Sniffing ISP's Butt

DON'T post new tutorials here! Please use the "Pending Submissions" board so the staff can review them first.
Post Reply
User avatar
DNR
Digital Mercenary
Digital Mercenary
Posts: 6114
Joined: 24 Feb 2006, 17:00
18
Location: Michigan USA
Contact:

Sniffing ISP's Butt

Post by DNR »

It is always a good habit to know your network. The ISP is the controller of your network to the internet, as well as remote access to work.
No matter what you do to avoid privacy threats, you are still at the mercy of your ISP.

Image

Depending on which ISP you choose, you will ultimately be connecting to a larger ISP. I am using a dial-up connection to Verizon. I do it through my V3 cellphone, using a USB connection. The system works as a cellphone transmission, like a landline modem it keeps a line alive and sends and recieves on the network as needed. In the image on the top, instead of a wall jack and telephone line - its a cellphone tower.

Verizon is a medium ISP, it still plugs into a major ISP, like Qwest or UUNET by a NAP. Verizon would be considered my POP, Point of Presence.
An Internet point of presence is an access point to the Internet. It is a physical location that houses servers, routers, ATM switches and digital/analog call aggregators. It may be either part of the facilities of a telecommunications provider that the Internet service provider (ISP) rents or a location separate from the telecommunications provider. ISPs typically have multiple POPs, sometimes numbering in the thousands. POPs are also located at Internet exchange points and colocation centres

A colocation centre (collocation center) ("colo") is also called a NAT, Network Access Point. The Colo center is a sort of data center where multiple customers locate network, server and storage gear and interconnect to a variety of telecommunications and other network service provider(s) with a minimum of cost and complexity.

Increasingly, organizations are recognizing the benefits of colocating their mission-critical equipment within a data centre. Colocation is becoming popular because of the time and cost savings a company can realize as result of using shared data centre infrastructure. Significant benefits of scale (large power and mechanical systems) result in large colocation facilities, typically 4500 to 9500 square metres (roughly 50000 to 100000 square feet).
check this link out for various maps of datacenters and NAPs
http://www.dyntex.com/our_network/index.html#map
or this one for your country
http://www.datacentermap.com/

Image

Connections to these datacenters can be by Metropolitian Area Networks, as well as by the actual Internet Backbone, this is sort of like your freeways and highways the cars drive on.

Network Operations Centers are responsible for:
primary and backup locations
network monitoring
statistics and log gathering
direct but secure access

The size of datacenters is controlled by making the network layout Modular - with datacenters only serving information clients would want - location based. Example - searching for Restaurants in Texas, would likely only return results for restaurants in the texas area - because the DB used is influenced by the POP. This is the reason I like to use other search engines besides Google, the search engines are biased to location.
The search engine would first use its own database, before searching else where for your topic of search.

http://c0vertl.tripod.com/search.htm

The above link is a collection of various search engines, located all over the world, and not reliant on say, google's own bias for its customers.

------

I am using ethereal to sniff my traffic from my laptop to the ISP, The results of the ethereal capture are posted in the code section, with comments.

ISP Sniff 1

In the packet capture you can see my Yahoo YIM trying to reach out to home server, and you can see the ISP use my computer name "nomad".

You can see the modem making contact with the LAN, using MAC addressing to identify itself. DHCP also usually relies on MAC addresses to manage the unique assignment of IP addresses to devices. This should be called the Link Configuration packets.

My interface
Description . . . . . . . . . . . : WAN (PPP/SLIP) Interface
Physical Address. . . . . . . . . : 00-53-45-00-00-00

(I am running out of time tonight, can anyone explain why the Physical address only refers to xx-53-45-xx-xx-xx in the ipconfig, and the packets display Destination: 20:53:45:4e:44:04??? )




---

http://en.wikipedia.org/wiki/Colocation_centre
http://www.dmoz.org/Business/Telecommun ... location//
http://www.datacentermap.com/
http://ws.edu.isoc.org/data/2005/413634 ... d1-6up.pdf
Last edited by DNR on 07 Feb 2009, 18:57, edited 9 times in total.
-
He gives wisdom to the wise and knowledge to the discerning. He reveals deep and hidden things; he knows what lies in Darkness, and Light dwells with him.

User avatar
DNR
Digital Mercenary
Digital Mercenary
Posts: 6114
Joined: 24 Feb 2006, 17:00
18
Location: Michigan USA
Contact:

Enable terminal window for dial-up

Post by DNR »

Your Internet connection dials the ISP and logs you on. The logon sequence varies based on the requirements of the ISP that you are calling. Point-to-Point Protocol (PPP) connections are often entirely automatic. Serial Line Internet Protocol (SLIP) connections may require that you log on using the terminal window, which may or may not permit you to automate the logon process with Switch.inf file scripts. You can set the terminal window to appear during the logon process by selecting Show terminal window on the Security tab of the Dial-up Connection Properties dialog box.

*in progress

About SSDP
The Simple Service Discovery Protocol (SSDP) enables detection of Universal Plug and Play (UPnP) devices on your home network. This service listens for UPnP connections at TCP port 5000 and UDP port 1900.
UPnP device is the Internet Gateway Devices (IGD) like routers, firewalls or computers running Internet Connection Sharing (from my ISP).

SSDP: Method = M-SEARCH
SSDP: Uniform Resource Identifier = *
SSDP: HTTP Protocol Version = HTTP/1.1
SSDP: Host = 239.255.255.250:1900
SSDP: Search Target = urn:schemas-upnp-org:device:InternetGatewayDevice:1
SSDP: Mandatory Extension = "ssdp:discover"

Windows Messenger does not use the built-in Universal Plug and Play services. Windows Messenger formats and sends the SSDP discovery messages.
I typed services.msc, scrolled for SSDP, and looked at propertires to see if the ISP is hooked into this..
The Dependacies tab indicated it was manually initiated and HTTP needs the service. In the Logon Tab, I found a long password for the 'network', I fired up a **astrisk unhider to reveal the password..
It didn't work..The password and user length are the same, and are more digits than the cellphone number..
The Dependacies for SSDP indicated that Windows Media Player Service is hooked into it, I looked under services.msc for this, and it showed that is using it for HTTP and SSL connections. This has nothing to do with windows media player, but it is a service. Service applications typically provide features such as client/server applications.

What is 239.255.255.250?
The reason you can't ping or trace route to 239.255.255.250 is that it's not a host, per se. Internet routers will ignore that IP because it is not a valid IP for an Internet host.

However, if a router has UPnP enabled, and received UPnP packet on port 1900, it would respond. The IP address 239.255.255.250 is just a standard place to send UPnP traffic. All UPnP compliant devices are configured to listen on that IP and port and will respond.
-
He gives wisdom to the wise and knowledge to the discerning. He reveals deep and hidden things; he knows what lies in Darkness, and Light dwells with him.

User avatar
computathug
Administrator
Administrator
Posts: 2693
Joined: 29 Mar 2007, 16:00
17
Location: UK
Contact:

Post by computathug »

Nice read buddy.

Its good to see whats happening when we use our computers. Sniffing traffic helps us to see how things progress when connecting over the web.

Another good site which which lets you know if your ISP is throttling your bit torrent connections that i found is

http://broadband.mpi-sws.org/transparency/bttest.php

It may take a few attemts but it does work :wink:

Another good source of info on your ISP

http://www.azureuswiki.com/index.php/Bad_ISPs

eppik
Fame ! Where are the chicks?!
Fame ! Where are the chicks?!
Posts: 212
Joined: 26 Mar 2006, 16:00
18
Location: Infinite Loop
Contact:

Post by eppik »

Bastards! Now I understand why i'd download at 1400Kb/s from Windows update and upload to ftp at 102Kb/s, but on utorrent I never EVER got over 600Kb/s dl and 98kb/s Upload, not even with 20+ consecutive downloads.

BTW the azureus wiki says that all networks on my country throtle 0__0

User avatar
DNR
Digital Mercenary
Digital Mercenary
Posts: 6114
Joined: 24 Feb 2006, 17:00
18
Location: Michigan USA
Contact:

Post by DNR »

eppik - As more ISPs/Telco companies use the Internet for voice, video/TV, and data/internet "Bundles' more people are going to clog the internet with phone calls, TV programming and more internet use - like in webcams, myspace shit. Throttling is the ONLY way to ensure customers get a certain level of QoS (quality of service) - Cheap Bundling of TV/Phone/Internet means more traffic on the IP devices on the WAN.

Customers should at least be aware of which companies throttle LESS, which companies throttle certain ports (tor) over others. You also investigate if certain tactics like changing the port number and encrypting your traffic works on that particular ISP's network..

DNR
-
He gives wisdom to the wise and knowledge to the discerning. He reveals deep and hidden things; he knows what lies in Darkness, and Light dwells with him.

User avatar
icebandit
Newbie
Newbie
Posts: 2
Joined: 20 Dec 2006, 17:00
17
Location: Interweb
Contact:

Post by icebandit »

very handy read thanks dude!
I was actually pretty surprised to see this method still works pretty decently.

User avatar
hpprinter100
Fame ! Where are the chicks?!
Fame ! Where are the chicks?!
Posts: 214
Joined: 19 Oct 2007, 16:00
16
Contact:

Post by hpprinter100 »

that bittorent test is very useful =D

User avatar
DNR
Digital Mercenary
Digital Mercenary
Posts: 6114
Joined: 24 Feb 2006, 17:00
18
Location: Michigan USA
Contact:

Post by DNR »

hmm forgot about this, thanks for digging it up of out the pile :wink:

This topic deserves a rework for suck-o 2v..

DNR
-
He gives wisdom to the wise and knowledge to the discerning. He reveals deep and hidden things; he knows what lies in Darkness, and Light dwells with him.

Post Reply