I setup a firewall rule in openwrt that said anything coming over USB needed to set the TTL to 65 so it looked like the data was coming from the phone itself and not from the tether.
IIRC, on the plan I was using on Cricket, I would get unlimited data + 15GB of tether. This just byapssed that limit.
I think they can almost figure it out because if I tried to tether without the TTL trick, data wouldn't work. So I'm guessing it still counted the data I was using against some kind of cap?
Years ago, I did this with my jailbroken iphone 3gs. When visiting lots of websites, it would serve up the mobile version, so I assumed that the app was somehow modifying request headers to look like a phone request. I guess not as many sites used TLS back then.
That's the TTL that some carriers use from the phone. So once it hits the router it goes down - meaning the carrier knows you're tethering. Setting it to back to 65 on the router makes it harder for the carrier to detect.
Close, but it's a little bit different than how you describe it. The router is connected between the phone and the other devices in this user's scenario. The default TTL on Linux and Android is 64. If you tether, the packet will go through your phone and have its TTL decremented to 63 (the phone is a gateway). Then when it arrives at the cell tower with a lower TTL, they know you're tethering and drop the packet.
If you set it to 65 on your host device or router, it will be decremented to 64 on the phone - and is now hard to distinguish from real traffic from the phone.
You want it to be one more than the value the phone uses as its default. Then when the packet arrives at the phone via the tether its TTL is decremented and it is passed out to the tower. Tower sees a packet with a TTL that it is expecting and assumes it is phone data.
IIRC, on the plan I was using on Cricket, I would get unlimited data + 15GB of tether. This just byapssed that limit.
I think they can almost figure it out because if I tried to tether without the TTL trick, data wouldn't work. So I'm guessing it still counted the data I was using against some kind of cap?