Finding the external (PPPoE, WAN) MAC address of an ADSL router

Question

My ISP is Orange Internet, I have recently ditched my crummy "livebox" and moved to a more stable BT Business Hub with the firmware flashed back to the original SingTel ROM. The thing works great apart from one problem: I'm unable to get my VOIP line to work.

I called Orange and apparently their VOIP service is tied to a specific MAC address which they are unable to change; they just enter the serial number of the livebox and it looks like their WAN-side MAC is hidden. My SingTel router allows changing the MAC address, but I'm unable to get the external MAC address of the livebox in order to spoof the correct one.

So we arrive at my question: How do I find the external MAC address of a black-box ADSL router which connects over PPPoE?

I'm thinking that if I had an ADSL modem with GNU/Linux drivers, I may be able to plug the router into the modem and record the traffic it sends using Wireshark. As the oE in PPPoE stands for "over Ethernet", I'm guessing Wireshark should have no problems finding the MAC address of my router this way. I don't actually have one though, so before I go out and buy one:

• Are my assumptions sound?
• Will I need a special sort of cable or will the link layer work with a standard modem cable?
• Is there a better way to do this?

Solution 1

If you want to connect your Livebox DSL modem-router to a simulated DSL signal, here are some possible problems you might need to investigate:

• A DSL modem in your home connects to a DSLAM in the phone company's central office. I'm not sure if two DSL modems can communicate with each other.

• You can't connect two phone devices with just a phone cable and communicate between them. You need something to put the correct phone line voltages on the line. You may be able to build a circuit to do this, or you might purchase a phone line simulator. (A phone line simulator will often have more features, like the ability to generate dial tone and other phone signals. Those signals wouldn't be needed for a DSL modem, but might be useful for connecting phones, answering machines, fax machines, or dial-up modems.) However, phone line simulators and circuits are mainly used with audible frequencies, I'm not sure if they'll reliably transmit high frequency DSL signals.

Solution 2

The mac is usually printed on the underside of the case...

Comments

[Gareth Davidson]

@Arjan, me too. This is the first bounty I've ever set. Maybe it gets added when the bounty expires? I'll keep an eye on it

[Arjan]

no, you have to assign the bounty. Or, if you're still expecting a better answer, then I guess you should un-accept the accepted answer. People just don't know (or at least: I don't know) if things have been solved for you. See How does the bounty system work?

[Gareth Davidson]

@Arjan, aha! How unintuitive! I clicked the bounty button and it worked, thank you :)

[Gareth Davidson]

It's a router so it has two MAC addresses. Only the LAN-side MAC is printed on the case, not the WAN one.

[RobotHumans]

Did they lock down telnet/ssh access to the router? often you can get this information from the shell...

[Gareth Davidson]

It's totally locked down, if I had ssh access I'd have no problem using arp to grab the WAN MAC address

[Bavi_H]

Usually a router's WAN MAC, Ethernet LAN MAC, and wireless LAN MAC addresses are in sequential order or otherwise numerically close to each other. Perhaps you can just try MAC addresses around the one listed on the label and see if it works?

[harrymc]

I believe that the printed MAC is the external one, and that is the one that your cable company will ask for. The internal one can be found with 'arp -a'.

[Gareth Davidson]

@Bavi_H, that's not a bad idea. I'll try that and see what happens. I'd prefer to reverse engineer it properly though and document it on the web for others in future.

[Bavi_H]

As harrymc said, it seems likely the MAC address on the label is the WAN MAC address. I've found a couple of Livebox images online that show the label reads @MAC, and the @ light on the front is the Internet light. If you've already set your BT/SingTel router to use that MAC and your VoIP still didn't work, perhaps Orange uses some other method to detect what router or VoIP device you're using.

[Bavi_H]

@Arjan: Are you sure they're exactly the same? The last digit may be different.

[Arjan]

:-) Okay, @Bavi, you made me go into one very cold room again. I'm sure! (It's a Thomson Speedtouch DSL modem/router. It only has one MAC address on its label, while actually I think the ethernet and Wifi things have different MAC addresses. Running arp -a shows dsldevice.lan (192.168.1.254) at 0:14:7f:f3:e0:f3 on en1 ifscope [ethernet] for that modem/router, which matches the label. On my wireless MacBook the wireless settings show: BSSID: 0:90:d0:f3:e0:f3. A wired Mac shows the same arp -a results.)

[Arjan]

@Bavi, any chance the LAN and WAN MACs might be the same? I've not assigned the public IP address (no DMZ or something like that) to any of my computers. Any change some traceroute command might show the MACs of the internal network?

[Arjan]

@Bavi, ah I see, I should have mentioned that indeed! (I am sure you did notice the smiley about going into that cold room! Just to be sure: also note I am NOT the question asker!)

[Bavi_H]

Arjan: Thanks for making sure, but I thought you had a Livebox. The label on your Thomson Speedtouch modem-router may not be comparable to the label on Gaz's Livebox. (reposted deleted comment)

[Gareth Davidson]

aking was right, the MAC on the case was not the internal one, it was the external WAN one. The problem I'm having is that I'm completely unable to diagnose why things aren't working, I would really need a Wireshark recording to sniff Orange's password.

[Gareth Davidson]

Good answer! I may well try this approach, when I can find the time to get the soldering iron out!