US Cable Support > Mediacom > Mediacom redirect service-opted out, still hijacks searches.

Mediacom redirect service-opted out, still hijacks searches.

I've seen a few posts about that service recently. I just tried it on my computer. I was opted in by default of course so I opted out. I don't get their redirects for typos anymore, but I get it for 404 pages still. I can't even enable the Adult filter or enable the typo correction service. They are always disabled no matter what I click. Only the one at the top actually changes after clicking save but it doesn't opt us out of the service fully I guess. Looks like Mediacom is having a problem. There are posts on their Mediacomcable.com forums on this, too. Maybe Mediacom Chad has some information on it.

reply to Dave7
I've seen a few posts about this behavior recently...never experienced it myself. Then again I've been using OpenDNS for so long...are you setting the 3rd party DNS in your router or just on a specific machine on the network?

Yea, setting it up in the router, and it seems to be working too. Namebench recognizes my current DNS as 8.8.8.8 or 8.8.4.4 when using Google DNS and some random address under Mediacom DNS (whatever they use).

reply to Dave7
Very strange. Setting it up in the router (that is, removing mediacom DNS and using a static third-party address(es) ) should take care of any 'hijacking' or redirection attempts by Mediacom. I've never had any trouble...Might want to ask MediacomChad about it.

reply to pabster
There are two different redirects they do. One for domains that don't exist and one for 404 pages. The 404 pages one doesn't matter what dns you use it seems, it looks like they're just injecting the information on the line whenever the system sees a 404 page(Sandvine in action). My neighbors computer doesn't get the page at all, but mine gets it even if I'm opted in or out. Something is going on. It's not annoying enough for me to call them for it, anyways I'm sure they know about it by now since they roam these forums. I only got the page by purposely trying to get it, it's not like it's interfering with my browsing. I don't care if they redirect traffic or not, I've sen plenty of businesses do it, but I see it could make a few people angry if they have no way of making it stop.

The redirect happens for me in firefox only. If I type anything into the address bar of IE I get a google search but firefox sends me to mediacom. It is slightly annoying but I normally just use the google search bar for searching and the address bar for addresses.

...
After opting out and closing firefox and opening it back up it doesn't happen anymore.

...
Forgot to mention I am using open dns also.

I've been seeing redirects using open dns. They are trying to pick up add revenue. I have a feeling they are having some real financial problems. The would explain the slow response to addressing all of the oversold nodes. I have a feeling they are going to go under soon.

reply to Dave7
Where is the option to opt out for this feature? I was never aware we had the option

Never used to do it, then it started one day. has made me mad since that day and just assumed I could not do anything about it.

(Perhaps I will roll over to a third party DNS if I cannot disable it?)

reply to Dave7
I had always had a suspicion that they were doing it somehow, but I never took the time to research it.

I do remember doing some testing, and when my computer would send a packet to 8.8.4.4, it would get a return from a mediacom DNS server...

Never really got too far into it.

As far as contacting Mediacom's Social media team, if there is something like this going on, odds are they aren't being informed. When some of mediacoms dumbest policies were started, they never asked anybody who actually spoke to customers (Mediacom MAX + Home networking bundle requirement)
--
I'm tired of killing stupid people just trying to do my job and go home!

reply to Dave7
We are working to resolve this now. We are actually trying to get some new examples to retest after we did some changes. Can anyone please send me your account# so I can send this to NOC to retest?

I have determined this is due to deep packet inspection. I've included details in the blog post linked below.

»wiiuse.net/blog/?p=207

reply to Dave7
I've still yet to see this. I don't get the Mediacom ads or redirects. I've never opted-out of the service and have used OpenDNS for years as I said. I tried the searches listed in that wiki and got the normal Google results as you would expect, rather than being hijacked by Mediacom. If they were really doing DPI in this scenario I would receive the Mediacom ads and results. So not sure what is really going on.

reply to Dmnchild

reply to pabster
Well it is definitely DPI. They are clearly using a web proxy, however I can not say if they are only inspecting traffic to Google's search servers on tcp port 80 or all web traffic. I suspect since this only appears to occur when a specific Google search is executed that they are only filtering traffic on their network when the destination IP is one (or all of) Google's search servers on tcp port 80 and sending a fake reply when the HTTP GET string is in a particular format.

During testing I noticed this redirection occurred about 75% of the time. I can't really make any meaningful conclusion off of that -- they could either be testing it, or trying to mask it by not filtering 100% of the time. In either case if definitely happens and is not the result of DNS. The only way they can redirect traffic in this way is inspection and http proxy.

I have a packet capture of it happening, and I've pasted the relevant data in the link I posted earlier.

This doesn't really bother me too much, but it's one of those things where if they do this and they don't come out and admit it up front, what else are they willing to do.. inspect and manipulate more traffic?

reply to Dave7
Seems somewhat similar to what I had found, I just didn't feel like going in depth with it.

reply to Dave7
Shame this is happening.

It started popping up for me a week or two ago, after using OpenDNS for months, and GoogleDNS for years before that and seeing nothing like it.

This never happens on big sites - google, facebook, etc. - only on small ones - personal sites, small blogs, forums. Occasionally, for a perfectly functioning DNS record or page, I will get the mediacom page hijack. You see, hitting the back button and following the link again, it works. I have opted out and still it does not work.

404 errors still show up as the site's configured 404 most of the time. Whenever a DNS record is truly missing or misconfigured, I get landed at OpenDNS' redirect page (which I like better). But again, maybe two to five times a day, a working page or DNS record throws me at mediacom.

This is frustrating. What do i have to do - start paying for a VPN again?

reply to Dave7
If you go into "Internet Options" and select search. change this value to which serch engine you would like to use as i default, I have found this to solve the issue. Please let me know if this does not work for you.

IMO, if your dns is switched off of mediacom's, mediacom should never be redirecting traffic to its own servers. Shouldnt have to resort to workarounds.