Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know in a home network, there are softwares that can monitor the TCP conversation occurred in the network and are capable of recording the download links sent from a computer. But my question is from an ISP level, because they use dynamic IP to address customer, would they be able to capture which links a user downloads? Thank you.

share|improve this question

closed as off topic by EEAA, GregD, Ward, John Gardeniers, Shane Madden Oct 3 '11 at 16:52

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

They no only can, in some places it's a legal requirement. – John Gardeniers Oct 3 '11 at 7:19
up vote 6 down vote accepted

In short, yes.

Any unencrypted traffic is subject to being monitored at any point between your LAN edge (be it a cable modem, dsl modem, FIOS termination box, etc.) and the destination server. The fact that you have a dynamic IP offers no protection. The ISP keeps logs of which IP addresses were handed out to which customers, complete with timestamps of how long that DHCP lease was active.

If you are browsing an SSL-secured website, the ISP will be able to see which IP address(es) you're communicating with, but the contents of that communication will be encrypted and as such, not easily accessible.

share|improve this answer
Added explanation -- DHCP assigns the dynamic IP to a MAC/HMAC address that has been provisioned to enable its internet access. The IP/MAC pair is logged. They know your HMAC, ergo you are using this specific IP at this specific time span. – Fiasco Labs Oct 3 '11 at 3:50

They can monitor the traffic that is coming from your connection which would allow them to track the unencrypted traffic that you send.

If you use something like Tor that will proxy your connection through a Tor relay so they will only be able to tell that you made an encrypted connection to a Tor node.

If you run a Tor relay, then other people will use your internet connection and they won't be able to say whether it was you going to those sites.

Similarly, although I haven't seen any cases proving it, if you run an open WiFi network, you could claim that someone else could have been using your connection. I first heard the idea from Bruce Schneier.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.