Mediacom - We Edit Your Packets

Mediacom, stop messing with my packets!

by nc on December 4, 2009 · 4 comments

Mediacom keeps getting worse and worse. As I’ve mentioned before. Mediacom is my ISP at home. Unfortunately, it’s the only service of reasonable speed at a decent price available for my address.

For the past few months, I’ve noticed that I seemingly randomly get redirected to a “Mediacom Assist” page, located at I assumed that they were being evil, and inspecting dns packets for NXDOMAIN (I don’t use their DNS servers, so it couldn’t just be Sitefinder-type junk.) However, I seemed to randomly hit links to working sites (ie, that also returned this error – just figured it was a fluke in their mechanism, and moved on. I just had a kid, after all, I’m too busy to be digging into what stupid things my ISP is doing! ;)
Tonight, I was reading the fun thread about MacPadd at Tom’s Hardware, and they have a link to the LiveJournal blog that MacPadd was posting at for awhile. The given URL was When I hit this page, Mediacom sends me over to “Assist”. I know that LiveJournal has a wildcard set up, so this should not be possible. For the fun of it, I set up a tcpdump, and checked what happens when I try to hit that page.. here are the results:


GET / HTTP/1.1
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv: Gecko/20091109 Ubuntu/9.10 (karmic) Firefox/3.5.5 FirePHP/0.3
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive


HTTP/1.1 200 OK
%MINIFYHTMLf045c0d1bb9c64c91d4d4135d4af1e1e25%The Search Guide redirection service has been enabled to provide helpful searches from browser queries. You entered a non-existent url and your browser attempted to redirect you with Javascript. To enable this please update your browser preferences. To turn off this feature please click this here

Ahem. The same query from a non-mediacom machine returns the expected 404 page from LiveJournal. So, apparently Mediacom is doing deep packet inspection, and rewriting 404’s under certain circumstances. The page that they redirect you to also has a pile of ‘Sponsored Links’ that are going to make them cash. Chances are this is all about the cash for them. They offer an opt-out, but who knows what else they are hijacking? This is just wrong and EVIL. For all I know, they could intercepting ads for Comcast or satellite TV and replacing them with their own. Or just about anything else, as long as money is involved.

Could we please get a net neutrality bill passed that says that ISP’s are not allowed to muck with our packets in this way? Well, maybe not – any net neutrality bill that would actually get passed would probably contain more harm than good. ;)

After figuring out what they were doing, I found lots of other posts about this.. anyone else find this to be pathetic?

{ 4 comments… read them below or add one }

Josh December 5, 2009 at 9:01 am

I have attempted to opt out of Mediacom’s “assistance” several times and it seems I keep finding pages that they want to help me with, makes my blood boil. I’ve had several instances of URL’s that work elsewhere falling victim to Mediacom’s helper service.
On the bright side I saw some notes from the Savage City Council minutes that indicate Clear is installing antenna’s in Savage so we may have a viable broadband alternative in 2010!


nc December 5, 2009 at 1:20 pm

Pathetic. I at least have VPN’s I can use to bypass, but still.. c’mon people!

RE: Clear coming – awesome! Only downside for me is the whole 2mb x 256k part.. sigh. I use my broadband to do offsite backups of photos, and it’s tough on the 2mb upstream.. ;)


nc December 5, 2009 at 1:28 pm

Hmm, I’ve seen a bunch of fiber being trenched around here, and from what I recall the City of Savage has lots of fiber run around – IE, to each major utility, water tower, etc.. and I know Scott County has a fiber loop connecting it to the 511 building downtown, and that there’s cheap bandwidth in 511 via both Level3 and Global Crossing……… hmm….. ;)


Joe January 1, 2013 at 11:24 pm

A quick off the top of my head suggestion that you can fixup …

Nate, could you block and make a special local 404 Page that redirects to:

script language=”javascript”


Leave a Comment

Previous post:

Next post: