, once activated, on today's shiny Super Hub (modem mode) I have 82.40.162.xxx

In reply to a post by John_Gray:

Well, it didn't for me!

On my much-loved Scientific Atlanta I had 82.33.27.138,
but, once activated, on today's shiny Super Hub (modem mode) I have 82.40.162.xxx

Well yes, you moved from the DOCSIS 1 to the DOCSIS 3 network. Moving DOCSIS 3 to DOCSIS 3 you'll keep the same IP. Nothing to do with client MAC addresses the configuration files for the two devices are different, the Superhub lives on a different network to the SA modem in your area.

You moved from Staverton 2, a Cisco uBR 7246VXR, to Staverton 13, a Motorola BSR. Address ranges are per CMTS, so you're the exception that proves the rule.