2

We had issues with one internet provider, and switched to another one. However, we received word that the new internet provider is somewhat affiliated with the previous.

When running a "what's my ip" query online, we see different results if we run it over an http link opposed to over an https link.

Over an http link, our ip is from a new subnet registered to the new company. Over https, our ip appears to belong to the subnet and ip range of our previous provider.

1- How would you explain this?

2- The new provider claims the old IP is somehow stuck in the buffer of our very own router, is that possible? How can we flush it? we already tried powering off then back on.

3- Is it possible our https commuications are being spied on? Like a man-in-the-middle attack?

4- Is it possible the new provider is cheating us and re-selling from the initial provider? at a higher price.

Many thanks

closed as off-topic by Xander, AJ Henderson, Jens Erat, Mark, TildalWave Dec 9 '14 at 0:02

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Xander, AJ Henderson, Jens Erat, Mark, TildalWave
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    Do you have any proxy set up? Can you provide wireshark/tcpdump dumps for both cases? – domen Dec 8 '14 at 14:25
  • tcptraceroute is your friend. – gowenfawr Dec 8 '14 at 15:06
  • That for the quick responses. the wireshark files can be downloaded from : link – Gabriel Dec 8 '14 at 15:56
1

Pure speculation without more info, but it could well be a case of HTTP proxying.

HTTPS proxying is not feasible without a complex set up, which would be why you see a different IP over HTTPS (your IP) than over HTTP (the proxy's IP). While this indeed can be used to "spy" on your HTTP traffic, it could also be a caching service, used to reduce unnecessary traffic due to repetitive web browsing.

The theory that they are reselling with a http proxy to 'hide' your IP from yourself seems unlikely to me.

There exist various ways to detect a proxy. Conveniently, publicly available tests exist freely (with varying quality - try a few..) e.g. here.

  • Thanks tried your link, HTTP: traceroute to 141.105.81.5 (141.105.81.5), 30 hops max, 40 byte packets  1  router1-atl.linode.com (64.22.106.73)  0.616 ms  0.396 ms  0.675 ms ... 11  212.73.241.82 (212.73.241.82) 223.845 ms  222.150 ms  222.131 ms 13  195.112.194.218 (195.112.194.218) 158.075 ms  158.137 ms  159.663 ms HTTPS: traceroute to 212.30.35.64 (212.30.35.64), 30 hops max, 40 byte packets  1  router1-atl.linode.com (64.22.106.73)  0.664 ms  0.728 ms  0.839 ms ... 13  82.96.85.12 (82.96.85.12)  97.300 ms  96.059 ms  97.716 ms Can you make anything out of it? 212. is from previous ISP – Gabriel Dec 8 '14 at 16:13
  • It does mention that there's an http proxy when connected from HTTP, and say the proxy IP is: 141.105.81.5 What does this mean? Thanks – Gabriel Dec 8 '14 at 16:15
  • If your previous IP address was indeed 212.30.35.64, you might be right with your assumption. Your ISP might have configured a transparent proxy to be used for non-HTTPS traffic (possibly to make you think you are being served by a different provider). I would suggest you get in touch with them again, as an IP address doesn't "get stuck" in a router like that. – Karl Hardr Dec 10 '14 at 13:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.