Bypass tethering restrictions and throttling

Cadmuim

I was able to bypass my carrier's restriction on tethering by
1) Removing dun from the APN type menu on the phone
2) Raising the TTL value on the connecting device from 64 to 65
3) Having the connected device use a VPN

Even though the carrier is not blocking hotspot connections anymore, it's still throttling the connection on the connected device (not on the phone itself). How does this make sense? Is there some other way they're detecting it as tethering? And why wouldn't they have blocked it like they did before these steps instead of just throttling it?

DeletedUser237

Cadmuim Have you considered that what's actually causing the throttling is the usage of VPN? As for how they detect if it's tethered since the first hop before your VPN will always be your ISP they can inspect packets (to some extent) maybe there's something in it that discloses it, like unusual TTL.

tV0gr

Have you tried the same VPN directly from your phone and compared its performance to tethering? I rarely use tethering and never had those issues personally. Or it might be that the tethered device is opening a lot more connections and/or use more bandwidth than expected, like cloud connection or automated updates. Or a DNS leak maybe?

Pure speculation, but since increasing the TTL by 1 was successful it would/should rule-out more advanced detection/analytics methods.

Cadmuim

Thanks for the reply.

I considered that, but the same VPN works at normal speeds on the phone. And immediately after changing the phone plan to one that includes tethering, the tethered device's download speed increased significantly (from ~80kbps to ~4mbps) and has stayed that way since. The VPN has a DNS leak protection setting permanently enabled.

I can't tell what's going on here or how they can figure out it may be a tethered device. Or why it's just being throttled instead of blocked like before.

DeletedUser237

Cadmuim It's done automatically so I suspect different rule applied to rate limit instead of block.

What other commenter said is wrong, they still can do a lot of traffic analysis for example the size of packets is bigger because your device now sends data from two devices at once. The number of packets increases, etc. The only sure way to avoid this, is to pay or change carrier.

E: also because of changed APN they may not be able to fully block, but can throttle instead.

de0u

Cadmuim I can't tell what's going on here or how they can figure out it may be a tethered device.

Aside from traffic volume, another possibility is IP-stack fingerprinting.