Some ISPs don't charge for bandwidth used on Youtube/Netflix/Facebook. How do they monitor that?
Jan 5
In Poland, it is common for mobile ISPs to offer plans with limited amount of bandwidth per month, with exclusion of some popular apps. So for example all traffic from YouTube is not counted towards the data cap.
Aside from net neutrality issues, I am wondering how is this achieved in the HTTPS age? How does the ISP know which packets to count towards the data cap?
I know it could be done with just looking at the IP address, but YouTube has a ton of IPs, and I suspect they change all the time. Plus, I wouldn't be surprised if some of YouTube's IPs are shared with other Google services, which are not uncapped by the ISPs...
1 answer
Accepted answer · original discussion
Jan 5
Firstly they know the YouTube IP address.
ISP's have an IP database. For example YouTube's ASN is AS15169. On the server side they would make a grouping for each service. One of them is the default grouping and this is the billing group. When you make use of default group, that usage is recorded in the system.
For example a few YouTube addresses are listed below.
root@server ~>whois -h whois.radb.net -- '-i origin AS15169' | grep ^route
route: 192.179.147.0/24
route: 192.179.148.0/23
route: 192.179.148.0/24
route: 192.179.149.0/24
route: 192.179.150.0/23
route: 192.179.150.0/
...
route6: 2607:f8b0:4016::/48
route6: 2604:31C0::/32
route6: 2620:33:c000::/48
route6: 2607:f8b0:4000::/48
route6: 2404:f340::/32
When you are trying to reach YouTube or other YouTube services (Google video storage) your phone will try to reach these IP addresses.
The ISP checks the IP address, and if it is inside the YouTube group, they don't apply charge at this group.
Another option is checking the SNI header at the initial HTTP connection. When you make a connection with HTTPS sites not all the data is encrypted.
For example, when you make a search on Google, you can see the URL in your browser like this: https://www.google.com/search?q=hello+world.
Encrypted data is /search?q=hello+world and all page content. Now you are reaching a site like www.google.com, but they don't know which page or the content inside of that page.
Some ISPs use SNI for this. For example in Turkey this method is used for making specific internet packages like 5GB internet+4GB Spotify or 7GB internet with unlimited WhatsApp. Also they use SNI for banning websites. Some websites use the same IP addresses like wikimedia.com or wikipedia.org. If they try to block Wikipedia with an IP addresses they block all Wikimedia services.
3 question comments
Use comments to ask for clarification. Post a solution as an answer.
Jan 7