Member Avatar for dogmatic

Windows XP Sp2
Netgear dual speed DS106 hub 10/100
Norton Anti-virus 2005
Mac Make up - Mac ip spoofer
PeerGaurdian

Ive been sharing a cable connection with my roomate for the last 5 months no problem.
We were able to both get on simultaneously after he installed mac make up on his system and spoofed my mac address. Everything has been fine until yesterday.
It seems that anytime he is plugged into the hub I automatically disconnect from the network.
If I disconnect him, I instantly get back on the network.
Ive tried unplugging the hub for while to reset it, I tried different ports on the hub, Both of us have done a restore point in XP to several days ago before it happen (no help), He still has mac makeup installed on his system and it still has my mac address in there. I reinstalled my network components in windows, no help.
It seems like something really easy with the symptoms but my network ability is limited.
If someone can point me out in the right direction it would be greatly appreciated.
Let me know if you need more info,
Thanks in advance,
-Dogmatic

  • 3 Contributors
  • 10 Replies
  • 141 Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by dogmatic

Dani AI

Generated

Short summary and practical next steps that build on and without repeating troubleshooting already tried.

First, why this happens: many upstream devices or administrators limit a single MAC/IP per physical port. When two machines try to share that link (or when one machine spoofs another), the network sees duplicate MAC/IP information and the ARP/switch tables flip, dropping one host. A home NAT router resolves the problem by presenting a single WAN MAC/IP to the provider and NATting multiple internal clients behind it.

Quick checks to diagnose the immediate problem

  • On a Windows machine, capture what the LAN sees before/after plugging the second PC:
    ipconfig /all
arp -a
ipconfig /release
ipconfig /renew

    Look for ARP table changes (the same IP mapping to two different MACs, or MACs flipping). If the ARP mapping keeps changing when the second PC is connected, the network is detecting conflicting identities.

How to set up a robust fix (SOHO router approach)

  • Put a NAT router between the incoming link and both PCs. Connect the ISP/modem to the router WAN, PCs to LAN ports.
  • If the ISP bound service to a single MAC, use the router’s "MAC clone" (WAN MAC clone) so the provider sees the expected address.
  • If the ISP requires PPPoE, enter credentials on the router WAN page and put the modem into bridge mode if necessary to avoid double-NAT.
  • For P2P/download performance, enable UPnP or forward a port on the router and consider simple QoS to avoid one client saturating the line.

Cautions and alternatives

  • MAC spoofing is a fragile workaround and can violate provider or admin policies; ask the network admin or ISP for a supported solution (additional registrations, VLANs, or a static IP).
  • If a managed switch enforces port-security (MAC-limits or 802.1X), a router may not help until the admin changes port settings. Check router logs and the upstream device behavior if problems continue.

Recommended Answers

All 10 Replies

Member Avatar for Suspishio

Assuming you have no router, it may be that the other end, the ISP, has set some policies to prevent what you're doing.

I would have thought that if you come out of the cable modem into the switch and then distribute to two PCs, you wouldn't need to do any MAC address spoofing.

Can you tell us more?

Member Avatar for dogmatic

Assuming you have no router, it may be that the other end, the ISP, has set some policies to prevent what you're doing.

I would have thought that if you come out of the cable modem into the switch and then distribute to two PCs, you wouldn't need to do any MAC address spoofing.

Can you tell us more?

Hm, well I went to go look to the path of where we get our data. It looks like its fiber all the way to a box outside the house, it then turns into Cat5 all the way to the garage to a UPS unit, which then the cat5 line goes directly into the computer room. So its not cable, sorry.
I hope that helps in determining this issue,
Thanks Suspishio for the fast reply.

Member Avatar for Suspishio

I can see why you'd want to spoof a MAC address - it's likely to be because of policies set by the network administrators to prevent more than one MAC address being used per LAN connexion.

But there are other detection techniques they can use, particularly IP addressing. And a swiytch can be detected. So suspect network admin policies being enforced.

At least from this distance, this is what I suspect.

Member Avatar for dogmatic

When we first got the connection, we had the same issue when more then 1 person tried to access it.
Only until the 2nd system spoofed the mac address were we both able to access the connection.

a small update: I had some torrents downloading and my roommate wanted to use the net. So I just plugged him in, it did what I thought it would do and all my downloads stopped. I left the system for 30 mins and came back to see that 2 of the 3 downloads were still going, but not that fast (30k Sec). I checked HTTP, but that was still unsuccessful.
If I unplug him, the downloads go "full speed".

Is there another way around the particular network admin policies that stop both of us accessing the full connection at the same time?

Thanks for all your help Suspishio.

Member Avatar for Suspishio

The slow down was prolly due to bandwidth consumed by the other device trying to get on. Not sure - would need to see it to know for sure. But that doesn't really matter.

There is no way round policies set at the service provision end if they are determined to defeat route sharing.

I suggest that you contact the network administrators and persuade them that it is unreasonably restrictive to your joint studies (have I got that right?) when a room is being shared to prevent one of the people from accessing the network. They can reset policies at patch panel level.

Member Avatar for DimaYasny

why not just buy a proper router, plug both pcs in with their own macs, and make the router simulate the mac on the outgoing connection to the ISP?

Member Avatar for Suspishio

why not just buy a proper router, plug both pcs in with their own macs, and make the router simulate the mac on the outgoing connection to the ISP?

Because, based on what dogmatic has said, the network administrator has restricted the LAN segment to a single user.

When that's sorted out, the switch will do fine.

Member Avatar for DimaYasny

that is exactly why soho routers have mac emulation built in.
I've done this with quite a few different ISPs all over the world, and it worked everywhere inspite of the ISP's restrictions, because the router simply acts as a single PC plugged into the network, and the machines behind it go surf a NAT gateway.

Member Avatar for Suspishio

that is exactly why soho routers have mac emulation built in.
I've done this with quite a few different ISPs all over the world, and it worked everywhere inspite of the ISP's restrictions, because the router simply acts as a single PC plugged into the network, and the machines behind it go surf a NAT gateway.

Yes indeed. NAT - a good point.

Member Avatar for dogmatic

After hooking up a router in the mix we are now able to both get online at the same time.
Thank you Suspishio and DimaYasny for your help and feedback.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.