2

We had issues with one internet provider, and switched to another one. However, we received word that the new internet provider is somewhat affiliated with the previous.

When running a "what's my ip" query online, we see different results if we run it over an http link opposed to over an https link.

Over an http link, our ip is from a new subnet registered to the new company. Over https, our ip appears to belong to the subnet and ip range of our previous provider.

1- How would you explain this?

2- The new provider claims the old IP is somehow stuck in the buffer of our very own router, is that possible? How can we flush it? we already tried powering off then back on.

3- Is it possible our https commuications are being spied on? Like a man-in-the-middle attack?

4- Is it possible the new provider is cheating us and re-selling from the initial provider? at a higher price.

Many thanks

Improve this question
3
  • 4
    Do you have any proxy set up? Can you provide wireshark/tcpdump dumps for both cases?
    – domen
    Dec 8, 2014 at 14:25
  • tcptraceroute is your friend.
    – gowenfawr
    Dec 8, 2014 at 15:06
  • That for the quick responses. the wireshark files can be downloaded from : link
    – Gabriel
    Dec 8, 2014 at 15:56

1 Answer 1

Reset to default
1

Pure speculation without more info, but it could well be a case of HTTP proxying.

HTTPS proxying is not feasible without a complex set up, which would be why you see a different IP over HTTPS (your IP) than over HTTP (the proxy's IP). While this indeed can be used to "spy" on your HTTP traffic, it could also be a caching service, used to reduce unnecessary traffic due to repetitive web browsing.

The theory that they are reselling with a http proxy to 'hide' your IP from yourself seems unlikely to me.

There exist various ways to detect a proxy. Conveniently, publicly available tests exist freely (with varying quality - try a few..) e.g. here.

Improve this answer
3
  • Thanks tried your link, HTTP: traceroute to 141.105.81.5 (141.105.81.5), 30 hops max, 40 byte packets  1  router1-atl.linode.com (64.22.106.73)  0.616 ms  0.396 ms  0.675 ms ... 11  212.73.241.82 (212.73.241.82) 223.845 ms  222.150 ms  222.131 ms 13  195.112.194.218 (195.112.194.218) 158.075 ms  158.137 ms  159.663 ms HTTPS: traceroute to 212.30.35.64 (212.30.35.64), 30 hops max, 40 byte packets  1  router1-atl.linode.com (64.22.106.73)  0.664 ms  0.728 ms  0.839 ms ... 13  82.96.85.12 (82.96.85.12)  97.300 ms  96.059 ms  97.716 ms Can you make anything out of it? 212. is from previous ISP
    – Gabriel
    Dec 8, 2014 at 16:13
  • It does mention that there's an http proxy when connected from HTTP, and say the proxy IP is: 141.105.81.5 What does this mean? Thanks
    – Gabriel
    Dec 8, 2014 at 16:15
  • If your previous IP address was indeed 212.30.35.64, you might be right with your assumption. Your ISP might have configured a transparent proxy to be used for non-HTTPS traffic (possibly to make you think you are being served by a different provider). I would suggest you get in touch with them again, as an IP address doesn't "get stuck" in a router like that.
    – Karl Hardr
    Dec 10, 2014 at 13:44

Not the answer you're looking for? Browse other questions tagged .