Duplicate participants (e.g., cloned subscriber units) (274) are detected in a communication network, such as a hybrid fiber/coax (HFC) cable television network or the like, by monitoring the physical layer of the network to detect transmission differences between such units. The subscriber units (14, 16, 18, 274, 276) may be cable modems that transmit upstream signals with associated identifiers to a headend (10, 200), e.g., to access the Internet or for telephony. Measured characteristics of the upstream signals can include: (1) propagation time (235), (2) frequency (240), (3) power (245), and (4) spectral characteristics (250). For propagation time, the reception time of the upstream message can be compared to a headend clock (215) and also to other messages with the same modem ID. For spectral characteristics, adjustment coefficients can be provided to the units to normalize the spectrum of the upstream signal to a baseline spectrum. When discrepancies are detected for an upstream signal that indicate duplicate modems are operating in the network, the account of the corresponding unit can be terminated.