A method and an apparatus for identifying an origin of captured DOCSIS upstream bursts are disclosed. Upstream bursts are captured without knowing their allocated time slots in advance. Information from an upstream channel descriptor is used to generate RF waveforms of upstream burst preambles, which are then correlated to the captured upstream waveforms to determine the type of captured upstream bursts without having to decode the latter. Once the type of the captured upstream bursts is determined, information from the upstream channel descriptor is further used to demodulate and decode the upstream burst, so that CPE MAC addresses can be extracted. From the extracted CPE MAC addresses, the origin of the captured upstream bursts can be identified. The identification of origins of captured upstream bursts assists in locating faults in the cable network.