Router operation?

Question

Computer networks

Добрый день, следующий вопрос.
У нас есть роутер, в нём стоит сим карта от оператора, роутер раздаёт вайфай, к вай фай подключается например 3 компа, видит ли оператор сотовой связи который обслуживает сим карту, что данная сим карта раздаёт вайфай, видит ли какие либо данные о тех кто подключаеться по вайфай? или же он видит только данные от роутера, такие как emei и mac ? Спасибо всем зарание за ответы.

Answer 1

The situation is the following.
Each device in the cellular network, at the time of registration, informs the network of its IMEI - the device code, by which you can uniquely identify the model of your device.
Yes, you need an IMEI base with device capabilities - a description of what kind of device it is and what it can do. But the mobile operator already has it: When you first inserted a SIM card into a new phone, did you receive an SMS Internet settings? The settings for different manufacturers are slightly different, so you need to know the model of the subscriber unit.
It turns out that as soon as you insert a SIM card into a Wi-Fi router, the operator, without additional equipment, understands that this is a router, which means that it will distribute the Internet via Wi-Fi. This is the first frontier of detection, and its implementation by the operator is completely free.
Second frontier: TTL analysis, as Fixid wrote .
It should be understood that only the routers themselves will be caught at the first line, and the Wi-Fi access point enabled in the phone settings is not visible to the operator.
But there is a trick: a device that distributes the Internet via Wi-Fi will, by default, reduce the TTL field on all ip packets passing through it.
Knowing the typical initial TTL values ​​​​for mobile platforms, you can react to all other values ​​\u200b\u200bas a signal that Wi-Fi is hiding somewhere)
To implement this, the operator will already need additional costs.
It is clear that no one will install a separate device to catch Wi-Fi lovers, so usually the operator's DPI is engaged in this - a complex that classifies and "colors" subscriber traffic, thanks to which it becomes possible, for example, free VKontakte for some operators. But, firstly, surprisingly, not all DPIs can do this. Secondly, those that can, can do it for some money in the form of a license to be purchased.
There is also a third frontier, especially for catching tricky subscribers like the same Fixid ;)
This is a heuristic.
The topic is interesting and exciting.
Yes, the subscriber can change the IMEI directly in the phone settings.
Yes, the subscriber can reflash the phone so that it does not touch TTL.
But, as soon as there are a lot of cunning subscribers, it becomes profitable for the operator to invest in advanced traffic analysis.
So what can be done?
Well, right off the bat:
Do you access the Internet directly from your phone through the built-in browser? Congratulations, you just told the operator in the User-Agent field of the HTTP protocol what mobile platform you have and what version!
How is it that from one device the operator sees different User-Agents, pointing either to Android or to Apple? Guys, do you have Wi-Fi there!
TCP/IP fingerprinting. Different mobile platforms (like Android/Apple) use different initial field values ​​in ip packets. Yes, take at least the same TCP Window size! Analyzing them, one can guess at least the platform manufacturer. And combining this with the same IMEI analysis...
Guys, how is it: the device itself is from Apple, and the values ​​​​of the fields in ip-packets are typical for Windows Phone?
Or why does your traffic look like Android or Blackberry?
All the more, not every DPI can do this, and who can, can, even more so separate money for a license. Yes, and the performance of such an analysis squanders very well ... But, nevertheless, if it works, it's possible.