> My carrier detects and throttles hotspot traffic by measuring packets TTL, so I tweaks the router's iptables to dodge that.
Could you elaborate on this?
> My carrier detects and throttles hotspot traffic by measuring packets TTL, so I tweaks the router's iptables to dodge that.
Could you elaborate on this?
Some mobile phone providers check the packet TTL to limit tethering.
Network packets commonly have start with default TTL values of 64, 128, or 255. Each hop in the network subtracts 1.
When phone connects direct to carrier (cell tower, I assume) the carrier will see TTL of 64.
A laptop tethered to a phone introduces a hop so laptop-to-phone TTL is 64, phone-to-carrier TTL is 63.
Carriers can then limit bandwidth if network packet that don't have a common TTL.
For `iptables` look at `--ttl-inc 1` (to add back the 1 so 63 => 64) or `--ttl-set 64`.
Alternatively, you set the tethered devices to use a TTL of 65, e.g. linux/mac `sysctl -w net.inet.ip.ttl=65`
Thank you for explaining this, I had always wondered how a carrier could tell a device was tethered if a router was not passing on tethered device details.
How do you figure out what detection method a carrier is using?
Make the TTL change , and see if traffic bw changes?
You can easily manipulate and set TTL to whatever is needed with a Mikrotik router. Override TTL for all devices behind it.
/ip firewall mangle add chain=postrouting out-interface=lte1 action=change-ttl new-ttl=set:64 passthrough=yes comment="Set TTL for Mobile Hotspot"
I have a friend that is also curious. Their fibre cable was cut by addicts trying to find a source of copper that took a few days to be repaired. Using their hot spot during the outage used up their allotted hot spot bandwidth for the month. My friend would be very interested in how to avoid potential down time in the future.
Might I suggest an email address added to your HN profile, lest a publicly posted reply result in observation by a nefarious telecom employee who just might obviate the proposed solution to your friend’s conundrum.
Are we back to this again? I have a friend who wants to know how to build a blue box.
TTL++l0l
Sure, it's widely known.
Default TTL is usually 64.
Phone traffic TTL is 64.
But when behind the phone-as-router/gateway, compy traffic TTL is...63!