0

Internet service providers (ISP) can choose to have full information on the browsing activity of one of its subscribers.

Can an outsider, who is not the ISP, but who simply knows someone's IP address, be able to somehow monitor the browsing activity of that IP address and know every website it is visiting?

How much information can an outsider obtain with only the IP address in hand, or maybe with additional details like the MAC address of the device? Or is it completely impossible

Improve this question
11
  • "Internet service providers (ISP) can choose to have full information on the browsing activity of one of its subscribers." - this is plain wrong. With plain HTTP they could get details, with HTTPS they could at most get the target domain, but not the actual URL.
    – Steffen Ullrich
    Commented Jan 28, 2021 at 18:19
  • how? don't they have the choice to log one of their customer's internet traffic?
    – user610620
    Commented Jan 28, 2021 at 18:20
  • ISP cannot get the details from inside encrypted traffic. And most of the details in HTTPS are encrypted.
    – Steffen Ullrich
    Commented Jan 28, 2021 at 18:21
  • 1
    @dandavis: First, the exact size can not be retrieved due to how TLS works. Then, many sites are actually dynamic and the size of the response differs in time and might be specific to the user. Even if it is static for a while this would require the ISP to scan all visited domains to find the size of each page. This can only be done for pages directly or indirectly accessible by links though from some starting page (i.e. no deep links from external sites) and also only pages which don't require authentication. In short: feasible only for a few selected sites but not for all traffic.
    – Steffen Ullrich
    Commented Jan 28, 2021 at 22:29
  • 1
    @dandavis: And this only assumes that HTTP/1 is used where it is mostly possible to look at traffic pattern to identify request-response pairs and thus get the approximate size of the response. With HTTP/2 or HTTP/3 this is no longer possible because multiple requests and responses are interleaved on the same connection. Thus, even less possible.
    – Steffen Ullrich
    Commented Jan 28, 2021 at 22:32

2 Answers 2

Reset to default
1

It depends on your outsider. A normal internet connection goes from your client (like a browser) to an endpoint (like a website).

The ISP as well as the endpoint knows your IP address. However when connecting through the ISPs network through a website you often have additional routers on the path, big internet exchanges ... Just do a traceroute from your home IP to some website and you often get half a dozen hops or more.

So everyone with the ability to sniff on or between these hops could possible know where you connect to. The more close to your home the more likely they can see all the endpoints you connect to.

Assuming a local ISP or your countries three letter agency, they can see the domains (or IPs in general) you visit, when you visit them, how long you visit them, the amount of traffic exchanged with the endpoint, the OS and applications you use, the protocols you use and in case the protocol does not use encryption they can also see the content. Based on that, they could make some assumptions what URL you visited and what you are doing online in general and how your soft/hardware stack looks like.

With encryption they can't directly see the content by just passively looking at the traffic. They could start active attacks which generally are a bit more noisy to see your content. Also they could attack the endpoint itself to see what you are doing.

On IPv4 MAC addresses are not transmitted outside your local network. On IPv6 this is more of an issue.

Improve this answer
-1

Your MAC address is only used within your local network for packet direction and does not get forwarded outside your router. It would be quite difficult to track what you are browsing using your public IP. Most internet communications these days are encrypted. Also, the only way to actually see a packets destination or source is to receive that packet (like a Man in the Middle attack). Other than that, someone would need direct access to the specific server that the packet is destined for in order to see where it came from, and even then with the immense amount of constant traffic on the internet as a whole it would be extremely difficult to single it out.

In short, it's absolutely possible, however EXTREMELY unlikely due to the difficulty of accessing those servers or employing a successful Man in the Middle attack.

Hope this helps!

Improve this answer
4
  • "Also, the only way to actually see a packets destination or source is to receive that packet (like a Man in the Middle attack)" . The source and destination IP addresses are not encrypted and can be monitored without becoming a MiTM. This does not show anything about content or sub pages, just the IP address.
    – user10216038
    Commented Jan 28, 2021 at 18:41
  • Additionally for a server with multiple virtual hosts, the individual host selected can be seen in the unencrypted SNI.
    – user10216038
    Commented Jan 28, 2021 at 18:45
  • 1
    "... the immense amount of constant traffic on the internet as a whole it would be extremely difficult to single it out ..." . While this seems reasonable from a human perspective, computers are really good at doing exactly this.
    – user10216038
    Commented Jan 28, 2021 at 18:48
  • Thank you for your comments! I agree that there are other ways to find the source/dest ip, just MiTM is probably the most common/easiest to visualize. If I'm not mistaken(and I very well may be) the perp would still need some way to insert themselves into that dataflow. And absolutely computers are great at that, however even with having the sourced public IP filtered you would then need to sort through all the different requests and acks that get transmitted(again, could be wrong, just how I see it!) either way, thank you for sharing your information! Take care!
    – lost_admin
    Commented Jan 28, 2021 at 18:58

Not the answer you're looking for? Browse other questions tagged .