• 2 Posts
  • 121 Comments
Joined 3 years ago
cake
Cake day: June 25th, 2023

help-circle

















  • Verizon and ATT just rebrand nokia ONTs and roll some of their own software that is mostly enhanced or changed encryption at L1. Can’t speak for Comcast, I only know about the other two as I’m in a smaller ISP that competes with them.

    They use have L2 onts that don’t have any gateway functions, just fiber to ethernet with some extra overhead to monitor the connection between the hose and shelf.

    The ONT-on-a-stick units do the same thing, just a more compact and expensive interface that doesn’t have great support, unless comcast or running all home run fibers where they can just provide a straight SFP instead of doing any optical splitting.


  • No, you are likely looking at an ONT (optical network terminal), and it is not a router. Even with a port that accepts the fiber (sfp or sfp+ for 10g) on your equipment, the OLT (optical line terminal) likely will not provide you with service.

    If you were to match the wavelengths the ISP is using you are likely to become a “rogue” on their PON that can knock out service for other customers that share the same passive network as you.

    I make assumptions about you being on PON since you say AT&T, generally all I have ever seen from them are passive networks (one fiber with splitters for 1 port to many customers) unless you are paying extra for “dedicated” ($$$$$) internet.

    If they are using a ONT with an “RG” (residential gateway) which is the typical “all in one” you can request the gateway service can be removed and replaced with a layer 2 bridge, where you’re router/firewall gets the “external” addressing and there is nothing being done by the ISP equipment other than sending you traffic and OAM (operations, administration, and maintenance; usually check or alert for light levels, software status, if a part of the ONT fails etc).


  • There are definitely multiple ways they can block traffic to a site, but you have to be sending traffic through them or using DNS from them, or placing your site behind them using them for protection from denial of service attacks.

    Firstly, if you pay or use their free “anti-ddos” services, what is really happening is all traffic to your site is being sent through their network. Should you violate their terms of service, they can choose to terminate that traffic.

    DNS is Domain name service, where I want to visit example.com, and DNS tells the computer to go to 12.34.56.78. The DNS server your computer will ultimately use can be assigned by your ISP, manually configured by your network administrator, etc. One choice you can use, that is regarded by some as a good choice due to response time, is cloudflare. When cloudflare decides to block a site, one method they may use is to redirect DNS replies for that domain to a placeholder that indicates this site is blocked, or reply with NXDOMAIN - Non-eXistent domain.

    An ISP could also choose to buy bandwidth from cloudflare as an upstream provider. For cloudflare enforcing a block, they would redirect traffic destined for any of address they want to a placeholder just like DNS.

    A more aggressive, and dangerous tactic that could cause global outages for a site, would be to falsely claim address as their own to the public internet with Border Gateway Protocol - BGP, then redirect/blackhole it.