Obtain, from a subscriber premises gateway, a data packet having a header field including a unique identifier for a combination of the gateway and a connected subscriber IP device. Transport the data packet through an internal network of a broadband service provider. Remove the header field after the transporting and prior to the data packet exiting the internal network of the broadband service provider to an external network. Store, in a subscriber internet protocol device data repository of the broadband service provider, data, including the header field, representing transport of the data packet through the internal network of the broadband service provider to the external network. Detect, based on the data repository, at least one of an internal and an external anomaly associated with the data packet. Initiate at least one mitigation action in response to the detecting of the at least one of an internal and an external anomaly.