1

My ISP gave me a special portal which contains my data usage. It also showed the usage by device MAC address. These devices are behind my router, but I thought that the mac address would not cross the router!

The router is not provided by my ISP, and I believe that the portal is on the internet and not just served from the router.

So how is my ISP tracking the MAC addresses of all devices connected to the router?

closed as unclear what you're asking by Steffen Ullrich, techraf, Dog eat cat world, HashHazard, Xander Oct 26 '16 at 17:10

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    What kind of portal is this? Who has control over the router, i.e. only you or also the ISP? What kind of router is this? And please restrict yourself to a sngle question per post, i.e. currently it is both too broad and not clear enough. – Steffen Ullrich Oct 26 '16 at 5:36
  • 1
    And where exactly is this portal located? Somewhere on the internet? Or is it on the local network? Many routers contain their own control panels where you can monitor network usage and the devices connected. For example if your control panel is at 192.168.X.X then it's probably located in your router and therefore there is nothing to suggest that your ISP knows the MAC addresses of devices connected to your router – RedBullNinja Oct 26 '16 at 6:52
  • The Portal is on Internet ! – Surya Oct 26 '16 at 7:24
  • @Surya Are you sure it is on the internet, and not just served by your router? How do you know? – Anders Oct 26 '16 at 8:29
2

Do your network segments look like this?

                                                             _    ____
                  +-------------+       +------------+      / \__/    \
Internal LAN------+ Your Router +-------+ ISP Router +-----+ Internet / 
                  +-------------+       +------------+      \________/

If so, your inner router must be misconfigured. You're right, MAC addresses are not passing a correctly set up router because ethernet is not routable.

So it doesn't matter whether that portal sits on the ISP's router or somewhere in the internet; in both cases, it shouldn't have access to your internal MAC addresses unless you somehow actively provide them.

If your ISP's Router (located at your home) provided WiFi to your internal clients, then obviously that would explain where it got their MAC addresses. Or if your router acted as a bridge (and especially if the ISP's router then offered DHCP to your internal LAN), that might explain it. Or if you installed a special app on each of your devices that sent the device mac to your ISP, that would also explain it. I think that in all other cases, your router is configured wrong; it's passing information it shouldn't.

If you're not sure whether your router is acting as a bridge, tell us the network addresses of your internal lan and the lan segment between your router and the ISP's router.

1

My isp gave me a special portal which contains my data usage

Thats great!

i wonder it also showed the usage by device mac address ,these devices are behind my router, i thought the mac address should not cross the router ! so how my isp is tracking mac address of all devices connected to router ?

Hmm, If its a router provided by the ISP(I am guessing it is) they may still have access to your router. Some ISPs do it for regularly updating images, monitoring purposes and sometimes providing services like the one given to you(of data usage). For monitoring purposes many times SNMP is used and most probably that is how they are able to see your usage.

Also there maybe a DHCP which gives IP to the clients with its gateway on the router itself. So you are actually connected to that router itself and router has your machine's ARP. So yes MAC doesn't cross router boundary, But if you are directly connected to the router. Router will be able to see you and reply the SNMP queries with your usage details and MAC information.

Some have specific OIDs on the basis of user MACs also.

What security issues are there with exposing MAC addresses?

None as such, as only you and ISP have access to your router. Also in wireless MACs are already exposed to sniffing.

NOTE: The answer assumes that your LAN gateway is on the router itself

Hope this helps!

  • No The Router Is not given By ISP .... – Surya Oct 26 '16 at 7:22
  • 1
    Is your LAN terminated on the router?. And does it have a public snmp string on it?As it may be open for anybody to know in that case!, Are your clients doing dot1x authentication with ISPs authentication server(like radius). – Anirudh Malhotra Oct 26 '16 at 7:28
  • actually i getting Internet directly from my ISP Router to my router ,i simply login in the router home page and enter the PPPOE credentials...and then any one who has access to my router can enjoy internet – Surya Oct 26 '16 at 7:34
  • 2
    Ok, so the ISP provides your modem, and you provide your own router. The only thing the ISP should be able to see is the MAC address of the router, unless your router has some awful configuration that allows ARP to pass to and from the WAN port (internet side) and the LAN, which is very unlikely. As an aside, the modem/router management protocol that most ISPs use to talk to customer devices (i.e. ISP provided modems, routers, etc.) is called TR-069. – Polynomial Oct 26 '16 at 8:37
  • +1 polynomial, Exactly. Well in that case I would be looking out for open SNMP strings, Or if your router is sending accounting information to some external IP(maybe radius accounting, which ISP asked you to enable). Or another case which is highly unlikely: Your ISP is hosting DHCP for you and giving you IPs from their internal network. – Anirudh Malhotra Oct 26 '16 at 8:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.