What can ISPs monitor as far as downloading goes?

[hans030390]

To be specific, can your ISP "see" what you're downloading through a website such as Rapidshare, Megaupload, etc? If so, how does this compare to P2P downloading (what they see, how strongly they monitor it, etc)?

 

[DeathRayLoveMachine]

HTTP uses no encryption, so it has no inherent privacy/security. HTTPS is private and secure, at least when it's set up correctly. There are a lot of P2P protocols.

Also? Slightly creepy question.

 

[her209]

If its not encrypted, they can see everything.

 

[NickOlsen8390]

Well, Working for a ISP as a network engineer I'll tell you, I can see everything our customers do. You have to understand, Were in the perfect man in the middle spot. If its not encrypted we can see it. Now, This doesn't mean we do, As it violates many privacy laws. But given a court order, or any reason we need to look at what your doing we can. We can see the large amount of horse porn your downloading, We can reconstruct your SIP phone calls (even skype if we catch the entire call(not really SIP)). We can see the spam your sending. We can enjoy that shoutcast stream your tuned into also.

Just know that if its not encrypted its overly simple to see every bit of it.

 

[onza]

basically - encrypt it.

 

[Fardringle]

basically - encrypt it.

Or simply don't do anything illegal or against the ISP's policy...

 

[onza]

Or simply don't do anything illegal or against the ISP's policy...

While this is true. I'd rather encrypt my data then not.

 

[JackMDS]

Encrypt is Not a Magic word.

What data are you going to encrypt while you download, or interact with, when the other site that does not providing encrypted interaction for the general public.

 

[hans030390]

Also? Slightly creepy question.

Haha. My university has fines for downloading copyrighted material, assuming they catch you doing it. I've heard that they don't actively look for people doing anything. At most, they just check people at random times. I've also heard they only do something when they've received a complaint from someone like the RIAA/MPAA.

Either way, no one really knows for sure how the school goes about checking that stuff, if they do. They do say to not use P2P for illegal purposes, but Rapidshare and such don't really fall under that category.

 

[jlazzaro]

They do say to not use P2P for illegal purposes, but Rapidshare and such don't really fall under that category.

so hosted services for illegal purposes is ok? since you neglected to mention that your university was your ISP, conform to their policies and you'll have nothing to worry about.

 

[hans030390]

so hosted services for illegal purposes is ok? since you neglected to mention that your university was your ISP, conform to their policies and you'll have nothing to worry about.

I meant that Rapidshare isn't P2P, and that's what they generally mention when talking about downloading copyright material, as if that's all they monitor (IF they monitor things).

This is why I haven't used torrents here. I was just wondering if websites like Rapidshare provide any more safety. Apparently they don't, so my question has been answered.

 

[n0cmonkey]

Haha. My university has fines for downloading copyrighted material, assuming they catch you doing it. I've heard that they don't actively look for people doing anything. At most, they just check people at random times. I've also heard they only do something when they've received a complaint from someone like the RIAA/MPAA.

Either way, no one really knows for sure how the school goes about checking that stuff, if they do. They do say to not use P2P for illegal purposes, but Rapidshare and such don't really fall under that category.

Most of what you download is copyrighted.

 

[jae]

Or simply don't do anything illegal or against the ISP's policy...

I'll rather encrypt

 

[Spike]

What about using a torrent program, can't most of them encrypt?

 

[xSauronx]

so hosted services for illegal purposes is ok? since you neglected to mention that your university was your ISP, conform to their policies and you'll have nothing to worry about.

seems like pretty much any question about how to skirt around something or that sounds suspicious should just be locked, 90% of it is college kids trying to skirt around Uni policies and the other 10% are people who want to use wifi to borrow a neighbors internet connection. jeebus, people

 

[Nothinman]

What about using a torrent program, can't most of them encrypt?

Yea, but it depends on whether the peer supports encryption as well. And that's assuming that one of the peers isn't your school looking for students in that torrent.

 

[n0cmonkey]

seems like pretty much any question about how to skirt around something or that sounds suspicious should just be locked, 90% of it is college kids trying to skirt around Uni policies and the other 10% are people who want to use wifi to borrow a neighbors internet connection. jeebus, people

Which is especially silly considering the UniKids could just sneakernet a TON of good stuff between themselves without touching the network.

 

[hans030390]

Most of what you download is copyrighted.

...Shhh.

What about using a torrent program, can't most of them encrypt?

Usually I run uTorrent with the encryption on and all that (basically as "secure" as it can be) with a "paranoid" IP block list. For some reason, though, I feel like the school is more likely to find me torrenting something vs downloading it through a web browser...

 

[NickOlsen8390]

Torrent traffic is super easy to spot, all they need to do is take a glance at the connections.
I can tell by looking at the concurrent connections on a wan interface encrypted or not.
Lots of connections, To IP's all around the world. And tons of different ports.
And a decent amount of the connections have a common source port.

 

[Red Squirrel]

Put a packet sniffer right at your main internet line. What you see, is basically what they can see.

 

[spidey07]

Put a packet sniffer right at your main internet line. What you see, is basically what they can see.

Accept for we have advanced application engines that automatically report on the traffic no matter what port it's running on, it can tell what it is.

 

[ch33zw1z]

Accept for we have advanced application engines that automatically report on the traffic no matter what port it's running on, it can tell what it is.

Hope I don't hijack the thread, but I'm curious what could be seen on mine:

I run a WinSSHD server on a non standard >10000 port. Remotely, I use Putty to make a connection with 2048 bit public/private key setup, a passphrase, and a password. All this is for a secure VNC connection really, but I plan on running a SFTP server eventually.

My first questions are:
What does that actually look like from your end?
Can you see any of the traffic I put through the tunnel?

 

[Nothinman]

Accept for we have advanced application engines that automatically report on the traffic no matter what port it's running on, it can tell what it is.

Except that only works if it's unencrypted or your inspection tool does a MITM attack.

What does that actually look like from your end?
Can you see any of the traffic I put through the tunnel?

Before any of the handshake SSH servers present a version banner so SSH clients can determine what protocol and workarounds to use. After that all of the traffic is encrypted.

 

[Red Squirrel]

Accept for we have advanced application engines that automatically report on the traffic no matter what port it's running on, it can tell what it is.

Yeah but it's still the same data, you're just "formatting" it to be easier to read. Kinda like wireshark breaks down packets of well known protocols so it's easier for the viewer to see what is going on.

I'm sure ISPs have reporting systems on stuff like well known ports and who is using lot of bandwith for say, bittorrent. It would be insane to capture and keep all the traffic so they probably capture but run it straight into such tools and disregard the rest. Tweak as required.

The FBI has a packet sniffer called Carnivore that they randomly plug into ISPs though and they capture everything and have people who read through it. Must be a boring job.

 

[n0cmonkey]

Except that only works if it's unencrypted or your inspection tool does a MITM attack.

They probably don't care as much about content, but more about what types and how much traffic is going around. The encryption is largely inconsequential.