5
1
I installed a new router today and saw my IP address change because the new router has a different MAC address and I am just curious on what information my ISP can see from my network.
I know they log the WAN MAC address and can figure out the manufacturer with the OUI, what about the router host name and other MAC addresses like the LAN and wireless MAC?
mok
Posted 2014-11-15T07:22:04.617
Reputation: 51
2
I know they log the WAN MAC address and can figure out the manufacturer with the OUI, what about the router host name and other MAC addresses like the LAN and wireless MAC?
The short answer: Depends on the ISP. In general ISP’s mainly track your usage and habits. This article on Lifehacker gives a good overview on that type of tracking that can be done on your usage without going past the WAN connection.
But as far as breaching past the WAN connection and into your LAN? Well, in general one should assume their ISP is operating within basic common carrier rights & privileges. Meaning they just won’t probe your internal router info. Which they honestly can’t if you are using a store bought router hooked up to their network.
The if comes from users who use ISP provided equipment; such as combo modems/routers. If it’s the ISP’s equipment you need to assume they are retaining some root level control on the device so they can handle remote firmware upgrades.
Here in NYC I seem to recall Verizon bricking tons of modems with a badly deployed firmware push about 10 years ago. I did dig up this article on how Comcast pushes (or pushed?) firmware updates. And I found this article on how British Telecom’s router firmware seems to setup management IP address explicitly for “firmware” updates, but then again who knows how much access they have with that level access.
Robert Graham of security firm Errata said that many Internet service providers make custom firmware for the modems they sell, and this typically has a management "back-door" so that the ISP can monitor or control the modem.
So if you are truly worried about an ISP provided piece of equipment going past the WAN and into your network, then I would recommend seeing if that ISP device can be made to behave like a modem in “bridge mode” and then purchasing another router that would connect to that modem and handle all routing. That way all of you network’s “heavy lifting” happens on equipment you have purchased and you control.
JakeGould
Posted 2014-11-15T07:22:04.617
Reputation: 38 217
1Verizon FIOS uses the router they supply to control all of their services. Each set-top box and DVR is basically a networked computer. I was a little surprised to find out that they had access to my home computer network. They knew every printer and PC name. No need to worry about the NSA hacking your system. Verizon is already inside. – fixer1234 – 2014-11-15T07:50:42.490
@fixer1234 Ahh! That Verizon! Thanks for the info. – JakeGould – 2014-11-15T07:51:33.063
The information they get from the router is your MAC address, that's it. Your ISP has a lot more info on you, though. – Jon – 2014-11-15T07:23:58.100
Another question, what happens if two users on the network manage to have the same MAC address while connected to the ISPs network? I know very little about networking. – mok – 2014-11-15T07:33:07.033
“…what happens if two users on the network manage to have the same MAC address…” MAC addresses are unique on a hardware level. The only way you would ever see duped MAC addresses is if someone is intentionally spoofing another address. – JakeGould – 2014-11-15T07:46:58.377
@Chipperyman Information they get OF your router is your router's MAC at the WAN interface of the router. But Through the router they also get all the packets that go between WAN and LAN. So you might want to encrypt where possible if you're concerned about that. – barlop – 2014-11-15T08:04:26.303
3@JakeGould That's how it's supposed to work, but in practice MAC address conflicts do appear, it's just that they are very hard to detect, unless it happens on computers which are on the same subnet. And then, you also have the "wild" manufacturers which use unregistered OUIs and have same MAC address on all (most?) of their products. This actually happened with some lab equipment that I have. Therefore I believe that your statement is a bit too optimistic. – AndrejaKo – 2014-11-15T10:17:21.340
I would add that if your router supports Home Network Administration Protocol (HNAP) then your ISP can remotely configure your router any way they please, including forwarding ports to let themselves into your local area network. – Mark Micallef – 2014-12-11T03:03:49.027