Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

As a home internet users, why does my ISP block my communication with any other client on the same subnet as mine? It is done for security obviously, but what is the risk?

Update: as clarified by Tylerl, the issue is related to non broadcast nature of the end user connection to POP. Users are only able to communicate with their gateway and ISPs make sure any traffic passes by their filtering devices for securing end users connectivity before they can reach any IPs (including) other peers.

share|improve this question
1  
I've never heard of an ISP doing such a thing. Other computers on my local network and other customers using the same ISP are not blocked in any way. What makes you think they are blocked? –  Ladadadada Sep 7 '13 at 10:38
    
Well, I am a home user and if I try to ping or do any other type of network scanning to my own subnet, I get no reply. Some ISPs provide you with private IP ranges and the same restriction apply. –  AdnanG Sep 7 '13 at 10:44
3  
Doesn't respond to ping is not quite the same thing as blocked. Does it respond to pings from a different ISP? Do other ISPs respond to pings? Does any other kind of IP traffic work? The most likely situation is that other home users are behind NAT and have not configured their routers to forward pings or any other kind of traffic to a particular machine. Since the packets have nowhere to go, they are dropped. Sometimes, if you are lucky, you will get a Destination host unreachable ICMP response. –  Ladadadada Sep 7 '13 at 11:02
    
ping is an example I used, but ANY type of communication is usually blocked between peers as per my experience. Sometimes, they assign you a /31 IP address. It is only you and your ISP. not even a /30 subnet with a network and a broadcast address. –  AdnanG Sep 7 '13 at 12:12
    
Have you checked BitTorrent's BEPs or mailing list? They have spent time engineering the protocol to emphasize local clients on the ISP's network. I would be surprised if they hadn't run into this at some point. –  Indolering Sep 7 '13 at 13:44
show 5 more comments

closed as unclear what you're asking by Adnan, TildalWave, AviD Sep 7 '13 at 21:13

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers

up vote 2 down vote accepted

As a rule, no; ISPs don't block communication between peers within their network. Though also as a rule, home Internet users don't allow any inbound connections, so the lack of connectivity is impossible to test without the cooperation of someone else on the same network.

Also, communication between subscriber peers is sometimes a part of the network that isn't well tested. So for example, they may assign you a /24 netmask which reflects that fact the address is a member of a network of the appropriate size. But then if the underlying technology doesn't broadcast ARP packets between all the nodes sharing the same prefix, then such a configuration would be incorrect, and the result would be a lack of connectivity only between peer nodes.

If, on the other hand, they assign you a /31 netmask as you suggested in your comments, then in that case they're correctly accounting for the fact that the technology won't handle inter-node broadcast traffic. In that case, all traffic must be routed through the network's local router.

share|improve this answer
    
This is very helpful in understanding the situation I asked the question about. I also found this link helpful. –  AdnanG Sep 7 '13 at 17:53
add comment

This is the first time I have ever heard of this. It makes no sense. Why do you think it could have a security reason? I know I have never had any block like this with any of my ISPs.

I would suggest it is the configurations on your system and the person you are trying to connect to that should be checked.

Dont expect to be able to ping them - you wouldn't be able to ping me for example, even if you were on the same subnet - but limiting ping is just good practice.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.