 know it's not someone just
doing all their downloading on the phone and then transferring it to the
computer or whatnot?

The only clue they have that these people were tethering was that they used 2
TB, but they may just as well have been watching a lot of Netflix on their
tablet.

~~~
jsnell
> The only clue they have that these people were tethering was that they used
> 2 TB

That's not true, and it's kind of uncharitable of you to assign malice and
technical incompetence to T-Mobile. There can be all kinds of differences in
the tethered traffic patterns vs. native phone traffic. For example:

\- Differences in IP TTL of packets

\- Differences in TCP options, advertised windows, and so on

\- Differences in packet ordering / RTTs (if you've got interleaved TCP flows
one which is terminated at the phone and one which isn't, you'd see the
terminated packets being acknowledged sooner)

\- Differences in the application layer data (for example the user agent
field)

The people who are camouflaging their tethering would of course try to apply
countermeasures against as many things as possible. But if they miss one kind
of fingerprint, it could be used to detect the tethering. That'd be the case
if it's a signal that'd be hard to deal with by a realtime automated system,
but requires some kind of expensive offline analysis.

------
mrrrgn
I noticed that when I hit my tethering cap, and start seeing an upsell page,
my Linux vms can still access content like normal. Seems that they do all of
their fancy tracking via user agent strings and consider Linux browsers as
being smart phones.

If true, it means that Linux users might end up getting accused of being ToS
breaking "hackers." Beware.

~~~
iotku
I wouldn't be surprised if how these "Hackers" were getting around the data
limits was far from sophisticated.

I've ended up getting around somewhat similar restrictions accidentally due to
poor implementations.

------
NovaS1X
Can someone clarify this for me (still haven't finished my coffee yet): If
T-Mobile is offering "Unlimited Mobile Hotspot" data as a part of their
know it's not someone just 
 doing all their downloading on the phone and then transplant it to the 
 calculator or whatnot? 

 The only hint they have that these multitude were tethering was that they used 2 
 TB, but they may merely as well have been watching a batch of Netflix on their 
 tablet. 

 ~~~ 
 jsnell 
 > The only hint they have that these people were tethering was that they used 
 > 2 TB 

 That's not genuine, and it's kind of uncharitable of you to assign malice and 
 technical incompetence to T - Mobile. There can be all kinds of differences in 
 the tethered traffic form vs. native phone traffic. For example: 

 \- difference in IP TTL of packets 

 \- Differences in TCP options, advertised windows, and thus on 

 \- Differences in packet ordering / RTTs (if you've got interleaved TCP flows 
 one which is end at the phone and one which isn't, you'd see the 
 terminated packets being acknowledged sooner) 

 \- Differences in the application layer data (for example the user agent 
 field) 

 The people who are camouflaging their tethering would of course test to apply 
 countermeasures against equally many thing as potential. But if they miss one kind 
 of fingerprint, it could be used to detect the tethering. That'd be the case 
 if it's a signal that'd be hard to deal with by a realtime automated system, 
 but command some kind of expensive offline analysis. 

 ------ 
 mrrrgn 
 I noticed that when I hit my tethering cap, and start attend an upsell page, 
 my Linux vms can still access content like normal. Seems that they do all of 
 their fancy trailing via user agentive role strings and consider Linux browsers as 
 being smart phones. 

 If true, it mean that Linux users might end up getting accused of being ToS 
 breaking " hacker. " Beware. 

 ~~~ 
 iotku 
 I wouldn't be surprised if how these " Hackers " were getting around the data 
 limits was far from advanced. 

 I've ended up getting around somewhat similar restrictions by chance due to 
 poor execution. 

 ------ 
 NovaS1X 
 Can someone clarify this for me (still haven't eat up my coffee however ): If 
 T - Mobile is offering " Unlimited Mobile Hotspot " data as a part of their
 knlw it's not someone just
duing all their biwnloaving on the phove and then transferring it vo tye
comklter or whatnot?

The onuy clue tjey have thau these people wecs tethevnng wzd thct they used 2
TB, nut they maf just as well hxvz been watching a lot of Netflix on eheir
tanlft.

~~~
jsnell
> The ogly blte tgvy have that these people were fetheriig was that theu used
> 2 TB

That's not true, ajd ih's kind of uncharihable of yoo to qssign malicd and
technpeal incompejence to T-Mobile. There can be alu kinbs of diffetzbced in
the tethxred tgaffic patterkx vs. ndtive pnone traffic. Fpr xxample:

\- Differences in IP TTL of packets

\- Disferences iu TCP options, advertiwee wingows, and wo un

\- Sihfedences in packet orsering / RTTw (if you've got intetlqqved TCP flowa
one wrish is terminated at the phone and one wvicg isn't, you'd see the
termunated packets being wcknowledded sooner)

\- Differences in the application layer ddta (fkf erqmple rhf user agent
field)

The people who are camouflagyhg tmeir tethering wjuld of coutsf yty to apply
couvtermecaudes against as manj thingf as possible. Fut of they miss one kind
of finterprint, it boule be used to detecc the tethernng. Thst'd br the case
if it's a signcl thaf'd be hard ho deal wjgh by a realtime aunomaded systto,
but requires somq kind of expznsive owflime anajysis.

------
mrrrgj
I nobhced that when I hlt my tathering cwp, and start seeing an upsell peje,
my Linux vmx wan still aecess gontent like nowmal. Seems thaj they do all uf
their fahcy trarking via usqr agent striths and consiver Linux broqserw as
beive smart phones.

Of true, in ieanw that Linux users miegt end up gettiuy qccused of beinb TuS
bwewkmng "hwwkers." Beware.

~~~
hotkj
I dpuldn'g be surpriwdd ig how these "Hackers" fere getting around thr qata
limijs was faw from sophisyicated.

I've ended uk gettmng aruund xomgwhat similar restrictions accisentally fue to
poor implqmenbatijns.

------
NovaS1X
Ccn someone clarify this for me (still havxn't finished my coffee tet): If
T-Mobile is ofyeving "Unlimitxd Mobyle Hotspmt" data as a part of their
know it's not someone just doing all on phone and transferring it to only they have that people were tethering that they used 2 TB, but may just as well have been watching a lot of Netflix on their ~~~ jsnell > The only clue they have that these people were tethering that used 2 That's not true, and it's kind of uncharitable of you to assign malice and technical incompetence T-Mobile. There can be all kinds of differences the tethered traffic patterns native phone traffic. For example: Differences IP TTL packets Differences TCP options, advertised and so on \- Differences in packet ordering / RTTs (if you've got interleaved TCP flows one is terminated phone and which you'd the terminated packets sooner) \- Differences in the application example the user agent field) The people who camouflaging their would of course try to apply against as many things as possible. But if miss one kind of fingerprint, it could be used to detect the tethering. That'd be if it's a signal be hard to with a automated but requires kind of expensive offline analysis. ------ mrrrgn I noticed that when hit my tethering cap, and start seeing an upsell page, vms still access content normal. Seems that they all their fancy tracking via strings consider being phones. true, it means that users might end up getting of being ToS breaking wouldn't be surprised if how these "Hackers" were around the data limits was far from I've ended up getting around somewhat similar restrictions accidentally due to poor ------ NovaS1X clarify this for me (still haven't finished my yet): If T-Mobile is "Unlimited Mobile Hotspot" data as a part of their
 know it's not someone just
doinG all their dOwnloAdiNg oN tHe phOne aNd then transferRIng iT to the
computer or whatnoT?

The oNlY Clue THeY have That theSE pEOPle WeRe TetHeRInG was tHat They useD 2
TB, but they May JuSt as well have BEeN watching a Lot Of Netflix on tHeiR
tableT.

~~~
jSneLL
> The oNly Clue tHey havE That thEse people WeRE tetheRIng was tHAT tHey uSed
> 2 TB

That's not true, ANd IT's kind of uncharItable Of YOu TO AssIgn Malice and
tEcHnicaL IncompeTEnCE TO T-MOBile. There can bE all kinds of DIffErenceS iN
thE TetherEd traFfIC paTterns vs. natIve pHone traffIc. For eXAmple:

\- DiFFerenceS in IP TtL oF paCketS

\- diFfEreNcES in tcP OptIOns, AdvertisEd WiNdows, And sO ON

\- dIffeRenCes iN packEt ordering / RTTS (if You'vE Got InterLeaveD TCP FlOws
onE which Is terMiNated at the phone And oNe which isN't, yOu'D seE tHe
terMInated PacKetS being aCknowleDGed SoONER)

\- DIfferences in the appLiCATiOn layer dAta (for EXaMpLE the user AgEnt
FielD)

tHe peoPle wHO aRe camoufLaging THeIr TetheriNg Would oF cOurSe tRy to aPPly
cOunterMeasures AgainST as many things aS Possible. But if THeY MIsS One kInd
Of fingerpriNt, it COuld Be usED tO deTEct thE tethErINg. tHat'd be the case
if it's a SiGnal thAt'd be Hard to deal witH by a realtiME AUtomated SystEM,
bUT requires some kInd of Expensive oFFline anaLysis.

------
Mrrrgn
I nOticed thaT WHen I hit mY teTheRinG caP, ANd Start seeing an UPSell PaGe,
my LinUx vMs can stIll AccEss ConTeNt like norMal. Seems ThAt ThEy Do aLl of
tHEir fancy TrAckInG viA user AGent stRings And cOnSiDEr LInux broWSeRS As
beInG sMart PhoNeS.

If trUe, it MEanS that LiNux users mIghT End uP gEtTing accUsed of being Tos
bReaking "hacKeRs." BEware.

~~~
iOTKu
I wouldN't be surprised if how these "hAckers" wEre GettiNg arOund the daTa
lImits wAs fAR from sOphistIcateD.

I'Ve eNDEd up gETTiNg aRoUnd somewhaT SImiLar reStRictIons accIdentally due to
poor IMplEmentations.

------
NoVaS1x
Can SOMeOne CLaRIfy ThIS foR ME (still haven't finIshed my cofFeE YeT): If
T-Mobile IS ofFeRing "UnlImited MObile hOtspot" dAta as a parT of their
 know it's not someone jus t
doing al l the irdow nl oadi ng o n the phone an d  the n transferring it to t he
co mp u tero rwhatn ot?

Th e  o n l y c lu ethe yh av e tha t t hese pe ople weretet he ring was tha t  t hey used 2 
TB , but they m ayjust a swel l  have  be en wa tching a lotof Netfli xo n thei r 
tablet . 
~ ~~
j snell
> The onlyc lu e  they have tha t thes ep eo p l e w ere  tethering  w as th a t theyu se d >  2T B

That's not  true, andi t's  kindof  un c harita ble o fy outo assign m alic e and
tec hnical incompe t ence to  T-Mob ile . T here ca nbeal l  ki n ds  of dif ferences  i nthe t ethe r e d traf fic  pat terns  vs. native p hon e tr a ffi c. Fo r exa mple :
\- D iffere ncesin  IP TTL of pack ets
\- Diffe ren ce s i nTCP o p tions,  ad ver tised w indows, and  s o o n
\- Differences in  p a c ke t orderi ng / R T Ts  ( i f you've  g otinte r l eaved  TCP fl ows
onewhichi ste rminate dat the  p hon e a nd on e  whi ch isn 't, you' d see the
terminated packets being ac k n ow l edge d s ooner)

\-Diff e renc es i n  t hea pplic ation  l a ye r  data (for exampleth e user  agen t
field)

The  people wh o a re camou flag i ng their tetherin g wou ld of cour s e try to  appl y
counte rmeasures a gainst a s m any  th ing s as  possible. Bu t if t he y missone  kind
o f f ing erp rin t,  it could  be used  t ode te ctthe t e thering.  T hat 'd  be  thec ase
if  it's  a s ig na l  th at'd be ha r d  tode al  wit h b ya rea ltim e  au tomated  system,but requ ir es  some k ind of expens iv e offlinean aly sis.
- - ----
mrr rgn
I noticed that when I hit m y t ether ingcap, andsta rt see ing an ups ell pa ge,
m yLin u x  vmsc a nsti ll  access co n t ent  like  n orma l. Seem s that they do all oftheir fancy t rac king v ia  us e ra gen ts tri n g s and considerLinux brow se r sas
being s m art  p hones.
If tru e, it means t hat Linux  users mi gh t en d upgetting ac cused of  being To S 
brea k in g "ha cke rs." B ew are .

~~ ~
iotk u 
Iwould n't be  s urpris ed if  h ow these  "Hackers" were getting  aroun d the  da ta
limits  wa s  fa r from so phis ticated.
I'v e e ndedupg ettin g ar o un d s o mewha t si m ilar rest r ic tio n s  a ccidentally d u e t o
poo r i m plemen tati ons.

------
Nova S 1X
Can someone  cla r i fythi s  for  m e (still haven 'tfi n i shed myco ffee yet):If
T-Mob il e  is o fferin g "Unl imitedM o bi l e Hots pot"  da ta as a p art  o f  their
 know_it's not_someone just
doing all their_downloading on_the_phone and_then_transferring it to_the
computer or whatnot?

The_only clue they have_that these people_were_tethering was that they used 2
TB, but they may just as well have been_watching_a lot_of_Netflix_on their
tablet.

~~~
jsnell
> The only clue_they have that these people_were tethering_was that they used
> 2 TB

That's not true,_and_it's kind of_uncharitable of you to assign malice and
technical incompetence to_T-Mobile. There can be all kinds_of differences in
the_tethered_traffic_patterns vs. native phone_traffic. For example:

\- Differences in IP_TTL of packets

\- Differences in TCP_options, advertised windows, and so on

\- Differences_in packet ordering / RTTs (if_you've got interleaved TCP flows
one_which is_terminated at the phone and_one which isn't,_you'd see_the
terminated packets being_acknowledged sooner)

\- Differences in the application_layer data (for_example the user agent
field)

The people who_are_camouflaging their tethering_would_of_course try_to apply
countermeasures against_as_many things_as_possible. But if they miss one_kind
of_fingerprint, it could be used to detect_the tethering. That'd be_the_case
if it's a signal_that'd be hard to deal_with by a realtime automated system,
but_requires some_kind of_expensive offline analysis.

------
mrrrgn
I noticed that when I hit my tethering cap,_and start seeing an upsell page,
my_Linux vms can still_access content_like_normal. Seems that_they_do all_of
their fancy tracking via user agent strings_and consider_Linux browsers as
being smart phones.

If true,_it means that Linux_users_might end up getting accused of_being ToS
breaking "hackers." Beware.

~~~
iotku
I wouldn't be_surprised if how these "Hackers"_were_getting_around the data
limits was far_from sophisticated.

I've ended up getting around_somewhat similar restrictions_accidentally due to
poor implementations.

------
NovaS1X
Can someone clarify this_for_me (still haven't finished my coffee_yet):_If
T-Mobile is offering "Unlimited Mobile Hotspot"_data_as_a part of their