> The only clue they have that these people were tethering was that they used 2 TB That's not true, and it's kind of uncharitable of you to assign malice and t

> The only clue they have that these people were tethering was that they used 2 TB That's not true, and it's kind of uncharitable of you to assign malice and technical incompetence to T-Mobile. There can be all kinds of differences in the tethered traffic patterns vs. native phone traffic. For example: - Differences in IP TTL of packets - Differences in TCP options, advertised windows, and so on - Differences in packet ordering / RTTs (if you've got interleaved TCP flows one which is terminated at the phone and one which isn't, you'd see the terminated packets being acknowledged sooner) - Differences in the application layer data (for example the user agent field) The people who are camouflaging their tethering would of course try to apply countermeasures against as many things as possible. But if they miss one kind of fingerprint, it could be used to detect the tethering. That'd be the case if it's a signal that'd be hard to deal with by a realtime automated system, but requires some kind of expensive offline analysis.