MNOs really don't need to know the traffic source address to apply throttling. As per the throttling algorithm, most of the times it's a Leaky Bucket variant (

MNOs really don't need to know the traffic source address to apply throttling. As per the throttling algorithm, most of the times it's a Leaky Bucket variant (https://en.wikipedia.org/wiki/Leaky_bucket https://en.wikipedia.org/wiki/Leaky_bucket). The variant usually allows short bursts of packets, then throttles down the downstream traffic for long connections to match the configured rate. A trick to know if the operator is using DPI to extract the SNI in HTTPS/encrypted traffic: play a YouTube video, then do a speed test (e.g. iperf) while it is playing. Two things could happen: either both apps are throttled (no DPI) or only Youtube is (there's some level of DPI).