Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently I wondered why my router shows a constant downstream of 5 MBit/s, while I am downloading almost no data. I discovered the "packet logging" function of my router, with which I was able to log all the traffic in the wireshark format. And I recognized that 80% of the downstream traffic was not for my IP address, so it just gets discarded (probably). When tapping the "internet interface" of my router, I could see the downstream packets of IP-adresses that is not mine: Mail addresses from other people, DNS query responses from other people, http-responses from other people...

My question: The fact that I can see other people's downstream, is this normal or is it a misconfiguration on the side of the ISP?

I doubt that it's normal, because this causes a lot of unnecessary traffic, which is bad for me, bad for the ISP and also a data privacy issue for everyone.

share|improve this question
That isn't normal, what sort of connectivity do you have? – NickW Mar 14 '14 at 11:31
Something is very badly configured at the lower levels, do as SvW suggests. – NickW Mar 14 '14 at 11:38
Note that this means your data is being seen by other customers. – Adam Davis Mar 14 '14 at 14:10
This isn't about professional IT and thus isn't on topic for Server Fault. Flagged for migration to Super User. – Blacklight Shining Mar 14 '14 at 23:25
@BlacklightShining if I had the same problem I would just look on google and it will give me server fault, since it's already here ;) – Braiam Mar 15 '14 at 16:57
up vote 12 down vote accepted

It has been a while since I consulted to the telecom industry so I am going off of what is still likely.

For DSL, this is sub-par. You should never see traffic destined for another IP address. I would check with your provider. This is not a standard configuration and it is likely that there are some settings in the RedBack that are not right. Each connection should be segmented and the bandwidth you are paying for by contract is being wasted. DSL connections are frame connections when you whittle through all of the protocols. This means that your frame connection must only see the traffic for your segment.

For Cable, this is normal. Cable is segmented by neighborhoods depending upon area saturation. A neighborhood could be many miles or one block. This is normal since cable is not a frame connection but based upon broadcast standards much like ethernet over thin-net/thick-net back in the day. Your cable router may or may not enforce network segmentation depending upon the router, either by age or by model. Cable connections almost always see traffic on the WAN side that is not intended for the LAN. But sometimes WAN traffic can be seen on the LAN side. This is not unusual even today with the larger carriers.

share|improve this answer
Wouldn't you have encryption on a cable network? – thejh Mar 16 '14 at 15:22
I guess it depends on the carrier. Encryption aside, if traffic is making it's way to the LAN side, it is actually trivial to examine the traffic with the right tools and experience. In fact, it may be trivial to sniff the WAN side too. I used to have to examine traffic including encrypted data near daily with a hardware sniffer to solve network problems. – closetnoc Mar 16 '14 at 16:35
I quoted a part of your answer in my question on Security SE. – unor Mar 19 '14 at 0:00
I see it. Thanks. I posted an answer, but I am sure a better answer will come along soon. – closetnoc Mar 19 '14 at 1:29
I also was under the impressions that all cable ISPs use BPI these days. – Fred Thomsen Mar 23 '14 at 0:12

No, this is not normal. Contact your provider to resolve this issue. When they can't, switch away ASAP.

share|improve this answer

If it's cable, by definition it's shared circuit. Seeing other people's downstream under global logging of all packets would be normal.

Promisc mode cable gear would be an interesting anomaly but that sounds like exactly what is happening.

share|improve this answer
Major cable companies are going to generally route through fibre nodes, and only those nodes are "shared circuit". No cable ISP in the United States would have such a configuration that would make this possible. – Thebluefish Mar 15 '14 at 12:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.