Hacker News Reader

Comment by codethief | Hacker News Reader

> My carrier detects and throttles hotspot traffic by measuring packets TTL, so I tweaks the router's iptables to dodge that.

Could you elaborate on this?

View on HN

Some mobile phone providers check the packet TTL to limit tethering.

Network packets commonly have start with default TTL values of 64, 128, or 255. Each hop in the network subtracts 1.

When phone connects direct to carrier (cell tower, I assume) the carrier will see TTL of 64.

A laptop tethered to a phone introduces a hop so laptop-to-phone TTL is 64, phone-to-carrier TTL is 63.

Carriers can then limit bandwidth if network packet that don't have a common TTL.

For `iptables` look at `--ttl-inc 1` (to add back the 1 so 63 => 64) or `--ttl-set 64`.

Alternatively, you set the tethered devices to use a TTL of 65, e.g. linux/mac `sysctl -w net.inet.ip.ttl=65`

How do you figure out what detection method a carrier is using?

Make the TTL change , and see if traffic bw changes?

Thank you for explaining this, I had always wondered how a carrier could tell a device was tethered if a router was not passing on tethered device details.

If the hotspot is sourced from the phone, the phone tells the carrier

Another way to do it is to look for requests to domains that phones never access but desktops/laptops often do. Windows Update is the most common, but you could probably do apt package repositories or whatever.

Thanks!

You can easily manipulate and set TTL to whatever is needed with a Mikrotik router. Override TTL for all devices behind it.

/ip firewall mangle add chain=postrouting out-interface=lte1 action=change-ttl new-ttl=set:64 passthrough=yes comment="Set TTL for Mobile Hotspot"

Sure, it's widely known.

Default TTL is usually 64.

Phone traffic TTL is 64.

But when behind the phone-as-router/gateway, compy traffic TTL is...63!

Thanks!

I have a friend that is also curious. Their fibre cable was cut by addicts trying to find a source of copper that took a few days to be repaired. Using their hot spot during the outage used up their allotted hot spot bandwidth for the month. My friend would be very interested in how to avoid potential down time in the future.

Might I suggest an email address added to your HN profile, lest a publicly posted reply result in observation by a nefarious telecom employee who just might obviate the proposed solution to your friend’s conundrum.

Are we back to this again? I have a friend who wants to know how to build a blue box.

One step from ‘SWIM tried meth and he’s freaking out’ from the old forums !

TTL++l0l

Reply on news.ycombinator.com