Log for OKTW Network
[問題] 遠傳是不是開始限制熱點分享了？
http://www.ptt.cc/bbs/mobilecomm/M.1574253504.A.2E0.html
http://www.ptt.cc/bbs/mobilecomm/M.1574253504.A.2E0.html
'''1 1 ms <1 ms <1 ms 192.168.1.1
2 <1 ms 2 ms 1 ms h254.s98.ts.hinet.net [168.95.98.254]
3 1 ms <1 ms <1 ms tpe4-3301.hinet.net [168.95.22.114]
4 2 ms 2 ms 2 ms tpdb-3021.hinet.net [220.128.3.134]
5 2 ms 2 ms 1 ms r4201-s2.hinet.net [220.128.1.237]
6 23 ms 24 ms 24 ms r11-hk.hinet.net [220.128.6.1]
7 25 ms 26 ms 24 ms 211-22-33-85.HINET-IP.hinet.net [211.22.33.85]
8 34 ms 46 ms 40 ms 014136143013.ctinets.com [14.136.143.13]
9 26 ms 26 ms 25 ms 014199255042.ctinets.com [14.199.255.42]
10 * * * Request timed out.
11 26 ms 26 ms 25 ms 061239060107.ctinets.com [61.239.60.107]'''
2 <1 ms 2 ms 1 ms h254.s98.ts.hinet.net [168.95.98.254]
3 1 ms <1 ms <1 ms tpe4-3301.hinet.net [168.95.22.114]
4 2 ms 2 ms 2 ms tpdb-3021.hinet.net [220.128.3.134]
5 2 ms 2 ms 1 ms r4201-s2.hinet.net [220.128.1.237]
6 23 ms 24 ms 24 ms r11-hk.hinet.net [220.128.6.1]
7 25 ms 26 ms 24 ms 211-22-33-85.HINET-IP.hinet.net [211.22.33.85]
8 34 ms 46 ms 40 ms 014136143013.ctinets.com [14.136.143.13]
9 26 ms 26 ms 25 ms 014199255042.ctinets.com [14.199.255.42]
10 * * * Request timed out.
11 26 ms 26 ms 25 ms 061239060107.ctinets.com [61.239.60.107]'''
How they detect that someone is tethering a device isn't something that network providers often want to talk about, for the obvious reason that the more consumers know about how this is being detected, the easier it is for them to find ways to hide the fact that they're doing it, and avoid the associated extra charges (1). However there are certain known techniques that will give away the fact that you're currently tethering, if your Service Provider happens to be running the right tool to check for these indicators:
Your Phone asks your network if tethering is allowed
The first and easiest method is that some phones will query the network to check whether the current contract allows tethering, and then totally disable the tethering options on the device in software if not. This generally only happens if you are running an OS version that has been customized by your Provider, example 1 example 2.
Your phone tells your network that you are tethering
It's also rumoured that some phones have a second set of APN details saved in them by the phone network, when you enable tethering they switch over to using this second APN for all tethered traffic, while using the normal APN for traffic originating on the phone. However I haven't found any concrete evidence of this, other than people finding odd APNs and wondering what they're for (bear in mind that an unlocked phone bought off-contract may have hundreds or thousands of APNs stored on it, ready for use on whichever network in whichever country the eventual owner decides to use it).
Inspecting the network packets for their TTL (time to live)
Every network packet travelling across a TCP/IP network, like the internet, has a built-in time-to-live (TTL) set on it, so that in case there is a problem with that packet reaching its destination this will stop it travelling around the network forever clogging everything up.
The way this works is that the packet starts with a TTL number (say 128) set on it when it leaves the sending device (your phone, or laptop), and then every time that packet travels through a router of any kind (like your home broadband router, or a router at your ISP or phone company) that router subtracts one from the TTL (which would decrement the TTL to 127 in this example), the next router it travels through will in turn decrement the TTL again, and so on, if the TTL ever reaches zero then the router it's at discards the packet and doesn't transmit it again.
When your phone is tethering it acts like a router so, as the packet passes from your tethered laptop through your phone and onto the phone network, your phone will subtract "1" from the TTL to show that the packet has passed through its first router. The phone networks know what the expected TTLs from common devices are (for instance packets from an iPhone always start at a TTL of 64), and so they can spot when they're one less (or totally different) than they're expecting.
MAC address inspection
Devices on a TCP/IP network, like the internet, all have a unique MAC ID set on their network interfaces. This is made up of two halves, one half identifying the manufacturer of the interface, and the other half being a unique identifier assigned by the manufacturer (like a serial number). Every network packet that is sent out will have been "stamped" with the MAC address of the originating device's network port. The MAC address of your laptop's wifi card will have a very different manufacturer and serial code than the MAC address of your phone's 3G interface.
TCP/IP Stack Fingerprinting
Different computer Operating Systems (eg Android, iOS, Windows, Mac OSX, Linux, etc) set up their TCP/IP stacks with different default values and settings (eg the Initial Packet Size, Initial TTL, Window Size...). The combination of these values can give a "fingerprint" that can be used to identify what operating system is running on the originating device. A side-effect of this may mean that if you're using an uncommon OS, or an OS that's similar to your phone's on your other device, your tethering may not be spotted.
Your Phone asks your network if tethering is allowed
The first and easiest method is that some phones will query the network to check whether the current contract allows tethering, and then totally disable the tethering options on the device in software if not. This generally only happens if you are running an OS version that has been customized by your Provider, example 1 example 2.
Your phone tells your network that you are tethering
It's also rumoured that some phones have a second set of APN details saved in them by the phone network, when you enable tethering they switch over to using this second APN for all tethered traffic, while using the normal APN for traffic originating on the phone. However I haven't found any concrete evidence of this, other than people finding odd APNs and wondering what they're for (bear in mind that an unlocked phone bought off-contract may have hundreds or thousands of APNs stored on it, ready for use on whichever network in whichever country the eventual owner decides to use it).
Inspecting the network packets for their TTL (time to live)
Every network packet travelling across a TCP/IP network, like the internet, has a built-in time-to-live (TTL) set on it, so that in case there is a problem with that packet reaching its destination this will stop it travelling around the network forever clogging everything up.
The way this works is that the packet starts with a TTL number (say 128) set on it when it leaves the sending device (your phone, or laptop), and then every time that packet travels through a router of any kind (like your home broadband router, or a router at your ISP or phone company) that router subtracts one from the TTL (which would decrement the TTL to 127 in this example), the next router it travels through will in turn decrement the TTL again, and so on, if the TTL ever reaches zero then the router it's at discards the packet and doesn't transmit it again.
When your phone is tethering it acts like a router so, as the packet passes from your tethered laptop through your phone and onto the phone network, your phone will subtract "1" from the TTL to show that the packet has passed through its first router. The phone networks know what the expected TTLs from common devices are (for instance packets from an iPhone always start at a TTL of 64), and so they can spot when they're one less (or totally different) than they're expecting.
MAC address inspection
Devices on a TCP/IP network, like the internet, all have a unique MAC ID set on their network interfaces. This is made up of two halves, one half identifying the manufacturer of the interface, and the other half being a unique identifier assigned by the manufacturer (like a serial number). Every network packet that is sent out will have been "stamped" with the MAC address of the originating device's network port. The MAC address of your laptop's wifi card will have a very different manufacturer and serial code than the MAC address of your phone's 3G interface.
TCP/IP Stack Fingerprinting
Different computer Operating Systems (eg Android, iOS, Windows, Mac OSX, Linux, etc) set up their TCP/IP stacks with different default values and settings (eg the Initial Packet Size, Initial TTL, Window Size...). The combination of these values can give a "fingerprint" that can be used to identify what operating system is running on the originating device. A side-effect of this may mean that if you're using an uncommon OS, or an OS that's similar to your phone's on your other device, your tethering may not be spotted.