I want to learn and practice penetration testing on my own network, and I want to be sure I'm making it legal.

Is there a system that reports to my ISP that I'm making suspicious activities, even if I never leave the LAN? If there is, would they report me? I'm speaking about "hacks" which ones don't affect the hosts outside my local network (such as DHCP starvation, WiFi password cracking, ARP spoofing, DoS, etc). Or the ISP doesn't care what I'm doing until I confront their system (which I never will)?

  • 1
    If you make pen testing with your hardware and your equipments there is no problem, you are just hacking your own devices that legally are yours (in general). The ISP dont care about what are you doing inside your lan interface, but check the ISP terms and conditions just in case. – camp0 May 6 '19 at 20:02
  • Do they even know what is happening behind the router? Such a "tool" exists? – user193070 May 6 '19 at 20:07
  • I'm voting to close this question as off-topic because it belongs on Law instead. – forest May 7 '19 at 1:20
  • 1
    If it never should leave your LAN anyway, why even connect your hardware to the ISP's router? – Marcel May 7 '19 at 5:53
  • This is more of a question for your ISP. Their Terms and Conditions will tell you what violates their rules. If you are using their router/AP to create your home network, there is a chance that testing completely within your own network might violate their terms. – schroeder May 7 '19 at 8:48

It's legal within the USA* to test your own equipment inside your own network.

Be aware that some of the newest ISP-provided routers (i.e. Comcast gigabit, aka Xfinity xFi) have some rudimentary security software built in, and they do internal network monitoring and detection to help homeowners secure their networks. The most I've seen them do is alert the account holder that new devices have been added to the network, or warn you if you try to connect to a known malicious site, but it's certainly possible that it could detect other forms of behavior that it might consider hostile. So don't be surprised if your ISP notices, and perhaps tries to "keep you safe" by blocking traffic it considers dangerous. It's also probable that any such activity would be logged by them.

However, most ISP routers are older, and the older ones don't do any such thing. Their security functioning is limited to simple firewalls that keep bad traffic out.

If you're concerned that you don't know if the ISP's router is monitoring your traffic, you don't have to trust it. You can add a second router inside your network and dedicate the innermost network to your penetration testing activities. Any network IP addresses that begin with "10.", "192.168.", or "172.16." through "172.31.", are called "Private Networks" (RFC 1918, for a more formal definition). These are reserved address ranges that are not allowed to be routed outside of your network by your router. So anything you send to those addresses won't leave your network, making them safe to experiment with.

* NOTE: standard disclaimers apply, this is not legal advice, it may not be accurate, I am not a lawyer, don't believe everything you read on the internet, use at your own risk.

  • If I understand well, there's no way to monitor inner traffic from outside, unless I have a modern router, which allows it by providing an interface or something like that. Am I right? – user193070 May 6 '19 at 21:13
  • @randomguy sort of yes, if whatever you're doing doesn't leak DNS queries to the outside. – ximaera May 7 '19 at 6:02

You can do anything in your own LAN. ISP has nothing to do with that.

However, you should be careful with 2 things:

  • make sure none of your tests using special tools go rogue and affect something outside the LAN (this is easy to fix by just having no actual internet connection while testing using special tools)

  • make sure what you do does not get reported by things like Windows 10 (this is harder to follow, as windows 10 is designed to automatically send reports of various types of activities it may find suspicious and it can even collect them and send them later when you are on-line again, if you're off-line while doing the testing)

  • What's the issue with Windows reporting it? While it's a privacy violation in general, it's not like Microsoft is going to read the report and tell your ISP that you're testing your own equipment. – forest May 7 '19 at 6:10
  • You get flagged, which is enough for other bad things to follow in a more easy manner. – Overmind May 7 '19 at 6:14
  • 1
    I'd be surprised if Windows' telemetry reporting is sufficiently automated that intent can be discovered. Maybe if full data reporting is enabled, and a program crashes causing a crash dump to be uploaded, and a human manually looks at it? In terms of getting "flagged", simply downloading the security tools is enough to do that. But I understand your point. – forest May 7 '19 at 6:16
  • @Overmind Flagged where? Which bad things follows? – vidarlo May 7 '19 at 7:02
  • Maybe flagged here: account.microsoft.com/privacy Login in with your Windows Store id or Windows login, if it is an email address. – thecarpy May 7 '19 at 10:28

At least in some countries, the router provided by the ISP is considered as part of the ISP network, even though it is installed in your home. You must read the fine print of your contract to know if you are in this case. If so, it would most probably be illegal to attempt to pentest it (depending on your country's laws).

I am not a lawyer, this is not legal advice.

  • Nothing prevents you from putting your own router behind that of the ISP. – Overmind May 7 '19 at 10:50
  • @Overmind Yes, of course. But one need to know in the first place that one might need to buy a 2nd one. – A. Hersean May 7 '19 at 11:53
  • Sure, but it should be obvious not to make such tests on provider equipment. – Overmind May 7 '19 at 12:07
  • @Overmind It should, but more often than not it is not the case. – A. Hersean May 7 '19 at 12:17