I've been reading lots on this subject recently, sadly SBH is still down at the moment (and there aren't many forums left). 
What other ways are there to find certs without extracting them from my subbed modem? SNMP access is restricted to the ISP's IP-address, so I can't simply scan for them.
I'm familiar with changing the NIC MAC (I use T-MAC in Windows & Macchanger in Linux, as you already mentioned).
What other ways are there to find certs without extracting them from my subbed modem? SNMP access is restricted to the ISP's IP-address, so I can't simply scan for them.
I'm familiar with changing the NIC MAC (I use T-MAC in Windows & Macchanger in Linux, as you already mentioned).