How Airtel could detect hotspot use on Unlimited 5G

Airtel does not check whether a customer uses data through a mobile hotspot or directly on the handset, and the only operative limit on its Unlimited 5G Data is the 300 GB fair usage threshold, a source told MediaNama. The source added that Airtel removed the disputed clause barring hotspot sharing before it circulated this month in screenshots and tweets.

Enforcing such a restriction would require the network to tell apart data shared to another device through the phone, known as tethering, from data used on the phone itself. That step engages India’s net-neutrality rules and raises privacy questions.

The source said that once a customer uses more than 300GB in a month, Airtel classifies the usage as commercial and the unlimited benefit no longer applies. Airtel’s postpaid terms frame the consequence as speed, reserving the right to “implement throttle speeds” in cases of commercial use.

Airtel has not put out a formal statement on the matter yet. For what Airtel’s terms actually say, you can read the story here.

Why is detection necessary at all? When a customer connects a laptop through a phone’s hotspot, the laptop’s traffic travels over the same mobile connection as the phone’s own traffic. It carries no marker identifying its source device. An operator that wants to enforce a hotspot restriction has to infer a second device from patterns in the traffic, which security researchers describe as reading signals in the data packets, the small units into which network traffic is broken, rather than any explicit label.

In the current dispute, a user said customers alter the Time-to-Live (TTL) value in their packets and route traffic through Virtual Private Networks (VPNs), which can mask the characteristics of a connection, to keep tethered data from standing out.

What signals would reveal tethering? Security literature and technical write-ups of the Airtel row cite several signals an operator can read:

• Time-to-Live (TTL): a counter in each packet’s header, the addressing label on the outside of a packet, that drops by one every time the packet passes through a device. Traffic routed through the phone shows a TTL one lower than traffic starting on the phone, which can reveal a second device.
• Operating-system fingerprinting: the network identifies technical traits in the traffic, such as how a device handles network connections and the Maximum Transmission Unit (MTU) size, the largest chunk of data it sends at once, which differ between a laptop and a phone.
• Deep Packet Inspection (DPI): examines the contents of packets rather than only their headers.

Does detection mean reading your traffic? Not necessarily, and the distinction is the privacy question. TTL checks, operating-system fingerprinting, and MTU reads work on the packet header, the addressing information on the outside of each packet. DPI goes further and inspects the payload, the data inside. Security vendors describe the…