Does TCP connection established between client and server goes via ISP

Naveen Rai 0
Viewed 24

I would like to go deeper into what all parties are involved once TCP connection established. As a client (e.g. my Laptop and I am at home) establishes TCP connection with server hosting the public website of my interest (say bing.com).

As my laptop does not NOT public IP but my ISP has, does my ISP (Internet service provider) server participates in TCP connection? if yes then how? Also, TLS handshake happens with ISP or client ?

can anyone please help me give the detail picture how these happens ?

Thanks for your time!

tls1.3 tls1.2 tcp ssl
1 Answers

What is the expectation on an ISP and how it usually works

ISP in most case only forward packets, i.e. they are not involved in the TCP or TLS handshake between a client behind the ISP and server outside the ISP except for making sure that the packets will reach the intended destination.

But, an ISP could behave differently ...

Since all the packets pass the ISP's network they have the ability to mess with the packets - specifically they can view the packets content, block packets, inject packets or do their own reply to packets. They thus have the ability to do the TCP handshake in place of the actually intended target. This abilities are usually used in the context of law enforcement only, were government agencies connect their own equipment to the ISP and let the ISP direct packets with specific properties (like from a specific customer) to this government equipment. These capabilities were used in the past also to inject advertisements into web traffic. See also Chinese ISPs Caught Injecting Ads and Malware into Web Pages or Sandvine’s PacketLogic Devices Used to Deploy Government Spyware in Turkey and Redirect Egyptian Users to Affiliate Ads?.

A less harmful use of this capabilities were transparent proxies, which were used in the past to cache often accessed content at the ISP in order to save upstream bandwidth and have faster answers to the clients web requests.

Such transparent interception and modification works only with plain traffic though. With the growing use of encrypted connections (i.e. HTTPS, TLS, ...) both bad and good use cases for transparent interception stop working since part of encryption protocols like TLS is the authentication of the server. Man in the middle like the ISP can usually not authenticate as the intended target, although there are attempts to do so by making trust in the government mandatory or by hacking certificate authorities: see Kazakhstan man-in-the-middle attack or An update on attempted man-in-the-middle attacks

Steffen Ullrich0
Related