I have a question and I hope someone in the antionline community can help me out.

When reading the latest issue of 2600, I noticed the author of the "uncapping your cable modem" article was able to see his ISP sniff his network. I have no doubt that they can monitor all traffic coming in and out of your cable modem. My question is how can you see them sniffing your traffic? I have a sniffer that monitors traffic at my router and all I see is port 53 (DNS) connections to port 1900 on my router. I'm assuming they do this to see if your cable modem is up and accepting connection. If not they take your IP and give it to someone else. Anyone have any ideas on how they do this?