Hot answers tagged

139

If I delete my router's history, is it still visible and can my ISP still provide it to my parents? Or is it deleted from existence? Your ISP's record of your network usage isn't in any way affected by you doing anything to your router. You could wipe its memory, subject it to an EMP, and crush its chips to dust, and it wouldn't have any effect on them. :-) ...


137

Deep Packet Inspection, also known as complete packet inspection, simply means they are analyzing all of your traffic as opposed to just grabbing connection information such as what IP's you are connecting to, what port number, what protocol and possibly a few other details about the network connection. This is normally discussed in contrast to the ...


88

In the early days of the web, webpages were mostly static and there would be no communication between your computer and the web server unless you were actively loading a page. Today, that is no longer true. It it extremely common for webpages to maintain active connections to provide features like live updates. When you see a new email appear in Gmail ...


87

There are a number of strategies, each having their own costs and benefits. Here are a few (there are more, and variations): blackholing By blackholing traffic, you discard all traffic towards the target IP address. Typically, ISP's try to use RTBH (remotely triggered blackholing), by which they can ask their upstream networks to discard the traffic, so it ...


63

Trey Blalock's answer describes percisely what deep packet inspection (DPI) is. But I'd like to add three things to hopefully answer your specific questions: There is a technique of DPI that does decrypt your data, called SSL interception, although it is more common in enterprise situations and only possible if the ISP (or any other interceptor) has the ...


61

Depends on the device and if you have taken any steps to hide it. Most devices by default put a lot of identifying information in the User-Agent header on outgoing HTTP/S requests. For HTTP requests these will be visible to anyone with wire access. For example for Android from here - Mozilla/5.0 (Linux; U; Android 4.0.3; ko-kr; LG-L160L Build/IML74K) ...


57

Your ISP is per definition a MITM (man-in-the-middle) and therefore can serve you any content it desires. You mentioned HTTPS and this is of course a game changer. Yes, the ISP can server any arbitrary content when you access e.g. Facebook, but it does not have access to the private server certificate of Facebook and your browser will detect that it is not ...


52

Can an ISP really detect this? The ISP can see all data your systems exchange with the internet (but not the plain text from encrypted data). Based on this he can detect botnets which often show typical behavior. Should I action on this and what to do? Yes, you should action on this since there seems to be malware in your network which is used to ...


41

As stated by Trey, DPI can see the entire content of your network traffic. All of it. If it is plain text, then they see everything that you do. To add on to Miao's answer: Things DPI can see, even when you use HTTPS: DNS information, e.g. https://catvideos.com/tigers - they will see https://catvideos.com IP address connectivity. So, even you you ...


40

I worked for an ISP and yes we do. We know many things about your systems in the house. A lot of them we learn from the router that we provide you, from vendor Mac addresses, from various headers you send out. We also know who's computer belongs to whom and what kind of device it is(I think from MAC ADDR Mac Vendor Lookup) maybe IMEI as from comment ...


39

Routers usually do not store history and ISPs, while they may record such things on internal logs, do not give them out to anyone without a court order. You do not need to worry about your parents finding the naughty sites you visited unless it's in your browser history. Just turn on incognito mode and don't worry. While it is theoretically possible that ...


33

Only the TLS endpoints1 can read the the full URL because HTTPS provides end-to-end encryption. HTTPS wraps the full HTTP protocol, including the request line, request/response body and all the headers. The request URL is just one part of HTTP that gets encrypted together with all the other components. If any party was able to read the URL, they would ...


30

Details here depend on your specific ISP setup, but it might well be that multiple customers share the same public IP address. This is called NAT or in case of ISP CG-NAT (carrier grade NAT). It is pretty common for ISP in mobile networks but is also not uncommon with cable or DSL. The main reason is that there is a shortage of public IPv4 addresses so ISP ...


22

So, I think, that when I type certain URL in my browser (for example https://google.com) I send request through ISP to ISP DNS and my provider gets response (ip of google.com) and goes by this IP and send request to this server (google.com) and gets response - html page that will be sent to me by my provider. Is it so? No, this does not work as you ...


21

Yes, probably. Most VPN protocols are not designed to hide the fact that they're VPN protocols, nor what kind of protocol they are. See for instance this paper which details fingerprinting OpenVPN. If you run all your traffic through a VPN, the fact that you're using a VPN is quite easily visible - as all traffic will be destined for a single destination - ...


19

This looks like a legitimate email. Someone detected that a computer with an Indian IP address was part of a botnet. This was shared with your National CERT (CERT-In). In turn, as they didn't know which user had that IP address at the time it was detected, they notified your ISP, which in turn found out which customer was responsible of that connection and ...


19

It depends on the site. Does the website have any javascript function sending data back from time to time? Open the Developer Tools on your browser, go to the Network tab and watch. If there's connections from time to time, the website knows your IP changed. If the site have Websockets (thanks Jon for pointing this), there's one caveat: already established ...


16

You cannot hide how much data you are sending and when you are online. But, Tor encrypts data and sends it through proxies before it reaches the target server, so that hides the contents of the communication and to which website or server you are talking. You can also try to hide that you are using Tor, but this is difficult and a determined ISP will be able ...


12

ISPs can absolutely log traffic upstream from your router. The easiest way for an ISP to inspect what users are doing is by inspecting logged dns queries. People can get around this by using non ISP dns servers such as 1.1.1.1 (cloudflare dns) or 8.8.8.8 (google dns) The next easiest is to actually log connections. To get around this, people use VPN or an ...


11

The email address from which you have received the mail seems genuine. The body of the mail also adds to the genuineness. However, senders email addresses can be spoofed by using open mail relays. As per the Department of Telecom, port 25 must be blocked to reduce surface area of spoofing, yet there are many open relay that are live still. To confirm ...


10

I think you are a bit confused about what DNS leakage is and isn't. The problem with DNS leakage isn't that the website knows what DNS server you are using. The issue is that the DNS server knows what websites you are visiting. For example, let's suppose you are using TOR, but not routing your DNS traffic through TOR. (This is a classic example of DNS ...


10

Your screenshot shows an HTTP ("Not Secure") page, not HTTPS. Your ISP essentially pulled an "SSL Stripping" attack on you; they blocked you from getting the redirect, fetched the HTTPS version of the site themselves, slapped their own content on top of the retrieved HTML, and then returned the modified HTML to you in response to your ...


10

Contrary to what some moderators in some communities believe, IP addresses are not a reliable personal identifier. Some ISPs use carrier-grade NAT, which means that a large number of users share the same IP address Many ISPs use dynamic IP allocation, which means that customers receive a new IP address every time they restart their router, and often even in ...


9

What surprises me here is not the fact that the passwords are displayed in plaintext, but that your ISP keeps a copy of your wifi password at all. This is not something they need to do in order to provide internet to you. It's the router that takes care of the wifi, so only the router needs to know the password. So why have they chosen to do it this way? My ...


7

Short answer: YES How? MAC ADDRESS & TCP/IP stack profiling ISP provided routers have access to your phones MAC address which is unique to your device and thus the manufacture of your device ... possibly even down to the model version or range of model versions of your device. On some devices the MAC address can be spoofed, however, you would need ...


7

It doesn't. DNS over TLS is not designed to keep your privacy from ISP. Like HTTP, DNS is vulnerable to MITM. DNS over TLS provides the same level of security as HTTPS. As DNS over TLS is encrypted, your ISP can't see the domains you query for but they don't have to. TLS uses Server Name Indication, a TLS extension which appears on the outside of HTTP host ...


7

Your parents will not normally have the authority to retrieve data from the ISP. An ISP does not offer this type of information on request. You need some type of government warrant before they're released, and the process is non-trivial. If you're worried about pr0n and simply silly stuff, then don't worry about it. If you're Dread Pirate Roberts v2.0, ...


7

Yes, they can. The important part is HTTP is still the default protocol in 2020. Most sites use HTTPS today, but it works by first doing an insecure request which will redirect to HTTPS. This means, since the ISP controls the default DNS server, the ISP can point to their own reverse proxy with their DNS server. This reverse proxy can do any manipulation you ...


6

Short answer: It erases the volatile memory, which is where the plug-ins are stored that you're referring to. This was what was doing the heavy-lifting of the malware. To fully get rid of malware, you are correct that the router's firmware will need to be upgraded or wiped and re-installed, but the malware referenced here used various plug-ins that lived ...


6

Yes, it is dangerous to disable a firewall with out any compensating controls or replacement filtering. It is true that an internet IP address indexer for IPv6 has much more to cover, but it does happen. Sans has articles on this. One of the issues here is that IPv6 allows for a direct attack on an internal device. NAT is not used (at least that is the ...


Only top voted, non community-wiki answers of a minimum length are eligible