1

My question originates from following articles:

http://www.theregister.co.uk/2016/07/14/cloudflare_investigating_mystery_interception_of_site_traffic_across_india/

and

https://medium.com/@karthikb351/airtel-is-sniffing-and-censoring-cloudflares-traffic-in-india-and-they-don-t-even-know-it-90935f7f6d98#.zduskeffu

I wanted to understand how does ISP intercept web traffic? Do they block DNS request? However, this can be circumvented with using different DNS servers. OR Do they block http get requests? I have no knowledge of traffic interception, however; I feel this is the most plausible method.

My reason for stating the above is because whenever I try to visit a website blocked (or redirected to a block page) by my ISP it is usually a http request. If I add https in the URL the website appears and I have access to it.

For example: http://websitename.com – blocked https://websitename.com – full access.

Thanks!

9
  • So CouldFlare is investigating, but you think you'll get the answer from StackExchange community? Just curious...
    – techraf
    Jul 15, 2016 at 5:31
  • Dear Techarf, I am asking this question to information technology community at large. For example, a proxy is a way ISP's intercept traffic. However, I wanted to understand beyond what my knowledge base is. Jul 15, 2016 at 5:45
  • And you are convinced such "for example" question is different from an open-ended, hypothetical question: “What if ______ happened?” as listed on what questions not to ask list?
    – techraf
    Jul 15, 2016 at 5:50
  • 2
    Parth, since you use this ISP, all you need is Wireshark and tutorials to answer this question in this specific case. A general overview of technical blocking by ISPs can be found here and here.
    – Jedi
    Jul 15, 2016 at 5:50
  • 1
    Also see chapter 3 here for tools and other chapters for more coverage. It's slightly dated but has nice figures.
    – Jedi
    Jul 15, 2016 at 6:14

1 Answer 1

4

The ISP can intercept traffic in any number of ways, from a proxy (like you suggest, though I would suspect a transparent proxy), to a span port on a switch. If they have control over a link in the chain between you and the Internet, they can see anything that passes through it. If it's encrypted data, the ISP can use an SSL inspector (like this), but that would be pretty obvious to you.

In reference to filtering, if your ISP is filtering based on the content of the website you're viewing (keywords, for example), or the destination (host, http resource), then making that request over SSL will inhibit their ability to see what you're requesting and from whom. They can still see your initial DNS request and the IP address that your request is sent to on the network layer however.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .