5

When dynamic IP addresses are assigned to users, how do ISPs store the logs? Do they just store the time and address of the websites visited or do they store the whole URL like we see in our browsers?

I've tried searching for this information but all that I get is "yes they store logs of everything you do".

But I want to know in what manner these logs are stored: only IP of the websites or can they just click on the link and see the whole page like we do from our browsing history?

Improve this question
1
  • You need to specify if this is HTTP or HTTPS. The answer varies by this.
    – Courtney Schwartz
    Commented Sep 29, 2016 at 4:32

2 Answers 2

Reset to default
2

It think your question was not about the internal hierarchical routing and IP prefixes, than much more about the techniques itself - right? Well, some savage once thought that the IP addresses don't tell you everything (true) so he came up with the idea of logging the DNS questions and answers - passive DNS. This way the ISP has the mapping between the names you type combined with the IP addresses so that DNS requests provide a much better overview - but they do not the know the full URL, which is on the HTTP level. However they have the port numbers and protocols being used. So now they filter services. When you visit a specific website, it contains specific plugins, ads, trackers, etc which all reveal DNS requests. Any ISP who wants to grow does this mainly for accounting hush..dig...profile...hush. The DNS method does not show the full URL but it has no overhead data in the packets and it's amazingly efficient to build up a digital fingerprint.

I mentioned the HTTP level - the same data can be gained if your ISP is monitoring your HTTPS traffic. They will see www.stackexchange.com but the rest is not visible because the (clean, no MITM, operating on a smaller scale) certificate is registered to domain.com. However your ISP could MitM your connection to utterly and completely defeat the encryption, and you would never know. HTTP is plain text, unlimited raw information - which gives ALL POWER to your ISP or someone who is monitoring your traffic. This is a lot of data, but you can assume your ISP has a tool which does a deep packet inspection on the Socket API level - so they don't have to store the full packets.

In theory if you want to obfuscate such monitoring you would connect to a rooted server or a strong VPN (L2TP/IPsec, no logs) then use Tor (Tails) and all encrypted services - this way all your ISP would see is undecipherable gibberish, well they would see an enstablished connection to the VPN (which would then see you are connecting to tor). And they would not care - unless its consistent extreme saturation of your line, especially if it impacts other users.

The answer to the question: No, they cannot click on your URL - they have to copy paste it. They certainly don't bother.

Improve this answer
4
  • @alija.junuzovic-Wow thx man, that's a well explained answer man but I didn't get you on the DPI part, are you saying that it's better if the isp has DPI machines so they don't store copy of all the packets? My isp says it doesn't do DPI in its policy
    – RichmondWilliams
    Commented Jul 2, 2014 at 16:27
  • @alija.junuzovic-Can they use deep flow inspection generally? That's against laws right, logging DNS queries is already a big privacy invasion
    – RichmondWilliams
    Commented Jul 2, 2014 at 16:58
  • @alija.junuzovic-the only solution is not to bother about our privacy :-)
    – RichmondWilliams
    Commented Jul 2, 2014 at 18:58
  • ire60 - please do not vandalise your posts. There are penalties if you continue to do this.
    – Rory Alsop ♦
    Commented Oct 4, 2014 at 9:07
1

nope, they can't directly view the website that you were browsing THE SAME as your browser history, they would need your session cookies to do that. A way to obtain your cookies remotely is to analyze the HTTP response of the login system when you were logging in to the website (which won't be available if the URL is HTTPS) OR setup a man in the middle attack.

Improve this answer
12
  • If you think about it, setting up MitM for ISP is the easiest thing to do as traffic is routed through ISP's hardware by default.
    – Dmitry Janushkevich
    Commented Jul 2, 2014 at 10:38
  • So? The OP's question is about logging all the ISP's users, is it not? There was nothing on filtering a specific subscriber, though it may be doable if this is maintained in a properly designed DB.
    – Dmitry Janushkevich
    Commented Jul 2, 2014 at 10:42
  • @user50132,If they want to monitor a particular user's activity they can do it, but my my question was on how they keep logs generally. So can they obtain session cookies of a users after long time?
    – RichmondWilliams
    Commented Jul 2, 2014 at 11:09
  • @RichmondWilliams I didn't answer the question, I only edited it to fix a couple of inaccuracies. ;) User user50132 was the author.
    – SilverlightFox
    Commented Jul 2, 2014 at 11:11
  • 1
    There are numerous ISPs which are required to log which websites are visited on a per IP basis (which can be linked back to a DHCP lease for a certain client account). Sessions (if done correctly and not part of the URL) may not be logged, but they surely see which sites you visited and when.
    – Lucas Kauffman
    Commented Jul 2, 2014 at 11:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .