yashsingh1/xdaforums huggingface dataset:
[Captivate General] gumbedamit:
Tethering

I know this is an old post, but I need to chime in here. When you use your phone as a tethering device, it's just another way to say that it's routing. yeah just like your home router. Your MAC address from the device connecting to your router, (tether) is not passed on, just like the IP address of that device is not passed on, It's called NAT'ing. Network Address Translation. The only address they see is the NAT'd address, Unless they put a port sniffer on the actual access port that your phone conencts to. They can do that virtually, but its near impossible to tell where you're going to connect on theur network. Yes, I am a network engineer and I too have gotten a notice from AT$T about tethering. What is most interesting is, I only tether my adroid tablet, which uses the same Netflx app that my Dell Streak uses. They go by data usage, yes, they can tell what sites you visit and see if you are going to Flash sites. If you have a registered Iphone and are going to Flash sites, that's a no brainer. Mirroring a port to sniff packets is a labor intensive task to do for MILLIONS of phones; unlikely they do that. On another note, AT$T considers it tethering when you connect your phones HDMI port to your TV, WOW!!!! remeber back in the day when you had a setting on your router to do MAC spoofing to mirror your laptop/desktop MAC address so that you could use your router and connect lots of devices, its the same thing.

---------- Post added at 05:02 PM ---------- Previous post was at 04:42 PM ----------

You are dead on, anything behind the phone would be NAT'd. They could tell by the browser string as well as the websites that you go to, (Iphones= No Flash).

I tether my phone to my android tablet which uses the same apps at my Dell Streak, (Netflix and Dolphin) I spoke with a AT$T rep and told them they started flagging be because I just subscribed to Netflix and my usage is now higher, 200mb > 3GB a month and that they need to make a note of that in my records. She said that she would. I spoke with another rep and played stupid, what is tethering, I only connect my phone to my TV with an HDMI cable to see it on a bigger screen.lol, she sent me an email on usage that states any device that connects to your phone for input/output is tethering. That could be the reason they want you you to have a tethering plan for the Atrix and it's keyboard...wow. They can't tell if you have a bluetooth device on your phone, they can tell the things I list earlier. They mainly go on your data usage patterns

No it's late, but I hope this helps...
[Captivate General] thisguyneil:
wow, i work for verizon and people who say things like that urk me
[Captivate General] Tankmetal:
perhaps they are calling out random customers hoping that they will confess.
[Captivate General] woody1:
There seem to be a lot of theories in these threads about how AT&T is detecting tethering, but, so far nobody seems to have discovered for sure how it's being done.

I agree with those who say that they're not looking at the MAC address; I don't think it gets passed along. Browser string is a possibility, but that hardly seems like a sure-fire way to figure it out.

I wonder if using a proxy connection over an encrypted tunnel would defeat their detection scheme? That would mask the browser identifier along with most everything else they could see. They might be able to see DNS lookups, but that would probably not prove anything.

All-in-all, I think that the most likely case is that they're just looking at raw data usage patterns. They may just assume that people who are using a much higher than average amount of data are tethering something.

But if anybody can figure out for sure how they're doing it, that would be a very good thing to know!
[Captivate General] gumbedamit:
I think I just answered your question.. Not a therory...In order for them sniff, they would need to do Port Mirroring on the port in which your phone connects to their network, very unlikely, your phone is mobile, so it connects to many of their cell towers. They can tell by the websites you visit, if you have a registered Iphone and you are going to Flash Sites, thats a red flag. They can also tell by your browser string, thus telling which browser you are using. So if you connect your laptop and browse with IE, they know... I don't tether my laptop, I tether my android tablet which uses the same apps that I have on my Dell Streak5. Yes, they did send me a letter and I then called them to explain the reason for my increased bandwith was due to me using Netflix. I went from 200 MB > 3GB of data usage, which is a red flag as well. So, lets sum this up

Iphone tethering and going to Flash sites= red flag

Laptop tethering and using desktop browser=red flag

Increased data usage will get you noticed and in that case i recommend you call them and tell them that you now have a streaming service and that your bandwidth will increase.

Hope this helps...
[Captivate General] mrhaley30705:
Only problem with the flash theory is that since 2.2 the captivate is flash capable. All Android are. Most likely it's browser packets, as described by Adam Outler earlier in the thread.
[Captivate General] xhozt:
actualy its most likely TTL tracking ...
[Captivate General] sixstringsg:
Then the user above wouldn't have been caught. The TTL on both his devices would be low enough since they're both android.
[Captivate General] xhozt:
nope cause the hop would make the tablets ttl lower than expected ..
[Captivate General] woody1:
He was talking about the iPhone, not Android phones being a red flag for Flash. For Android phones, they'd need to use something else.
[Captivate General] woody1:
I've been reading different discussions on this issue, and I've also come to think that the most likely method they're using is to look at the TTL for the packets.

Here are some reasons this makes sense:

1. Internet packets are like a series of nested envelopes, with different levels of information in each one. The most basic packet info includes the TTL value (time to live parameter). This value is decremented every time a packet passes through a router. This kind of data is equivalent to the address information on the outside of a letter you send through the mail, so it's visible to everybody who handles the packet. It would be very straightforward for AT&T to look at the TTL for packets coming from the phone and determine if the TTL value is different from a packet originating from the phone itself.

Here's a table of default TTL values for different OS's.

So, AT&T expects to see a TTL value of 64. If it sees packets with some other value, that's an indication that those packets originated in another device.

2. I don't think they are using other methods, such as the use of Flash, browser id string etc. These methods would require deeper packet inspection which would be equivalent to the post office opening up your mail to see what's in it. First of all, this method would be more resource intensive. More importantly, it would be illegal. AT&T can freely look at the header info, including the TTL, but examining the data inside the packets (including the browser id, etc.), would be illegal. Charter Cable did a trial of packet inspection in 2008, but they were ordered to stop.

3. MAC address is not passed from a LAN to Internet, so that is probably not the method used.

4. TTL inspection would offer a simple determinant: if the value is anything other than 64, they can be pretty sure that the packet came from another device. And in normal circumstances, any packet coming from a tethered device would have a value other then 64, probably 63, 127 or 254. Very easy to check.

So, if TTL values are the thing to worry about, what's the solution for masking tethering? Seems that a good solution would be a tethering app that resets the TTL value to the expected 64. That would do the trick and I would guess that this would be pretty doable.

Another possible approach would be to use an app to set up an SSH tunnel on the phone that would channel all of the traffic through a server controlled by the user. My guess is that this would make all of the traffic going through the tunnel appear to be from the phone, but I don't know for sure. Also, I'm not sure how to set this up. And it requires the user to have a server somewhere to route through.

Maybe a developer will give this some thought and determine how to make a good solution!
[Captivate General] xhozt:
He he they have it seems found a way .

https://plus.google.com/u/0/?tab=wX#103583939320326217147/posts/1Yy1jb9z4TA
[Captivate General] gumbedamit:
Guess you didn't read. I said "Iphone users" and flash.....

---------- Post added at 05:04 PM ---------- Previous post was at 04:42 PM ----------

GUYS, When you do a trace or a sniff of a packet, you have to first be on the port in which that packet is being sniffed. If you don't have physical access, then you have to do a "port Mirroring" to capture packets. You cannot sniff circuits that you are are not on. Do you know how much data,(gb) is generated on a corporate network port, let alone the 10's of thousands of users that are on a 3G/4G network switch. What is the likelyhood of them actually sniffing. The are looking at usage/browser strings/destination IP's

1)Usage- If you go from 200mb>3GB

2)Browser Strings- last time I looked, there are no IE browsers for Android/Iphone devices

3)Destination IP's- Flash sites and Iphone don't go together

All of this info can be obtained from thier proxy servers, no need to sniff.

As far as the TTL theory, I'd have to look more into that, could be...
[Captivate General] woody1:
Not sure about your assertions about AT&T not being able to sniff packets, etc. If the data goes through their routers/proxy servers, then they can see the packets. The issue isn't whether they can see the packets: they can. The question is what methods are feasible for them to use. I still think that examining the browser ID would be complicated and also illegal. The TTL is very basic, low-level information contained in the packet headers. It seems to be the consensus that TTL is what they're looking at.

---------- Post added at 10:52 AM ---------- Previous post was at 10:42 AM ----------

I don't have a Google+ account; can you tell me what that post is about?
[Captivate General] gumbedamit:
Guess people don't read anymore, I NEVER said that they can't sniff. If you understood what it takes to do so, then you would understand what I was talking about. Good luck with that....
[Captivate General] wjohnson:
Good luck with that AT&T...
[Captivate General] derek4484:
I agree, nobody here knows how they are determining who is and isnt tethering.

It very well could be MAC address. Nobody knows for sure whether or not the phone is acting as a NAT firewall or not. As a user, I would hope so. But it may just be acting as a gateway to the AT&T network.

I would think that browser user agent would be a pretty crappy way for them to find out....thus it may be just what AT&T is doing. It seems like something that would be done by them. The quickest and cheapest way possible (also the most inaccurate). Any Android user can change the browser user agent in his browser from mobile to desktop to get the desktop version of websites and thus would get flagged as tethering.

I've never once used wifi or USB tethering. I have streamed music over the internet to my phone then using bluetooth protocol had it stream to my car radio. I was notified I was tethering. I called AT&T and asked them if they considered that tethering, they said clearly that wasnt. But said I was still tethering to other devices, which I have never done. I've also never gone over 2GB...ever. And 90% of the time I'm under 1GB Also, I've been on modified ROMs basically the entire time I've had this phone. None of my ROMs have had the tetheringmanager.apk in them.

And one more thing...its 2GB not 2gb. Thats two entirely different quantities. 2gb is equal to 250MB. Get it straight. Reading through this thread and seeing people put in 2gb, 8gb, etc makes it really hard to understand what they really mean. When you type 2gb do you mean 2GB or 250MB??
[Captivate General] gumbedamit:
I know for sure they are not looking at MAC address's. I'm sure that I mentioned that I am a NETWORK ENGINEER, don't need to shell out my creds. GB of gb, we can play that if you want, not a big deal. You've made my point by stating that you were sent a text about tethering and you don't tether,they DON"T REALLY KNOW, thus the reason so many people who don't tether are getting flagged. I've flashed my Dell Streak, thus my tethering is done at the OS level and not by an app. Your phone is not acting like a Nat'd firewall, not unless you have an app for that. It's plain and simple, it's acting as a router, no mistery behind that.

No, I don't know for certain what they are using to tell if people are tethering, I do know what they are not using. I posted on another thread about the TTL theory and how to change it. I design and build network infrastructures for many companies, been doing so for over 20yrs, I do know a lil bit about a few things network related, so you can use the info I've provided or you can continue to rag about gb vs GB, makes no diff to me. I'm just trying to provide some insight as to what they may be doing....
[Captivate General] lothos:
And a series of envelopes is the best way to transmit data through a series of tubes.

TTL is obviously very easy to inspect. You could even have your systems only check the headers of outbound packets with a ttl below a certain threshold. I don't use linux, so I'm not familiar with IPTables, but it CAN modify the ttl of packets. My phone does have iptables on it (ie, droidwall works). It should be possible to modify your system to change the TTL of all packets to 64.

They could also be using a kind of reverse ttl detection. They know how many hops it should be to your phone (you are on their network, after all), and so they modify your traffic to have exactly that TTL. If your phone starts sending back ICMP time exceeded packets, they know that the data was destined for a device on the "other side" of your phone.

And if anyone thinks they don't have the ability to do deep packet inspection on all of your data, think again. They were helping the NSA do it on an international scale and our wonderful congress granted them retroactive immunity when it was discovered.
[Captivate General] grndnl:
AT&T are just bastards...
[Captivate General] cangzhang:
not an ATT customer...
[Captivate General] brentett:
i wonder why it took att so long to come up with this...
[Captivate General] PRTEQ:
I told them the same thing and they say that I am transferring data, for that I say than that is the stupid thing I have never heard. I told them that is transferring audio not data, he also told me that if I use an HDMI cable to see my phone on the tv I am also tethering, dumbest of all... after a very hard discussion with the guy, he asked me if there is something else he could help, and I told him to put in the system what I just told him. Than I called att customer service and report the guy name and tell them that he was rude and not help full at all, and att didn't change my plan as they told me so.

I am not sure why was that. It would be interesting to confirm if there is any way to for sure know when the phone is tethering and better, to trick it...
[Captivate General] bmunday:
At&t wireless and at&t Comcast were and are different infrastructure.
[Captivate General] woody1:
What are you talking about? And what is AT&T Comcast?
[Captivate General] rr5678:
This is why AT&T can go jam their service where the sun doesn't shine. I would never switch to them from T-Mobile, and I'm glad that merger didn't happen. I've never had to pay for tethering with T-Mobile. Why the hell does it even cost extra to tether? It's not like you're using something extra.

If you want to be nitpicky, at least get it right. It's Gb for gigabit, not gb.
[Captivate General] Spartoi:
The method in the OP to avoid tethering seems to be only for PCs. I want to tether to my tablet (Asus TF) so what method would I use to avoid being detected by AT&T?

EDIT:

Can AT&T detect tethering via Bluetooth?
[Captivate General] woody1:
1. AFAIK, nobody has proved that the method in the OP (detecting browser strings) is actually the method that AT&T is using, so I would not depend on that solution.

2. According to some reports, AT&T has accused people of tethering while using Bluetooth, however, it appears that it depends on the type of device that you're using with Bluetooth.
[Samsung Epic 4G Touch] 420247paul:
I sent my wife to the corporate store in kck to exchange my phone because the screen was scratched and the manager told her he would replace it this time but next time he would flash it back to stock first to fix the problem next time so do the sprint store use odin and if so is there a stock img floating around a safety net would be nice.
[Samsung Epic 4G Touch] austin420:
holy ****ing run on sentence.
[Samsung Epic 4G Touch] squshy 7:
The manager must have been misinformed. They havnt given us the flashing software or the tar. Yes, we do use an executable version of odin (think of it like odin for dummies).

All of this software exists on our triage laptop. Every night, this laptop shuts itself down, wiping all data, and reboots to a pre-set installation of software.

Whenever sprint wants new software on our laptop (such as new firmware), an update pops up, we're prompted to reboot, it goes through it's wipe, and upon reboot the new software is there. The entire process is automated.

I assure you, the update has not been pushed to my laptop. If it was, I would've leaked it by now.

What is perhaps even more interesting is we still don't have the software for the Conquer 4G. This makes me think they'll be pushing them both simultaneously.
[HTC EVO 3D] howie411:
When I use the GPS widget my phone resets, I get the white screen with the HTC logo, then I get the loading screen and then the main screen refreshes.

I can turn it off using the quick settings just fine, tried rebooting the phone but that doesn't fix the issues. Any ideas?
[HTC EVO 3D] tablo:
I have the same issue. Anyone have any suggestions?
[HTC EVO 3D] shortyboy:
First things first...

What rom,kernel and boot loader?and maybe carrier...

Sent from my HTC Evo 3D
[HTC EVO 3D] shezi01:
I have the same problem.

Rom - Stock 2.3.4

kernel - 2.6.35.13-g84f8edd ( time stamp on here is Aug 5th 2011 1:14:20 am)

boot loader - hboot 1.5

software 2.08.651.2

carrier - sprint

i have not updated my phone to the latest security update( 2.08.651.3)
[HTC EVO 3D] tablo:
same except software 2.08.651.3
[HTC EVO 3D] seaapp70:
Try uninstalling the 4g sprint corp widget.
[HTC EVO 3D] tablo:
I don't see where I can turn that off.
[HTC EVO 3D] Akasa Fox:
I remember this /was/ an issue when 2.3.4 came out, I also had a problem with mobile data (3g) but for some reason they fixed themselves.

Download a widget for GPS off the marketplace to replace the broken one.

Other than that I'm not really sure, sorry, but I only had these problems with stock.
[HTC EVO 3D] seaapp70:
Go into settings, manage app, all, 4g corp widget. I had the same problem, I removed the update on the widget and the gps worked again.
[HTC EVO 3D] Rydah:
It's for sure the 4g corp widget, but I moved the update to system instead of data as an update and it fixed my Mobile.Network and GPS widget.

Via My HTC Evo 3D On The Now Network From Sprint.
[HTC EVO 3D] tablo:
I don't see anything in Settings>>Manage Apps that says "4g corp widget".

I see something called "HTC Sense", but there are 2 instances of it there. Also, how exactly does one remove the update as you stated. :confused:
[HTC EVO 3D] Burkettacb:
Go to Settings- Applications- Manage Applications- (tab) ALL- Scroll down until you read, Settings Sprint Corp 4G, select it and click on Uninstall updates. Widgets will all work accordingly as they did before the last minor update. And no it wont hurt your 4G or anything.
[HTC EVO 3D] ExploreMN:
I had the same problem after the update. I did a factory reset and everything worked fine since. So...if you don't mind reloading your apps, just do that.
[HTC EVO 3D] tablo:
Worked. Thanks so much.
[Galaxy S II Accessories] MaritimeGamer:
Just got my SGP Neo Hybrid Case in "Champagne Gold" color. Right from Korea to me. There was a bit of head-ache but I won't bother you with that...

When I was trying to find Videos and Photos for the case before I ordered it, in Champagne Gold I couldn't find any so I though for other people out there like me I would take some. ;)

I love the look and color of the case now that I have it. :)

http://www.youtube.com/watch?v=RR_osY6Jm_w

BTW, The free Ultra Crystal screen proctor was installed when the photos and Video was taken.
[Galaxy S II Accessories] Mwinggg:
i got the same color as well, very good choice combined with black
[Galaxy S II Accessories] poch_1421:
nice one!

offtopic:

what's a good neo hybrid color for a white SGP Glas?
[Galaxy S II Accessories] MaritimeGamer:
I would assume the white or black ones.
[Galaxy S II Accessories] adotkdotjh:
Awesome! I wanted to buy this color too, but I went with satin silver cuze I wasn't sure how the gold color would turn out to be.

I'm happy with silver at this moment =)
[Galaxy S II Accessories] MaritimeGamer:
I read some ones Post a wile back and they said after 2 week the snug fit of the back starts to stretch out... Well it's been well over 2 weeks but yep, mine just did that... :( It will still do the job just not as firm as when it was new. Kinda like a older woman! LOL Joke! :eek:
[Samsung Epic 4G Touch] J_Bone:
I hope I didn't miss something but couldn't find a clear place with these comparisons. Some things could be back tracked through the 3D forum as there are plenty of 3D comps here but it is way too tedious.

Looking for opinions from folks that are coming straight from the EVO 4G. Also, if you could, please post what rom you were running on the EVO as well. Be as specific as possible. (data, call recpt, etc)

Thanks a bunch!
[Samsung Epic 4G Touch] jmlott:
Coming from Evo 4G running Cyanogenmod 7:

Screen waaaay prettier and a little bigger

Better battery

Much lighter and thinner

Much faster and more responsive

Call quality same to me

Sound same to me

Cell reception same (though it shows fewer bars)

Wifi reception better

Overall worth every penny. You won't regret it.
[Samsung Epic 4G Touch] jmlott:
... And thats just stock rooted. Cant wait to get CM7 on this bad boy.
[Samsung Epic 4G Touch] comeatmebro:
It blows the original evo out of the water. The extra ram just makes it faster, the extra storage allows more apps, the dual core is noticeably faster, the screen is a lot smoother (fps wise, you no longer see the very tiny lag when you scroll through apps), the screen is just amazing compared to the evo. oh yea and battery is just amazing. There's no competition when it comes to battery life.

I can't compare the data because I lost my 4g a while ago on my evo so can't comment on the speeds since it's been a long time.

Also the fact that its thinner more stylish just gets chicks all wet :x
[Samsung Epic 4G Touch] monterj:
I've had the Evo 4G since launch. It's going to be my backup in case anything happens to my Epic 4G Touch. I flashed new roms weekly until I settled with CM7 and MIUI 1.85.

3G Reception (I live in SoCal) - Speed and signal strength very similar

4G Reception - E4GT synched a little faster. Speeds varied, but E4GT averaged better speeds.

Wifi Signal - Seems like I can go a few feet further with the Evo, but not a specific test

Call Quality - E4GT is clearer and louder

Speakerphone - E4GT is clearer and louder

Battery Life - Stock E4GT lasts about 2 hours longer than a super battery tweaked Evo - Low/Moderate usage on E4GT lasted 24 hrs

Size/Weight - At first the E4GT felt fragile because it was so light and thin, but it's built well. The back cover actually snaps flush unlike Evo.

These are the major differences. Screen and speed are on a whole new level. The only thing I miss is the kickstand!