Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Recently I called my ISP and talked to them about a problem I experienced with a PC. They asked me "Are you talking about the PC that is connected in port 2 with X hostname?"
It got me wondering how they know that, how can my ISP know the port which my device is connected to and how would that allow them to see the hostname?
I have FTTP (Fibre to the Premises) and a GPON ONU given to me by my ISP.
TL;DR - They will have remote access to the router they provided and thus they will be able to obtain such information.
Yes, this is plausible. As I am sure you're aware, your ISP will give you a router when you get an Internet Service from them, it's no secret that they have access to this router.
The ports that are on the back of the router are access ports meaning, you plug a device in and you access the network, there will be ways in which they can see the status of these ports, what's connected, etc.
I cannot tell you exactly what they're doing to see this information because I don't know the inner-workings of these types of "routers" and I don't work for your ISP. But in essence yes they will have access to that information and there isn't a whole lot you can do about it.
All of your modems and routers run an operating system underneath. If that modem/router/modem+router combo belongs to your ISP, BELIEVE, they have a tap into it.
I know my modem has a couple open ports on it that AT&T uses for remote administration.
So let's answer some questions for you.
What can they see on your network?
Everything that passes through their tunnel, believe they have access to if they want.
Now it would be a gross violation of privacy and ethics if they were doing some type of deep packet inspection on all your traffic but if I had to bet my life on it, I'd bet they were collecting data on every single customer.
This data is likely limited to DNS queries but it could go deeper. They might be collecting the data about the machines on your network but I highly doubt it considering most people have setups like I do. That is, the isp modem is connected to a 3rd party router. So all the modem would see in it's device list would be the router. Pretty useless if you're trying to market to people that have a specific device.
How do they see your machines?
Like I mentioned earlier, these modems and routers run on operating systems and these operating systems have something called an Arp Table in them. The arp table keeps track of known hosts. A known host is anyone that communicates with this machine.
What does the Arp Table have in it?
You'll find that the arp table has hostname ip address mac address and what interface it's connected to.
Here's a screenshot of my router. I just logged in and dumped the arp table out with arp -a
My apologies for redacting so much of it but I don't want my internal network ips and device mac addresses floating around.
So this image is of my router which I own. My modem should only have my router in its arp table so AT&T would only see something along the lines of
Tomato-Router 192.168.1.2 at FF:FF:FF:FF:FF:FF [ether] eth0
