1

My question originates from following articles:

http://www.theregister.co.uk/2016/07/14/cloudflare_investigating_mystery_interception_of_site_traffic_across_india/

and

https://medium.com/@karthikb351/airtel-is-sniffing-and-censoring-cloudflares-traffic-in-india-and-they-don-t-even-know-it-90935f7f6d98#.zduskeffu

I wanted to understand how does ISP intercept web traffic? Do they block DNS request? However, this can be circumvented with using different DNS servers. OR Do they block http get requests? I have no knowledge of traffic interception, however; I feel this is the most plausible method.

My reason for stating the above is because whenever I try to visit a website blocked (or redirected to a block page) by my ISP it is usually a http request. If I add https in the URL the website appears and I have access to it.

For example: http://websitename.com – blocked https://websitename.com – full access.

Thanks!

  • So CouldFlare is investigating, but you think you'll get the answer from StackExchange community? Just curious... – techraf Jul 15 '16 at 5:31
  • Dear Techarf, I am asking this question to information technology community at large. For example, a proxy is a way ISP's intercept traffic. However, I wanted to understand beyond what my knowledge base is. – Parth Maniar Jul 15 '16 at 5:45
  • And you are convinced such "for example" question is different from an open-ended, hypothetical question: “What if ______ happened?” as listed on what questions not to ask list? – techraf Jul 15 '16 at 5:50
  • 2
    Parth, since you use this ISP, all you need is Wireshark and tutorials to answer this question in this specific case. A general overview of technical blocking by ISPs can be found here and here. – Jedi Jul 15 '16 at 5:50
  • 1
    Also see chapter 3 here for tools and other chapters for more coverage. It's slightly dated but has nice figures. – Jedi Jul 15 '16 at 6:14
4

The ISP can intercept traffic in any number of ways, from a proxy (like you suggest, though I would suspect a transparent proxy), to a span port on a switch. If they have control over a link in the chain between you and the Internet, they can see anything that passes through it. If it's encrypted data, the ISP can use an SSL inspector (like this), but that would be pretty obvious to you.

In reference to filtering, if your ISP is filtering based on the content of the website you're viewing (keywords, for example), or the destination (host, http resource), then making that request over SSL will inhibit their ability to see what you're requesting and from whom. They can still see your initial DNS request and the IP address that your request is sent to on the network layer however.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.