## 4 Attack Surface Analysis
### Gateway to Internet Service Provider
#### 4.3.1 Sessions with Internet Activity  
During the experiment, the type and duration of web activities were kept the same on both routers for consistency. Table 4 details the Internet activities, along with their durations, that were performed during the experiment. The total duration of the experiment with Internet activities on each router was 70 min. Online marketplaces and business websites were visited and certain products were searched to determine the types of data packets exchanged through the router. By analyzing the data packets, we could check if malicious data packets were being exchanged through the router. Malicious data packets refer to not only data packets that could harm the user's devices but also unauthorized ones that might be used to expose information about user's devices or networks. Figure 3 shows the overall steps of the experiment with the Internet activity. Initially, the LANProbe was physically connected between the router and the modern to access the network. This setup allowed for the monitoring of traffic departing from \begin{table}
\begin{tabular}{c l l} \hline \hline
**Sl. No.** & **Activity Details** & **Duration (min)** \\ \hline
1 & Search the Internet browser for shoes and visit three individual business websites & 0–9 \\ \hline
2 & Go to an online marketplace and search for a 32\({}^{\prime\prime}\) TV & 11–13 \\ \hline
3 & Go to another online marketplace and search for a 32\({}^{\prime\prime}\) TV & 14–16 \\ \hline
4 & Stream short videos & 17–31 \\ \hline
5 & Create an account in an online learning platform & 33–35 \\ \hline
6 & Log in to the university student portal & 36–38 \\ \hline
7 & Use personal email to send messages, pictures, and documents & 39–49 \\ \hline
8 & Turn on incognito mode and search for hotels and gaming console deals from online marketplaces & 50–58 \\ \hline
9 & Turn off incognito mode and stream a movie & 59–65 \\ \hline
10 & Sit idle with the browser open & 66–70 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Internet activities with durations. Figure 3: Flowchart of experiment with Internet activities. the WLAN to the ISP. In addition, a laptop was connected to the LANProbe to monitor the data packets that flowed through the router using Wireshark. Once the Wireshark session was initiated, the activities described in Table 4 were carried out for their designated durations. Upon completion of all activities, the Wireshark session was saved and subsequently analyzed. Some of the common packets found on both routers are shown in Table 5, along with the protocol and its description. Most of them were standard data packets that we expected to find during the Wireshark session. Table 6 illustrates the data packets exclusive to the ISP router. Among these, a notable discovery was the presence of ping request packets, commonly used for network diagnostics to assess device connectivity. The frequency of ping requests averaged about 26 per 1000 s. Furthermore, the remaining unique packets identified were deemed safe, with no indication of suspicious packet exchanges. Table 7 displays the majority of data packets isolated from the personal router. No signs of suspicious activity were detected. Analysis revealed that the variance in data packets between routers was caused by two primary factors: firmware variations and