Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently my i-connection started to get laggy. Sometimes it disappears completely.

ISP told me that someone steals my internet. Someone has managed to sniff my MAC address, kick me out and surf web in my place.

So... I'm curious - how it's possible to steal MAC address and what makes that mystical thief to be more privileged that when he uses i-net I lose mine (this technique would be especially handy while I'm waiting on ISP)?

Are there any defense against this?

Or my ISP just lies to me?

P.s. It's not wifi.

This is how it looks like: alt text

  • I'm living in apartment no 14.
  • Neighbor i trust lives in apartment no 13
  • Neighbor i don't know lives in apartment no 7
  • Wtf is where 1 cable magically turns into 2 cables

Forgot to mention - thing that makes 'theft of internet' more believable is that i-net shows up at night when everybody sleeps. And ISP said that there was internet traffic when my pc was turned off.

share|improve this question
Are you sure it's a switch and not a hub? – Keith Stokes Apr 4 '10 at 4:01
@Keith yes, I'm sure about that. – Arnis L. Apr 4 '10 at 12:48
up vote 3 down vote accepted

If you're on a DSL line, then it's extremely difficult for someone to steal your internet connection without getting on your home network, since the connection between you and your ISP is a point-to-point link.

However, if you're on cable, it's surprisingly easy to "steal" someone else's Internet -- about as easy as it is to steal cable. Assuming, that is, that the following are true:

  • The ISP doesn't have appropriate countermeasures in place
  • The "thief" is on your local cable broadcast network
  • The "thief" has a cable modem that allows you to set your upstream MAC address (not common)

Since cable internet is a "shared medium" network, the cable modems simply put traffic onto one single shared network, relying on MAC addresses to differentiate the traffic between each other. The size of your shared network is determined by your cable company, but it's usually limited to a single neighborhood or housing structure. If two devices on the network use the same MAC address, they can be indistinguishable from each other.

Besides allowing the "thief" to use on your account, this situation will also cause a degradation in service as the two devices will mistakingly acknowledge eachother's traffic or reset eachother's connections.

share|improve this answer
This sounds like exact description of what's happening. – Arnis L. Apr 4 '10 at 1:29

THe ISP most likely lies.

The MAC address is only relevant on the physical link between routers - once you hit a router, it is irrelevant (and the IP address takes over).

MAC addresses are supposed to be unique, but are not always - and can be entered in the driver, so they may not be. Whoever wins depends on flooding the ARP protocol level - the switch/router will use the last ARP announcing the IP-address / MAC address mapping.

But unless you are on a link that is a hugh significant ethernet segment, the ISP just lies.

share|improve this answer
Is there any way to actually be sure about that? One thing i forgot to mention - i can access switch physically. – Arnis L. Apr 3 '10 at 23:34
'arp -a' on command line shows ~60 entries. Does that mean ethernet segment is big enough and thief might exist? :/ – Arnis L. Apr 3 '10 at 23:46
Cable modems have MAC addresses too. In fact, any 802.X devices has a MAC address. The ISP may be right. – tylerl Apr 4 '10 at 1:27
@tylerl but the questions remains - is there any way how I can check that out & are there any ways how to defend myself? – Arnis L. Apr 4 '10 at 1:30
@Arnis L. -- No there is nothing you can do about this. It's the cable company who's dropping the ball here. This is their network and their responsibility. They owe it to you to fix it, since you're not getting the quality of service you're paying for. Have them change your MAC address (probably means give you a new cable modem) and hopefully the attacker will pick someone else instead. – tylerl Apr 4 '10 at 1:49

Yes, please edit the diagram to show where the connection goes out of the house. What type of line is it: cable, DSL, or actual ethernet (cat5/cat6)?

If the diagram is correct then there are 2 MAC on the line for apartment 13. Perhaps that is what the ISP is talking about, since they would not expect to see two MACs on their line.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.