## 4 Attack Surface Analysis
### Gateway to Internet Service Provider
#### 4.3.1 Sessions with Internet Activity
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Protocol** & **Information** & **Packet Description** \\ \hline ICMPv6 & Router advertisement & Message sent by routers to advertise its presence for helping devices configure IPv6 address. \\ \hline ICMPv6 & Multicast listener report message v2 & Multicast listener Discovery (MLD) protocol used to indicate listening to certain multicast groups. \\ \hline ICMPv6 & Neighbor advertisement & Response to neighbor solicitation by devices to advertise their link-layer address. \\ \hline ICMPv6 & Echo (ping) request id, seq = 0 and 1, hop limit = 1 (multicast) & Ping request used for network diagnostic or control purposes. \\ \hline IGMPv3 & Membership report/leave group & Indicates leaving a multicast group. \\ \hline IGMPv3 & Membership report/join group & Indicates joining a multicast group. \\ \hline NBNS & Name query & NetBIOS Name Service (NBNS) query for changing a NetBIOS name into the corresponding IP address. \\ \hline NBNS & Refresh NB USERS & NetBIOS Name Service refresh request for maintaining the registration of NetBIOS name on the network. \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Data packets found during experiment with Internet activity in ISP router. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Protocol** & **Information** & **Packet Description** \\ \hline ICMPv6 & Neighbor solicitation & Protocol used by devices to discover the link-layer addresses of other devices on the same network. \\ \hline DHCPv6 & Solicit & This was sent by devices for locating DHCPv6 servers on the ISP network. \\ \hline IGMPv2 & Membership report group & Protocol used by a device to inform routers that it wants to receive traffic for a specific multicast group. \\ \hline SSDP & M-SEARCH * HTTP/1.1 & Simple Service Discovery Protocol (SSDP) that is used for discovering plug-and-play devices on a local network. * means broadcast to all. \\ \hline DHCP & DHCP discover & Protocol used by devices on the network to find the DHCP servers and obtain IP address and other network configuration information. \\ \hline MDNS & Standard query & Multicast DNS (MDNS) is used for resolving hostnames to IP addresses. \\ \hline ARP & Who has and tell & Query used to find MAC address that corresponds to the specific IP address and sent to the device specified in tell. \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Data packets found during experiment with Internet activity in both ISP router and personal router. security protocol configurations. Since the routers were set up automatically, they employed different configurations, primarily for multicasting and router advertising, resulting in the observed diversity in data packets. After examining the Pcap (packet capture) file that monitors Internet activities, it was found that no suspicious packets that passed between routers were detected. The ISP did not initiate any queries through the router that could pose security risks, nor were they actively gathering data from users' ends. Most of the observed packets were associated with devices communicating with each other within the network. Hence, it is plausible that the ISP collects user data within their cloud architecture, likely achieved by analyzing specific packets and correlating them with known device types. To explore potential suspicious activities during a device's idle periods, an experiment was conducted, as outlined in the following section. Although the experiment revealed that no suspicious packets were actively injected by the ISP or router firmware, it is important to clarify the potential implications of ISP-controlled routers beyond the application layer. Specifically, ISP-provided firmware may expose Layer 2 (MAC address) information, which would otherwise be invisible beyond the router boundary due to standard IP routing constraints. This would enable customer profiling or device fingerprinting by correlating MAC addresses, device types, and browsing behavior.