ISP is watching you...

[rowdy_yates]

Yes. But I can give greens to poster for the Tor reference. Green given.

[|3lack|ce]

I got him Geek... also fed rowdy back his reds. Thanks rowdy - here's 10 times that many back. Next time let your post suffice please?

[edit]

We have to go by what was posted and reply according. One can assume all they want, but it's important to reply to what was posted. Inquiring about logging activities does not flag one a possible malicious user.

Actually, we DO have to read between the lines - that's part of being a security-oriented administrator. It didn't necessarily flag him as a possible malicious user, it just put him in that 'suspicious' category. In truth, I filed him as 'wanting to learn how,' and responded accordingly, giving little information, but a decent response nonetheless. Amazingly enough, I was somewhat 'out of character' in that particular response - my norm is to slam them completely - in this case I instructed...a bit.

Now tell the class, young Rowdy, what did you actually contribute to this person's inquiry?[/edit]

[rowdy_yates]

Originally posted here by |3lack|ce
Now tell the class, young Rowdy, what did you actually contribute to this person's inquiry?[/edit]

Hi. Yes, I believe that the OP's question has been answered quite well by other contributors. I don't think I can add anything of value at this point.

Take care.

[MrMarbles]

I see that they monitor for "potentially hazardous open port"... meaning that they are scanning your for viruses, open relays, other servers? Their AUP says you can't operate any server...

I seem to be regularly (almost exclusively) port scanned by addresses within the same range as me. I thought it might be the ISP checking on my "potentially hazardous open ports" . I asked my ISP for some explanation or if they were responsible for annoying alerts from my firewall and their response was that "no it must be another of our customers". Nice. Thanks.

Anyone have any ideas why they would all come from the same range as me?

[MrLinus]

Anyone have any ideas why they would all come from the same range as me?

Yup. Two possibilities. The most likely one is that your subnet neighbours suck at AV and are infected with worms that are looking for new places to propogate to. Hug your firewall. It's doing it's job by notifying you.

The second one is that you have subnet neighbours that have too much time on their hands and are playing with one or more of a variety of port/vulnerability scanners in hope that they find something vulnerable. Again, hug your firewall. It's doing it's job.

[MrMarbles]

well i like a hug, but never been particularly neighbourly

Excuse my naivety but is it common for these worms to attack IP's from the same ISP as their victim?

[MrLinus]

Yup. First one to do that, IIRC, was Code Red (way back when). It makes it easier to do a scan locally than trying to go across the internet.

Here's some links to help:

http://www.icir.org/vern/dimacs-large-attacks/gao.ppt
http://www.ieee-infocom.org/2003/papers/46_03.PDF
http://www.cs.berkeley.edu/~nweaver/worms.pdf
http://www.acsac.org/2004/papers/145.pdf

[scratchONtheBOX]

ISP is really watching us here in KSA

In my case, with the strict policy here (supporting the local customs and traditions), ISP here, together with the STRONG support of the Government is not only “WATCHING” the cyberspace activities but also “CONTROLLING” it.

It’s a BIG task for the Gov’t and ISP hand-in-hand doing this FILTERING activities. I have heard that they have the whole UNIVERSITY FACILITY to carry on the tasks and maintaining it. By this way, the students (who will be the future employees) of the FACILITY are learning the INS and OUTS of Network Security Infrastructure and the Internet.

I am just wondering although I get the BIG picture, but can you imagine how BIG their FACILITY is and their activities over there just to control and filter the NET here? I am not really sure but I could say that it will be BIG for the WHOLE COUNTRY to control it. And what may be the contributions of the ISP (maybe more than 10 major providers here).

The idea is, for an instance, you came across a BAD website (Porn or something against their CUSTOMS, TRADITIONS and RULES), after a couple of minutes, try to check the page again and VOILA – “ACCESS TO URL IS BLOCKED” message will show. I mean they are really that FAST!

Just an additional idea regarding what your ISP and the Government can do.

Yo!

[MrCoffee]

MrMarbles:
My ISP port scans me on a regular schedule, thou i doubt is has anything to do with "Hazardous" Ports. I get about a gillion portscan log enties a month from them hitting my firewall.

Back to the orginal question:
I am unsure why everyone is so sure that your ISP CARES about your internet activity. Or why they would both retaining or reviewing a log of whatever you are doing, especially if you are a home user. Unless another ISP or party complains about your activities, why bother? Does everyone really think that Internet America (example) has the time or the energy to browse thru the logs of all 500,000 users? (I picked them because I get a number of exploits/attacks from their dialup accounts).
I worked for a mid sized ISP and with a second small ISP, and between support calls comming in and all the general confusion that goes hand in hand with any large network (and your ISP is nothing more then a LARGE network when you think about it) do you not think that the Admins dont have better things to do with their time?
The level of detail you are talking about ...... it is possible, but WHY? Unless you are 1) a drain on their resouces and they want to know WHY, or 2) They can find a reason to charge you more (say move you from personal to business class). or 3) you are causing complaints. (Which falls under their AUP I am sure)
While some ISP's maybe track every move you make (The two I worked at didnt as far as I ever knew) it seems like it would be a lot less then cost effective for ANY business model for that kind of a manpower to results ratio.

Again, I am trying to think of this as ISP Admin or Owner, and how I want to use my resources and manpower. Why do I CARE if you are downloading Debbie Does Data or Windows XP or The Moody Blues Greatest hits? My AUP is going to say expressly that those activities are not allowed, so the ISP is covered legally.

I can see logging of activities, but reviewing them without a cause? Not likely.

[Black Cluster]

Hey guys,

Filtering the web is not easy task to undertake. As we all know the Internet should be open to all people to access any website they want, At least it should be so, regardless of what IPSs do.

Filtering the web has no meaning whatsoever. Its just like fooling people to generate some meaningless fears inside peoples. This is too bad practice, guys.

Originally posted here by scratchONtheBOX
Just an additional idea regarding what your ISP and the Government can do.

Yo! [/B]

Partialy, I don't agree.
They are trying to do so "But they could not do that YET". Internet is a "Freedom-reign body" no one can deny this. Always FREEDOM shall WIN.

For me, I can access any website I want, regardless of what my ISP might use to prevent me.
Filtering the web works only with Internet novices. Ask any one who used the Internet, say 1 year now, Does the ISP proxy prevent you from any website you wish to visit? The answer will be NO

Always FREEDOM REIGNS

Just my $0.02

Cheers