23

I work at an office typing numbers into a computer. It gets quite boring sometimes, so I go on Netflix while using their WiFi on my phone.

Can they tell what apps I'm using, based on network traffic?

Improve this question
17
  • 64
    Yes they can. Use your own Internet connection.
    – Simon
    Oct 9, 2015 at 13:17
  • 22
    Honestly, streaming video is pretty easy to spot using traffic analysis (sustained transfers at fixed bitrates), and Netflix is on the harmless end of the scale (not porn, not illegal). The same through a VPN would probably put up more flags.
    – drxzcl
    Oct 9, 2015 at 18:40
  • 6
    security.stackexchange.com/questions/65183/…
    – Ben
    Oct 10, 2015 at 20:11
  • 7
    Am I the only one thinking the OP should be doing the job they've been paid to do?
    – JamesRyan
    Oct 11, 2015 at 23:59
  • 4
    @drxzcl "Netflix is on the harmless end of the scale" This is not entirely true. There are other factors to consider. We don't know if any business critical processes are using the Wi-Fi. We don't know how much bandwidth is available via the Wi-Fi link. A situation could occur where the link is saturated with streaming Netflix traffic if other employees adopted this same approach to combat boredom, creating a DOS scenario.
    – k1DBLITZ
    Oct 13, 2015 at 14:53

7 Answers 7

Reset to default
66

Short answer is yes. If there is any logging on their WiFi router they might not be able to see exact apps, but they'll be able to see the server domain/hostnames that you're connecting to.

You can also look at these question and answers:

Is there a way for my ISP or LAN admin to learn my Gmail address?
Can an employer see cellular network traffic routed through company-owned device?

Long Answer

Secure WiFi only encrypts traffic up to the Access Point. It's decrypted, and the traffic can be monitored. If it's an enterprise router it's more than capable of logging specific types of traffic. If your work has a firewall in their network then it's even more likely that your employer has the capability to monitor traffic. These do have to be configured, and your employer has to care, but it's very possible.

Domain Name Server (DNS) requests contain the domain hostname that you're trying to reach, and these requests are sent before an SSL/TLS channel can be established and secure.

enter image description here Source

If you're using SSL/TLS it's possible to see the hostname of the server that you're connecting to in two ways. First is the server's certificate. The common name generally needs to match the domain name that you're browsing to.

enter image description here

Can they link this back to you? This really depends on a lot of factors. If they're really adamant they'll be able to track down the MAC address of your device, IMEI, and other mobile phone identifiers. This is a lot of work, and in the end still might not link you to the traffic.

In all honesty, if they care it's just easier to block the traffic than it is to try and track you down.

Improve this answer
10
  • 1
    Depending on how they are doing this and if the site uses SSL/TLS, all they are going to see is the Server's IP, no actual URLs.
    – rbialon
    Oct 9, 2015 at 12:53
  • 14
    @rbialon In TLS the certificates sent by the server will contain the domain name of the website you're visiting, and DNS requests are still sent out in the clear.
    – RoraΖ
    Oct 9, 2015 at 12:57
  • 1
    Perhaps it's more accurate to sey that they can see that someone is using Netflix on their phone using their wifi, but not easily link it to a particular person - as is the case from doing the same from a work computer.
    – Peteris
    Oct 9, 2015 at 14:43
  • 2
    @JPhi1618 Yes and No. They're probably not using static IPs on the clients nor are they recording all the MAC addresses of their computers (or rather individual NICs.) Instead they probably rely on their domain controller to know who is doing what.
    – Dean MacGregor
    Oct 9, 2015 at 17:29
  • 2
    Logging wouldn't have to be in the WiFi router/access point - it could also be anywhere between that and the connection to the ISP.
    – nobody
    Oct 9, 2015 at 22:25
8

Depending on what they have set up as regards logging and monitoring, yes - this is something they could do.

If you have a policy against using the wifi for such things, I'd suggest not doing that, but I guess you could ask. They might not want you doing it when you should be working, however...

Improve this answer
1

Yes, they can. It’s as simple as that.

If you want a solution, though, if your network allows it in the office, set up a small Raspberry Pi and Swan VPN at home. Connect your phone to the wifi and tunnel out your connection. Problem solved.

Improve this answer
12
  • 11
    In this case, setting up a VPN doesn't help much. When they see 3+ Mbps of constant traffic going to your phone, they're going to be suspicious, regardless of whether it's encrypted or not. Furthermore, streaming content (whether video or, especially, VoIP) has quite unique traffic signatures that make it rather easy to detect, even when the traffic itself is encrypted. Lots of research has been done in this field (including some by myself) and the classifiers are actually quite good.
    – reirab
    Oct 9, 2015 at 20:39
  • 1
    For a recent-ish survey paper of the topic, see Gomes, et al., 2013. (This is not my work, by the way.)
    – reirab
    Oct 9, 2015 at 20:43
  • 1
    ^ "plausible deniability" only works to a v limited extent. (Setting aside more basic rules like bandwidth limits,) If an employer can't specifically prove you're doing something that goes against acceptable use, they might hedge their bets, and out you go. Employers aren't subject to the rules of science, law, or w/e when deciding whether to keep someone on.
    – underscore_d
    Oct 11, 2015 at 12:35
  • 1
    @silverpenguin there are a lot of employers who will fire you even more likely for using a "shady" VPN than Netflix. I mean someone transfers data and doesn't want the company to see what they are doing? Either he is downloading malware or transferring out trade secrets.
    – Josef
    Oct 12, 2015 at 12:29
  • 1
    @Michael He might. But the probability is quite high he is not even allowed to use company resources for personal pleasure and if he still does that, trying to hide it makes it worse! I am not against using a VPN in a free wifi network or your own network or whatever, but inside a proper company network, that's just asking for trouble. Just try to see the perspective of an network admin there. In his IDS a alert pops up, that massive unknown encrypted data is transferred. What do you think he will do?
    – Josef
    Oct 12, 2015 at 13:06
0

Yes they can. If you do not want them to see what IP you connect to, use a VPN service, they will only be able to see the VPN IP and not know where the connection was intended for.

Improve this answer
0

Yes they can see it, but depending on your country you might be protected by law or not... So you should ask if they can use that info against you or not... In some countries usage of that information will violate privacy laws.

Improve this answer
0
0

Yes they can see the traffic, but maybe not the specific apps you are using. Just the traffic. Depending on the setup, they may have already tracked this. Sometimes they will not be able to tell who did it, but sometimes they will also be tracking the device's name (e.g. "Phil's iPad") depending on certain things.

So while it may be true that a company largely will not know if it's you even if they see the traffic, and they may not know specifically that you are using a particular app to generate the traffic, the fact is they COULD know you are the person generating the traffic to and from netflix servers, if your device's name is a dead giveaway or if anyone kind of already knows your device's name. (They could also know if there is anyone in your office who you have chatted with about this issue).

If you haven't been approached yet in any way, or if use of the network for Netflix or large downloads hasn't come up in some way you know about, chances are pretty good that they don't currently care. However you may also want to not risk it in the future, and instead use your own data plan for things like that.

Improve this answer
0
-1

Yes they can.

(As a fighter of full disclosure I won't disclose here how they can. In full agreement with myself :), since in this case I won't give a key advantage to the bad against the good.)

In most law context it is lawful for your employer to investigate this abuse of its company resources: you are here using resources provided and maintained to permit work of all employees, your colleagues. The key exception to this right to stop a resources abuse is the case were resources are explicitly provided as a convenience for private use. For example if your wireless network is named "Rest area" or "Recreation area".

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .