5

When dynamic IP addresses are assigned to users, how do ISPs store the logs? Do they just store the time and address of the websites visited or do they store the whole URL like we see in our browsers?

I've tried searching for this information but all that I get is "yes they store logs of everything you do".

But I want to know in what manner these logs are stored: only IP of the websites or can they just click on the link and see the whole page like we do from our browsing history?

  • You need to specify if this is HTTP or HTTPS. The answer varies by this. – Courtney Schwartz Sep 29 '16 at 4:32
2

It think your question was not about the internal hierarchical routing and IP prefixes, than much more about the techniques itself - right? Well, some savage once thought that the IP addresses don't tell you everything (true) so he came up with the idea of logging the DNS questions and answers - passive DNS. This way the ISP has the mapping between the names you type combined with the IP addresses so that DNS requests provide a much better overview - but they do not the know the full URL, which is on the HTTP level. However they have the port numbers and protocols being used. So now they filter services. When you visit a specific website, it contains specific plugins, ads, trackers, etc which all reveal DNS requests. Any ISP who wants to grow does this mainly for accounting hush..dig...profile...hush. The DNS method does not show the full URL but it has no overhead data in the packets and it's amazingly efficient to build up a digital fingerprint.

I mentioned the HTTP level - the same data can be gained if your ISP is monitoring your HTTPS traffic. They will see www.stackexchange.com but the rest is not visible because the (clean, no MITM, operating on a smaller scale) certificate is registered to domain.com. However your ISP could MitM your connection to utterly and completely defeat the encryption, and you would never know. HTTP is plain text, unlimited raw information - which gives ALL POWER to your ISP or someone who is monitoring your traffic. This is a lot of data, but you can assume your ISP has a tool which does a deep packet inspection on the Socket API level - so they don't have to store the full packets.

In theory if you want to obfuscate such monitoring you would connect to a rooted server or a strong VPN (L2TP/IPsec, no logs) then use Tor (Tails) and all encrypted services - this way all your ISP would see is undecipherable gibberish, well they would see an enstablished connection to the VPN (which would then see you are connecting to tor). And they would not care - unless its consistent extreme saturation of your line, especially if it impacts other users.

The answer to the question: No, they cannot click on your URL - they have to copy paste it. They certainly don't bother.

  • @alija.junuzovic-Wow thx man, that's a well explained answer man but I didn't get you on the DPI part, are you saying that it's better if the isp has DPI machines so they don't store copy of all the packets? My isp says it doesn't do DPI in its policy – RichmondWilliams Jul 2 '14 at 16:27
  • @alija.junuzovic-Can they use deep flow inspection generally? That's against laws right, logging DNS queries is already a big privacy invasion – RichmondWilliams Jul 2 '14 at 16:58
  • @alija.junuzovic-the only solution is not to bother about our privacy :-) – RichmondWilliams Jul 2 '14 at 18:58
  • ire60 - please do not vandalise your posts. There are penalties if you continue to do this. – Rory Alsop Oct 4 '14 at 9:07
1

nope, they can't directly view the website that you were browsing THE SAME as your browser history, they would need your session cookies to do that. A way to obtain your cookies remotely is to analyze the HTTP response of the login system when you were logging in to the website (which won't be available if the URL is HTTPS) OR setup a man in the middle attack.

  • If you think about it, setting up MitM for ISP is the easiest thing to do as traffic is routed through ISP's hardware by default. – Dmitry Yanushkevich Jul 2 '14 at 10:38
  • So? The OP's question is about logging all the ISP's users, is it not? There was nothing on filtering a specific subscriber, though it may be doable if this is maintained in a properly designed DB. – Dmitry Yanushkevich Jul 2 '14 at 10:42
  • @user50132,If they want to monitor a particular user's activity they can do it, but my my question was on how they keep logs generally. So can they obtain session cookies of a users after long time? – RichmondWilliams Jul 2 '14 at 11:09
  • @RichmondWilliams I didn't answer the question, I only edited it to fix a couple of inaccuracies. ;) User user50132 was the author. – SilverlightFox Jul 2 '14 at 11:11
  • 1
    There are numerous ISPs which are required to log which websites are visited on a per IP basis (which can be linked back to a DHCP lease for a certain client account). Sessions (if done correctly and not part of the URL) may not be logged, but they surely see which sites you visited and when. – Lucas Kauffman Jul 2 '14 at 11:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.