ISP Hotspots on Your Home Router: How They Work and How to Opt Out

Run a Wi-Fi scanner in any dense residential neighborhood and you’ll see the same thing sooner or later. Next to the private home networks and the neighbors’ guest SSIDs, there’s a network name that belongs to the ISP. In the United States it’s often xfinitywifi. In the UK it’s BTWifi-with-FON or Virgin Media Wi-Fi. A neighbor didn’t set these up. They come from the ISP’s own edge design, and the router on your desk is part of it. It serves your household, and it also acts as a node in a large provider-managed mesh.

That raises questions about who owns the hardware, who gets the spectrum, and how safe the arrangement really is. When an ISP configures customer-premises equipment (CPE) to broadcast a public network, it splits one physical device into several logical ones. You keep a private network behind your own pre-shared key. Eligible visitors and other subscribers of the same ISP connect through a separate service. To judge how well this works, you have to look past the marketing at the IEEE 802.11 standards, Linux bridging, and the tunneling protocols behind it. This post covers each of them.

How virtual access points let one radio broadcast two networks

A residential gateway is a highly integrated system-on-chip (SoC) that packs a router, an Ethernet switch, a stateful firewall, a DHCP server, and a wireless access point into one package. When an ISP adds a public hotspot to hardware like this, it doesn’t install a second radio for the public. It uses the 802.11 support for multiple Basic Service Sets (BSS) on a single physical radio. Each extra BSS is a virtual access point (VAP), and one wireless chipset can advertise several network identities at once.

A BSS is identified by a Basic Service Set Identifier (BSSID), a 48-bit MAC address for the specific radio interface sending the network. The SSID is only the human-readable name attached to a BSSID. Several physical access points can share one SSID to form an Extended Service Set (ESS) for roaming, and a single access point can also produce several BSSIDs, each with its own MAC address and SSID. When your gateway broadcasts both HomeNetwork and xfinitywifi, the wireless driver (often built on the Linux mac80211 subsystem) tells the hardware to time-division multiplex management and data frames for both networks.

A VAP gets no antenna, RF chain, or channel of its own. The private and public networks share the same spectrum, the same transmission opportunities, and the same hardware queues. If the gateway puts the hotspot on 5 GHz, that traffic competes directly with your household’s 5 GHz traffic. The details depend on the chipset vendor (Qualcomm’s ath10k and ath11k families, Broadcom’s FullMAC drivers) and on how the ISP’s firmware provisions virtual interfaces at boot. Either way, a public hotspot costs local resources, even though the public never pays for them.

Beacon overhead: how much airtime a public SSID costs

Before a client can join an access point, it has to find it. In 802.11 that job belongs to the beacon frame, a management frame the access point sends periodically to announce itself. Every BSS, including each VAP on your gateway, sends its own beacons. That sets a baseline of RF overhead whether or not a single public client is moving data.

The default beacon interval is 100 Time Units (TU). One TU is 1,024 microseconds, so the interval is 102.4 ms, or about 9.77 beacons per second for one BSS. Add a public VAP and the radio sends roughly 19.5 beacons per second. If the ISP also provisions hidden SSIDs for mesh backhaul, set-top boxes, or IoT onboarding, the total can pass thirty frames per second on one channel.

The real cost comes from the rate those frames use. Beacons go out at one of the basic rates in the BSS membership set, so that legacy devices and clients at the edge of range can still hear them. On a crowded 2.4 GHz channel that still supports old 802.11b devices, that rate can be 1 Mbps. On a modern 5 GHz network it is often 6 Mbps. A 300-byte beacon at 6 Mbps takes about 0.4 ms of airtime. That’s tiny on its own, but at twenty to thirty beacons per second it adds up to roughly one percent of channel time before any user data moves.

Probe responses add to it. Phones and laptops that scan for known networks broadcast probe requests, and the access point answers each one with a probe response about the size of a beacon, sent at similarly low rates. In an apartment block with dozens of scanning devices, a gateway with a public VAP produces a steady stream of them. Management frames at low data rates cost far more airtime than the same bytes at high speed, and every microsecond spent on a public beacon is one your private network can’t use.

How ISPs isolate hotspot traffic from your home network

The first worry for most people who find a public hotspot on their router is whether strangers can reach their LAN. A sound design handles this with strict Layer 2 and Layer 3 segregation, so the public BSS lives in its own forwarding domain. The two SSIDs are only what you see. The real boundary sits inside the gateway’s operating system, usually a heavily modified Linux fork or a proprietary real-time OS.

On a standard residential gateway, the private LAN interfaces (the Ethernet switch ports and the private wireless VAP) sit in one software bridge, usually named br-lan or br0. Devices on it get addresses from the local DHCP server and talk to each other freely. For the hotspot, the ISP firmware creates a separate virtual interface for the public VAP and attaches it to a different bridge domain, such as br-wan or a dedicated VLAN interface. The kernel’s switching logic then never forwards frames from the public interface to the private bridge.

Bridge separation is only the first layer. The stateful firewall, managed by iptables or nftables, has to drop any traffic going from the public bridge to the private bridge or to the gateway’s local management addresses. The public VAP should also disable intra-BSS bridging, which stops public clients on the same hotspot from seeing or talking to each other. That client isolation is standard for public Wi-Fi because it blocks lateral movement and local network mapping. How well all of this holds depends on the ISP’s firmware engineering. One wrong firewall rule or an accidental bridge assignment could expose the private LAN, which makes firmware quality the thing the whole design rests on.

GRE, L2TPv3 and CAPWAP: how hotspot traffic reaches the ISP

Local isolation is half the job. The ISP also has to get public traffic into its core network without passing it through your NAT or using your household’s IP address. If a public user downloads pirated material or does something malicious, the legal notices and IP reputation damage should land on the ISP’s hotspot infrastructure and not on your account. So the gateway acts as a tunnel endpoint. It encapsulates the public traffic and sends it straight to central ISP equipment called a Wireless Access Gateway (WAG) or Broadband Network Gateway (BNG).

A common transport is Generic Routing Encapsulation (GRE), defined in RFC 2784. When a public client associates with the VAP and asks for an IP address, the gateway intercepts the DHCP request and forwards it through the tunnel to the ISP’s core DHCP servers. The client gets an address from a pool reserved for the hotspot. When it browses, its IPv4 or IPv6 packets are wrapped in an outer IP header addressed to the WAG.

This gives the ISP a few advantages. The public traffic skips your routing table and NAT state, so it doesn’t eat into your connection-tracking limits. Policy enforcement, deep packet inspection, and captive portal authentication can happen at the WAG instead of on the residential gateway’s modest CPU. Newer deployments may use Layer 2 Tunneling Protocol version 3 (L2TPv3) or CAPWAP (Control And Provisioning of Wireless Access Points) for backhaul. That reduces the home router to a lightweight access point for the public network, and the routing and security work happens in the provider’s data center.

Why WAN rate limits don’t protect your Wi-Fi airtime

Many consumers, and some networking professionals, assume an ISP can protect your network by throttling the hotspot at the WAN edge. ISPs often advertise public users capped at 5 or 10 Mbps, and subscribers conclude that their private 500 Mbps fiber line is untouched. That confuses wide-area bandwidth with local wireless airtime.

A WAN limit controls how fast data enters the ISP’s access network, whether that’s the DOCSIS cable plant or the fiber ONT. Wi-Fi follows Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) on a half-duplex shared medium, where only one device can transmit successfully on a channel at any instant. A public client’s frames cross the air before they ever reach the gateway’s WAN queue.

How much airtime they take depends on the physical layer data rate, set by the Modulation and Coding Scheme (MCS) negotiated between client and gateway. A public user parked in a car outside, or in a neighboring apartment behind thick walls, negotiates a low MCS to keep the link up. A client sending at 10 Mbps holds the channel far longer to move the same data as a laptop on your couch linked at 800 Mbps. While the public client struggles to send a single TCP acknowledgment, your devices sit in backoff waiting for the channel to clear.

So a WAN rate limit stops the public client from saturating the broadband pipe and does nothing about the RF collision domain. The client still takes a disproportionate share of local airtime, which raises latency and jitter for your private devices. QoS mechanisms such as Wi-Fi Multimedia (WMM) and Enhanced Distributed Channel Access (EDCA) prioritize voice and video, but a badly placed public client sending lots of management and low-rate data can still drag down the whole local wireless environment. The only way to remove that airtime cost is to disable the public VAP, which takes its beacons and its data out of your spectrum.

How to detect an ISP hotspot with TShark and Scapy

To confirm the hotspot and study how it behaves, you need packet-level analysis, because a phone’s Wi-Fi scanner won’t tell you enough. Start by checking whether the SSID comes from your own hardware or bleeds in from a neighbor’s identical router. That means looking at the Organizationally Unique Identifier (OUI) of the BSSID, how the signal changes as you move around, and which channel it uses.

Capturing raw 802.11 management frames needs a wireless adapter that supports monitor mode. In that mode the adapter skips normal MAC-layer filtering and passively records everything on a channel, including beacons, probe requests, and control frames the operating system normally ignores. On Linux the aircrack-ng suite is the usual way to put the interface in that state. Once it’s capturing, TShark can filter and decode beacon intervals and capabilities.

tshark -i wlan0mon \
  -Y "wlan.fc.type_subtype == 0x0008" \
  -T fields \
  -e wlan.bssid \
  -e wlan.ssid \
  -e wlan.fixed.beacon \
  -e wlan.radio.channel

This command selects beacon frames (type/subtype 0x0008) and prints the BSSID, SSID, beacon interval, and operating channel. Comparing the public BSSID with your private one often shows sequential MAC addresses, a strong sign that a single chipset generates both VAPs. The beacon interval can also reveal ISP policy. 100 TU is standard, but some ISPs change it to cut airtime overhead or to line up with DTIM (Delivery Traffic Indication Message) schedules for battery-powered devices.

For offline analysis of large PCAP files, Python with the Scapy library works well. Scapy lets you dissect the information elements (IEs) inside beacon frames, which carry supported data rates, security protocols (WPA2-Enterprise, Passpoint), and roaming agreements.

from scapy.all import sniff, Dot11Beacon, Dot11Elt
def analyze_beacons(pkt):
    if not pkt.haslayer(Dot11Beacon):
        return
    bssid = pkt.addr3
    ssid = "<hidden>"
    
    # Iterate through Information Elements to find the SSID
    elt = pkt.getlayer(Dot11Elt)
    while elt is not None:
        if elt.ID == 0:
            ssid = elt.info.decode("utf-8", errors="replace")
            break
        elt = elt.payload.getlayer(Dot11Elt)
    interval = pkt[Dot11Beacon].beacon_interval
    print(f"BSSID: {bssid} | SSID: {ssid} | Interval: {interval} TU")
sniff(iface="wlan0mon", prn=analyze_beacons, store=False)

The script listens passively and reads the BSSID and SSID without associating with the network or injecting traffic. A capture can prove that the VAP exists and show how it beacons. It can’t reveal the backend tunneling design or the VLAN tagging on the wired side of the gateway. Those details stay inside the proprietary firmware and the ISP’s core network.

Passpoint and Hotspot 2.0: how subscribers authenticate

Authentication for public users has changed a lot over the past decade. Early ISP hotspots used open association followed by a captive portal. The user joined the SSID, the WAG redirected their HTTP traffic to a web page, and they typed in their ISP billing credentials. That worked, but it is insecure for anything that isn’t HTTPS, and it suits modern mobile operating systems and IoT devices poorly, since they expect connectivity the moment they associate.

The industry has mostly moved to Hotspot 2.0, also called Passpoint, which builds on the 802.11u standard. Passpoint lets the access point advertise network details through Access Network Query Protocol (ANQP) elements. They tell the client what kind of network it is, which roaming consortium it belongs to, and which authentication methods it supports (EAP-TLS or EAP-SIM, for example), all before the device tries to associate.

When a subscriber with a compatible phone walks past a participating gateway, the phone reads the ANQP data, recognizes the ISP’s roaming consortium, and starts an 802.1X EAP exchange using credentials stored on the SIM card or in a digital certificate. It happens in the background over WPA2-Enterprise or WPA3-Enterprise, and the user lands in the right tunnel at the WAG. Your private network stays on a simple pre-shared key (PSK) while the public one uses certificate-based authentication. Running two security models on one radio shows how flexible 802.11 is, but it also means the gateway’s CPU has to handle the cryptography for several simultaneous security associations.

Why ISPs do it, and the legal questions it raises

ISPs do this mainly to cut capital spending. A municipal Wi-Fi network means negotiating site leases, running dedicated backhaul fiber, installing weatherproof enclosures, and physically securing thousands of remote nodes. Using the fleet of residential gateways already in homes gives an ISP millions of access points at once, and a dense overlapping mesh across whole cities, all powered and housed by subscribers.

That raises questions about IP reputation and liability. Public traffic is tunneled to the WAG, so those users reach the internet from the ISP’s own IP pools and not from your address. That protects you from Digital Millennium Copyright Act (DMCA) notices and abuse reports caused by a stranger sitting on your porch. You still supply the electricity, the local spectrum, and the physical space. In many jurisdictions the broadband terms of service let the ISP use part of the gateway’s resources for network management and public access, which makes the subscriber an unpaid host for a commercial Wi-Fi network.

Electricity is a frequent debate in enthusiast forums. An extra VAP means more state tables and more beacon frames, but an idle public hotspot adds only milliwatts. Power draw and heat matter only under heavy, sustained transfer. Consent is the bigger issue. Many subscribers don’t know their hardware is part of a commercial mesh until they spot the SSID or notice unexplained interference.

How to disable an ISP hotspot: opt-out and bridge mode

Opting out varies a lot by ISP and hardware revision. Comcast and BT both offer ways to turn the hotspot off, though the setting tends to sit in account pages or mobile apps and not in the router’s local web interface. Disabling it through the ISP’s provisioning system sends a remote command that tells the firmware to tear down the public VAP and stop its beacons.

The catch is TR-069 management. Because the ISP controls this configuration, a factory reset or firmware update can quietly switch the hotspot back on. If you want full control of your RF environment, the most reliable fix is to bypass the ISP’s routing and wireless functions with bridge mode (also called modem mode).

In bridge mode the gateway disables its NAT engine, its DHCP server, and its internal wireless radios. It stops being a router and becomes a media converter that turns the DOCSIS or fiber signal into Ethernet. You plug your own router into that link. Because the ISP’s hardware no longer generates any wireless networks, the public hotspot is gone from your premises, and you control your own SSIDs, channel planning, and security policy.

There are tradeoffs. Bridge mode breaks the ISP’s proprietary mesh extenders, integrated VoIP phone service, and remote diagnostic tools. Some ISPs also resist it, hiding the option or requiring a technician visit, because bridge mode removes their visibility into the home network and their ability to run a public hotspot there.

what the hidden tenant costs you

The technology for separating this traffic (VLANs, distinct bridge domains, and GRE tunnels to central Wireless Access Gateways) is mature, and it does protect your private LAN from unauthorized access. The RF side is a different matter. Every extra virtual access point adds beacon overhead, probe responses, and CSMA/CA contention, and no amount of clever software changes that. WAN bandwidth limits protect the broadband pipe but not your airtime, which low-rate clients at the edge of the router’s range can consume.

Whether you see the arrangement as a smart use of existing infrastructure or an overreach into your property, the cost is real. The router in your home serves two parties: the household that pays the monthly bill, and the provider that treats the same box as a node in its mesh.