@Peter Gathercole
> "I'm not sure that it is that simple. The cable network, even from the street boxes is a tree network, with many branches and bi-directional signal regenerators."
Yep. The plan is to narrow it down to a small enough segment that it then becomes practical to go house by house. I am of course assuming here that the cableco engineers have a well-equipped toolbox full of parts such as taps, mixers, filters, injectors, splicers etc., that only require breaking the connection briefly to place them in circuit, and perhaps that they are willing to put a little development effort into building a few custom jerry-rigged gizmos out of these parts and some of the standard sort of parts they'll have around the lab - oscillators, filters, that kind of thing.
> "The signal is not baseband, but true multi-frequency broadband (my, how that term is mis-used in the public space), with many customers appearing on the same branch of the tree. It is not a point-to-point network like the telephone network."
Well yeh, that's why I didn't just say "Follow the wire from the port on the CMTS"!
There's this little thing called a MAC layer. It manages many clients appearing on the same segment of a network. Remember it, because it'll come in handy later.
> "The modulation is a mixture of TDMA and FDMA, with modems switching frequency during normal operation, and possibly using more than one frequency carrier for the higher data speeds.
> If you were to inject noise (that is, without disconnecting the individual tap from the network), you would take out ALL customers ON THAT BRANCH! If you wanted to try to make it more selective, you could try to identify the frequency currently in use, but you would still take out all the customers using that carrier on that branch, and that is assuming that the modems would not switch to another frequency."
Hang on a minute. We control the horizontal, we control the vertical, remember? We manipulate the allocation policy of all the cable modems on the same CMTS port as the 'phantom' to isolate it in a time slot and channel of its own. Then we can inject timed pulses of band-limited noise into the system and know we're only going to take out one specific modem. This could be done with a laptop with a hacked-up cable modem card in it and some special drivers.
> "If you want to check each tap, you would have to physically visit each tap point."
Yep. This is a fraud investigation and we have to assume they are motivated to put some effort into it. The point of tracing the signal down the tree to the final segment is to reduce the number of tap sites to a manageable quantity. Then you actually go round each house one at a time and visit each tap point and test it again there. Sooner or later you find your signal source.
> "You may also get false positives. What happens if, at the same time as you trying to identify an illegal modem, a customer turns off their cable modem?"
Errm, that's trivial. You just repeatedly run the test a few dozen times, turning the blocking noise injection on and off at random intervals a few superframes apart. The odds of someone switching their cable modem on and off, or of a loose wire or third-party noise source interfering in the exact pattern you choose? Inifinitesimal.
> "All in all, I expect that the cable engineers at Virgin Media, who actually maintain a cable network, to know more about the design and running of these things than a majority of us amateurs commenting in this thread"
Err, did they say that they /weren't/ able to trace individual modems and I missed it? I'm sure they do know how to run their network. Some of the techniques I have just described may even be novel, but I'm pretty sure they're the same sorts of ideas they'd be kicking around if you got them round a meeting table and asked them how to solve this problem.
TDR was probably a red herring, I guess. Except... you know that one particular modem's listening on a particular channel at a particular time. That means (because cable modem QAM demodulators tend to work on an IF) that there's a bandpass filter out there at the end of the line, tuned to the channel center frequency and effectively connecting and disconnecting according to the time-slot allocation. Now, a filter is neither a short-circuit nor an open-circuit, but it sure is electrically distinguishable from there not being a filter there, even at the end of a cable segment. So the idea might not be completely without its uses after all...