Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've noticed some funny behavior lately with my home Internet connection such as connections dropping frequently, rate limiting occuring, and packet loss.

I know how to get around this online, use a VPN, use disposable virtual machines, Tor, etc. But I kind of want to know IF they are spying on my data and what they are doing with it? Intercepting, monitoring, manipulating, etc. More specifically, how does one detect eavesdropping which got me thinking, is there a way to tell if my ISP spying on me or monitoring my data other than asking a network admin at my ISP?

share|improve this question
I've heard that a certain British ISP can actually access your LAN via the residential routers they provide with their internet packages. – user5065 Nov 27 '12 at 20:22
up vote 13 down vote accepted

connections dropping frequently, rate limiting occuring, and packet loss

Without knowing whether your connection resets are injected TCP reset packets or a result of dropped packets, it's hard to say whether you're actually having your data acted on or just having connection issues. It is entirely conceivable that your line or equipment aren't working quite right.

That said, every sane network provider, ISP, hosting facility, or transit provider monitors interface and by proxy customer bandwidth. Bandwidth caps are very common for residential ISPs in some countries.

None of this addresses whether they're inspecting the contents of your traffic, and unless they're acting on what they see in a way that's visible to you by changing how they handle their traffic (or using your credentials, making stock trades on information you email, etc.), it's impossible to tell. Anybody who routes your traffic is entirely capable of sending a copy to second interface.

When it comes to a 3rd party monitoring you on your own network, looking for diverted traffic is possible. When it comes to asking if somebody who is expected to be in the line of transit is doing something more with the data, there is no trace of it until you see them act on it.

share|improve this answer

If your ISP has the right equipment in place and configured correctly you have absolutely no way of knowing the level of monitoring that is going on. The technology has existed for years to allow any ISP to store and process network traffic at data rates in ways that are completely undetectable to users.

It's not just your ISP that you have to consider here. The Internet is a patchwork quilt of large and small ISPs all connected through peering connections. When you're connecting to your favorite off-shore porno-tube site you will likely be going through five or more providers on your way to your destination, and any of them may be storing every packet of your connection. Many governments (many of them democracies) have instituted laws requiring ISPs to log traffic for the government's use, so if you're in the US and connecting to a site in the UK for example your traffic is likely available to both the US and UK governments. So it's not about "my ISP", it's about the internet in general.

As for your particular issue it sounds more like connectivity problems over your line to your ISP, or capacity issues between your ISP and their upstream providers. I'd call them and raise a trouble ticker, otherwise they won't know you're having a problem.

share|improve this answer
I guess all the more reason to use a VPN. – Zippy Zeppoli Jan 18 '13 at 21:22

This is the only thing I've ever seen that does any sort of tests like what you want. Would be nice to know if there's others.

share|improve this answer

That's totally impossible to tell whether your packages are being intercepted by the third party. Just check your connection, it may be simply unstable, or if it is wireless someone may utilize a Wi-Fi jammer nearby.

share|improve this answer

I second the previous posts - eavesdropping is not detectable technically. However, there is a tool provided by the EFF which lets you detect at least some sorts of tampering with your traffic:

You can find it on - this is what the EFF say about it:

Is your ISP interfering with your BitTorrent connections? Cutting off your VOIP calls? Undermining the principles of network neutrality? In order to answer those questions, concerned Internet users need tools to test their Internet connections and gather evidence about ISP interference practices. After all, if it weren't for the testing efforts of Rob Topolski, the Associated Press, and EFF, Comcast would still be stone-walling about their now-infamous BitTorrent blocking efforts.

share|improve this answer
Hmm - half a year late. For some reason this question popped up as "up to date"... must look closer before answering. – adebaumann Jul 8 '13 at 12:52
Its not really an answer, your answer contains a response, to a previous answer ( the hallmark signs of a bad answer ). – Ramhound Jul 9 '13 at 15:28

run > cmd > netstat -ano, look for established and type the IP address in the browser. It will show that your ISP is connected to you, but it won't give details as to whether they are active or passive listeners.

share|improve this answer
That is just plain wrong. – Tim Brigham Jul 8 '13 at 13:35

protected by Community yesterday

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.