WO2019174752A1

WO2019174752A1 - Enforcement of tethering policy in a wireless communications network

Info

Publication number: WO2019174752A1
Application number: PCT/EP2018/056738
Authority: WO
Inventors: Robert Skog
Original assignee: Telefonaktiebolaget Lm Ericsson (Publ)
Priority date: 2018-03-16
Filing date: 2018-03-16
Publication date: 2019-09-19

Abstract

There is provided a method in a node of a wireless communication network, the method comprising: receiving an internet protocol packet for a wireless communications device; editing the hop limit for the internet protocol packet such that the hop limit will expire upon the internet protocol packet arriving at the wireless communications device; and sending the internet protocol packet to the wireless communications device.

Description

ENFORCEMENT OF TETHERING POLICY IN A

WIRELESS COMMUNICATIONS NETWORK

Technical field

The present application relates to: a method in a node of a wireless communication network; a node of a wireless communication network; an apparatus for detecting tethering in a wireless communications network; and a computer-readable medium.

Background

Tethering is the act of sharing a mobile device's internet connection with other connected devices. Typically, the mobile device is a smartphone which can use Wi-Fi to connect to other local devices and allow them to access the internet over the

smartphone’s cellular connection. In this way the smartphone acts as a router, routing internet protocol packets between a local device and the wireless communications network.

Examples of a local device are another smartphone, a tablet or a laptop. Tethering is useful because some devices don’t have a cellular connection built in. Some tablets and most laptops fall into this category. Additionally, even if a local device does have the capability of using a cellular connection built in, the user may not have a data plan or sim card to take advantage of this connection for that device. Furthermore, even if a user has two smartphones, each with a data plan but on different networks, the user may be at a location where one smartphones does not have network reception. In that case the user may choose to use tethering to connect that device without network reception to the internet.

When tethering is done via Wi-Fi, the feature may be branded as a personal or mobile hotspot. Thus, an Internet-connected mobile device can act as a portable wireless access point and router for local devices connected to it.

Network operators are introducing unlimited data plans for users of smartphones. This means that the user can access the internet as much as he/ she wants without reaching any limit in their data plan. Flowever, tethering allows a user to vastly increase the amount of data they consume via their smartphone, by for example sharing their connection with multiple users or using a high bandwidth application on a more powerful computing device such as a laptop or PC.

A network operator can impose terms on the unlimited data plan that do not allow tethering to help limit bandwidth usage by users, but the network operator requires a mechanism to both detect tethering and to enforce the terms & conditions of their subscriptions.

Summary

Accordingly, there is provided a method in a node of a wireless communication network, the method comprising: receiving an internet protocol packet for a wireless

communications device; editing the hop limit for the internet protocol packet such that the hop limit will expire upon the internet protocol packet arriving at the wireless communications device; and sending the internet protocol packet to the wireless communications device.

If the internet protocol packet is intended for a device connected to the wireless communications device, and the wireless communications device is expected to route that internet protocol packet thereto, the hop limit causes the internet protocol packet to be discarded by the wireless communications device. The wireless communications device, acting as a router, will discard any internet protocol packet for which the hop limit has a value such that the internet protocol packet will arrive at the wireless communications device but be routed no further. Such a packet will not reach the tethered device, effectively disabling tethering on that connection.

Upon discarding a packet due to an expired hop limit, the wireless communications device will send an error message, which may be an ICMP error message. That message is sent to the origin server but passes through the wireless communications network where it is detected and confirms that the wireless communications device is operating as a router and was attempting to use tethering.

The method may be performed on every packet received by the wireless communications network and for the wireless communications device. This will prevent packets from reaching tethered devices, this effectively blocks tethered traffic for that wireless communications device. Alternatively, the method may be performed on a subset of packets received by the wireless communications network and for the wireless communications device. The subset may be a random sample. The subset may be selected so as to be sufficient to detect whether the wireless communications device is using tethering.

The hop limit may be a time-to-live value. In an IPv4 header the hop limit is called time- to-live (TTL). TTL is measured in seconds, although every host that passes the datagram must reduce the TTL by at least one unit. In practice, the TTL field is reduced by one on every hop. To reflect this practice, the field is renamed hop limit in IPv6.

The method may further comprise: receiving an error message from the wireless communications device, the error message indicating that the internet protocol packet cannot be routed; and recording an indication of tethering by the wireless

communications device.

The error message may be an ICMP error message. The recording may comprise sending an indication of tethering to another node in the wireless communications network.

The indication of tethering may be used by the wireless communications operator to enforce its tethering policy by editing the hop limit for all packets sent to that wireless communications device, thus disabling any tethering traffic. Importantly, the data connection to the smartphone remains substantially unaffected by this mechanism.

The method may further comprise determining the number of hops from the wireless communications device to the node in the wireless communications network.

The operating system (OS) of the wireless communications device has a default initial TTL value. For example, for Android 3.2.1 the default TTL is 64, similarly iOS has a default TTL of 64, and Windows Mobile has a default TTL of 128. Given the distinct likely starting values and the low number of hops expected between the wireless communications device and the network node, it is in most cases very easy to determine the number of hops. OS finger printing can be used by wireless communications network to determine the operating system of the wireless communications device and the expected default TTL value.

The node in the wireless communications network may be a packet gateway or a tethering detection node. The wireless communications device may be a user equipment device and the wireless communications network may be a cellular communication network.

There is further provided a node of a wireless communication network, the node comprising: a receiver, a processor, and a sender. The receiver is arranged to receive an internet protocol packet for a wireless communications device. The processor is arranged to edit the hop limit for the internet protocol packet such that the hop limit will expire upon the internet protocol packet arriving at the wireless communications device. The sender may be arranged to send the internet protocol packet to the wireless communications device.

If the internet protocol packet is intended for a device connected to the wireless communications device, and the wireless communications device is expected to route that internet protocol packet thereto, the hop limit causes the internet protocol packet to be discarded by the wireless communications device. The wireless communications device, acting as a router, will discard any internet protocol packet for which the hop limit has a value such that the internet protocol packet will arrive at the wireless communications device but be routed no further. Upon discarding a packet due to an expired hop limit, the wireless communications device will send an error message, which may be an ICMP error message. Such a packet will not reach the tethered device, effectively disabling tethering on that connection.

Upon discarding a packet due to an expired hop limit, the wireless communications device will send an error message, which may be an ICMP error message. That message is sent to the origin server but passes through the wireless communications network where it is detected and confirms that the wireless communications device is operating as a router and was attempting to use tethering. The node may be further arranged to: receive an error message from the wireless communications device, the error message indicating that the internet protocol packet cannot be routed; and record an indication of tethering by the wireless communications device.

The indication of tethering may be used by the processor to enforce a tethering policy by editing the hop limit for all packets sent to that wireless communications device, thus disabling any tethering traffic. Importantly, the data connection to the smartphone remains substantially unaffected by this mechanism.

The processor may be further arranged to determine the number of hops from the wireless communications device to the node in the wireless communications network.

The node may be a packet gateway or a tethering detection node. The wireless communications device may be a user equipment device and the wireless

communications network may be a cellular communication network.

The wireless communications device may be a mobile phone, a smartphone, a cell phone, or any device with a cellular modem. The tethered device may be any kind of personal computer such as a television, a smart television, a set-top box, a games- console, a home-theatre personal computer, a tablet, a smartphone, a laptop, or even a desktop PC.

There is further provided an apparatus for detecting tethering in a wireless

communications network, the apparatus comprising a processor and a memory, said memory containing instructions executable by said processor whereby said apparatus is operative to: receive an internet protocol packet for a wireless communications device; edit the hop limit for the internet protocol packet such that the hop limit will expire upon the internet protocol packet arriving at the wireless communications device; and send the internet protocol packet to the wireless communications device. There is further provided an apparatus for detecting tethering in a wireless

communications network, the apparatus comprising a processor and a memory, said memory containing instructions executable by said processor whereby said apparatus comprising: a module for receiving an internet protocol packet for a wireless

communications device; a module for editing the hop limit for the internet protocol packet such that the hop limit will expire upon the internet protocol packet arriving at the wireless communications device; and a module for sending the internet protocol packet to the wireless communications device.

There is further provided a computer-readable medium, carrying instructions, which, when executed by computer logic, causes said computer logic to carry out any of the methods defined herein. There is further provided a computer-readable storage medium, storing instructions, which, when executed by computer logic, causes said computer logic to carry out any of the methods defined herein. The computer program product may be in the form of a non-volatile memory or volatile memory, e.g. an EEPROM (Electrically Erasable Programmable Read-only Memory), a flash memory, a disk drive or a RAM (Random- access memory).

The device is adapted to store a message e.g. in a memory such as a flash drive or a hard disk of the device. Brief description of the drawings

Methods and apparatus for enforcement of tethering policy in a wireless communications network will now be described, by way of example only, with reference to the accompanying drawings, in which:

Figure 1 shows a typical tethering arrangement;

Figure 2 illustrates in more detail how internet protocol packets are handled in a wireless communications network;

Figure 3 is a signaling diagram illustrating packets travelling between a tethered local device and an origin server, via a wireless communications network;

Figure 4 illustrates a method in a node of a wireless communication network; Figure 5 illustrates an alternative method in a node of a wireless communication network.; and

Figure 6 illustrates a node of a wireless communication network.

Detailed description

A typical tethering arrangement is shown in Figure 1. A wireless communications device, here illustrated as a smartphone 100 has set up a local Wi-Fi hotspot and is connected to a tablet 102 and a laptop 104. The smartphone 100 connects to the internet 180 via a wireless communication network 150. Tablet 102 and a laptop 104 are tethered to the smartphone 100 and use its internet connection. FI ere, the wireless communications network 150 is illustrated as comprising a base station 152 and a network node 154. In this arrangement a tethered device such as tablet 102 can access a service hosted on an origin server 190 via a communication chain comprising: the Wi-Fi link to smartphone 100; the wireless communications network 150; and then the internet 180, to which origin server 190 is also connected.

A hop limit or time-to-live (TTL) is a mechanism that limits the lifespan or lifetime of a data packet in a computer or network. The hop limit may be implemented as a counter or timestamp attached to or embedded in the data. Once the prescribed event count or timespan has elapsed, the data packet is discarded. In computer networking, a hop limit prevents a data packet from circulating indefinitely.

In an IPv4 header the hop limit is called time-to-live (TTL). TTL is measured in seconds, although every host that passes the datagram must reduce the TTL by at least one unit. In practice, the TTL field is reduced by one on every hop. To reflect this practice, the TTL field is renamed‘hop limit’ in IPv6. Both the terms‘hop limit’ and ‘TTL’ are used herein as the invention may equally be applied to internet protocol packets that use either protocol, or indeed any hop restriction mechanism.

There is presented herein a method and apparatus to use the hop limit to restrict packet flow to tethered devices, and further to identify when a wireless communications device is attempting to use tethering. In mobile networks there is a tunnel protocol used between the wireless communications device and the packet gateway. This means that there will not be any hop limit changes for traffic going to the device. Such an arrangement is illustrated in figure 2.

Figure 2 illustrates in more detail how internet protocol (IP) packets are handled in the wireless communications network 150. The wireless communications network 150 connects a user equipment (UE) 100 to a remote host 190. The wireless

communications network 150 comprises a base station (eNB) 152 and a Packet Gateway 154. The packet gateway may operate as a tethering detection node. The OSI layers for each node are shown. An IP packet is received at the Packet Gateway 154 of the wireless communications network 150 whereupon the packet is transported via the lower OSI layers to be reconstituted at the UE 100. The IP packet is carried through the wireless communications network 150 using a tunneling protocol such as GTP (GPRS (General Packet Radio Service) Tunneling Protocol). The wireless communications network 150 does not decrement the hop limit at every node within it, and may decrement the hop limit once as the IP packet either enters or leaves the tunnel. In this embodiment the hop limit is decremented once in the wireless communications network 150 as the IP packet arrives in the network. The operator of the wireless communications network will know how many hops of an IP packet’s hop limit are used traversing the network. If the IP packet is to be routed from the UE 100 to another local device, then the hop limit is further decremented by one at the UE 100.

The acronyms in the different layers of the different nodes of figure 2 will now be explained for completeness. APP means application layer 201, which is an abstraction layer that specifies the shared communications protocols and interface methods used by hosts in a communications network. TCP/UDP refers to Transmission Control Protocol or User Datagram Protocol, which are alternative solutions for the presentation layer 202, which is responsible for the delivery and formatting of information to the application layer 201 for further processing or display. Here, the session layer 203 is referred to as IP or Internet Protocol.

The transport layer 204 comprises PDCP (Packet Data Convergence Protocol) or GTP (GPRS (General Packet Radio Service) Tunneling Protocol). The PDCP is located in the Radio Protocol Stack in the UMTS/LTE/ 5G Air interface on top of the RLC layer. The network layer 205 is either RLC (Radio Link Control) or UDP (User Datagram Protocol). The data link 206 is the MAC (Media Access Control) or IP (Internet Protocol). PHY is the physical layer 207, which in a wireless communications network is the radio signals transmitted between nodes.

Accordingly, the operator can know how many hops there are from the tethering detection node or the packet gateway to the wireless communications device regardless of how many routers the packet passes through within the wireless communications network. This means that for traffic going to the wireless communications device, the tethering detection node can change the hop limit value so that the internet protocol packets will only reach the device. If the hop limit for a packet reaches zero but the wireless communications device receives packets intended for a tethered device, it cannot send these on since the hop limit is zero. Such a packet is discarded and when this happens the wireless communications device must send an ICMP (Internet Control Message Protocol) error message. Since the ICMP error message returns to the packet originating server via the packet gateway (or tethering detection node) the packet gateway can detect that error message and conclude that the device is tethering and report this. The report of tethering can be used by the network operator to bring sanctions against the user according to the terms and conditions of their subscription agreement. Such sanctions may include enforcement like blocking or shaping of traffic. However, the network operator may determine it is sufficient that return traffic to the tethered device is blocked at the wireless communications device by virtue of the hop limit being reached.

The TTL (Time To Live) value in the IPv4 header specifies the maximum number of hops a packet can traverse. Different operating systems set different initial TTL values; Windows uses 64 or 128, while iOS and Android use 64 by default.

Figure 3 is a signaling diagram showing an uplink packet travelling from a tethered local device 102 via: a wireless communications device 100, a wireless communications network 150 (the wireless communications network 150 comprising a packet gateway 154, a router 156 and a tethering detection node 158), the internet 180 to an origin server 190. Figure 3 additionally shows a return packet travelling from the origin server 190 back towards the tethering device 102; and an ICMP error message which is sent from the wireless communications device 100 to the origin server 190. Wireless communications device 100 establishes a Wi-Fi network and a connection to tethered device 102, with which the wireless communications device shares its cellular internet connection. Tethered device 102 attempts to access a service hosted at origin server 190 and so sends an uplink packet 301 towards the origin server 190. The uplink packet is passed by all the other nodes, and the internet 180, to origin server 190. In response 310 thereto, the origin server 190 sends a return packet 311 to tethered device 102. Origin server 190 sets the hop limit, here referred to as TTL, of the return packet 311 to 64.

For simplicity, the route through the internet 180 is not shown here, but the return packet 311 passes through ten routing nodes before it arrives at the tethering detection node 158 of the wireless communications network 150, at which point it has a TTL value of 54. Tethering detection node 158 sets the TTL value of the return packet to 1. As explained above, the return packet tunnels through the wireless communications network and does not have its TTL value decremented until it arrives at the wireless

communications device 100. That is, tethering detection node 158 passes the return packet 311 via a router 156 and a packet gateway 154 both of which are still within the wireless communications network 150, and so without changing the TTL of the return packet.

The return packet 311 arrives at the wireless communications device 100 with a TTL of one. The return packet 311 is addressed to tethered device 102 and so the wireless communications device 100, acting as a router, should route the return packet 311 to tethered device 102. However, before routing the return packet 311, the wireless communications device 100 must first decrement its TTL value. Because the TTL of the return packet is 1, when the wireless communications device 100 decrements the TTL value, it hits zero, and the wireless communications device 100 must thus discard 335 the return packet 311. As part of the discard procedure the wireless communications sends an error message 341 in reply to the source of the return packet 311, the origin server 190. The error message 341 is an ICMP (Internet Control Message Protocol) Error message. The ICMP Error message 341 tells the origin server 190 that the return packet 311 was not delivered. The ICMP Error message 341 passes via the wireless communications network 150 and the tethering detection node 158 therein. ICMP error message 341 is detected by the tethering detection node 158 and tells it that wireless communications device 100 attempted to route the return packet 311 to another device, but couldn’t, because the TTL wouldn’t allow it. Thus, an accurate detection of tethering usage by the wireless communications device 100 is obtained at the wireless communications network 150. This method has the advantage that the wireless communication network or mobile service network operator is made aware of tethering activity and can detect authorized and unauthorized tethering behavior. This enables the operator to block tethering, both authorized and unauthorized, to protect operator profitability. Further, the operator is able to enforce tethering detection policies, redirecting subscribers to a portal to purchase a tethering plan, or blocking traffic if the user continues to violate the Terms of Service.

For example, where a user is attempting to use tethering, violating their current terms of service, the operator may offer a service plan upgrade to enable tethering functionality. Thus, the network operator is able to monetize tethering services and offer improved subscriber value. Indeed, with this tethering detection mechanism in place a network operator can choose to offer a variety of personalized subscriber options, including tethering as part of an existing plan or as a stand-alone plan, time-of-day-based tethering, and specified tethering bandwidth limitations.

If applied to only a small proportion of packets sent to a wireless communications device, most tethering traffic would be allowed and error correction mechanisms in the communication channel will likely render the internet connection for the tethered device useable. The network operator can thus use the described method to detect tethering without blocking tethering.

The network operator may apply this method to a subset of the packets sent to each wireless communications device connected to its network. The subset may be a small proportion. The small proportion may be 1 in 1000, for example. In practice, the network operator is likely to only implement the method described herein for wireless communications devices that should not be using tethering.

Figure 4 illustrates a method in a node of a wireless communication network. The method comprises receiving 410 an internet protocol packet for a wireless

communications device. The received packet is edited 420 such that the hop limit of the packet will expire upon the internet protocol packet arriving at the wireless

communications device. The method further comprises sending 430 the internet protocol packet to the wireless communications device.

The method may be performed on every packet received by the wireless communications network and for the wireless communications device. This will prevent packets from reaching tethered devices, this effectively blocks tethered traffic for that wireless communications device. Alternatively, the method may be performed on a subset of packets received by the wireless communications network and for the wireless communications device. The subset may be a random sample. The subset may be selected so as to be sufficient to detect whether the wireless communications device is using tethering. The hop limit may be a time-to-live value. In an IPv4 header the hop limit is called time- to-live (TTL). TTL is measured in seconds, although every host that passes the datagram must reduce the TTL by at least one unit. In practice, the TTL field is reduced by one on every hop. To reflect this practice, the field is renamed hop limit in IPv6.

Figure 5 illustrates an alternative method in a node of a wireless communication network. The method comprises determining 505 the number of hops from the wireless communications device to the node in the wireless communications network. The method further comprises receiving 510 an internet protocol packet for a wireless communications device. The received packet is edited 520 such that the hop limit of the packet will expire upon the internet protocol packet arriving at the wireless

communications device. The method further comprises sending 530 the internet protocol packet to the wireless communications device. The method further comprises: receiving 540 an error message from the wireless communications device, the error message indicating that the internet protocol packet cannot be routed; and recording 550 an indication of tethering by the wireless communications device.

Figure 6 illustrates a node of a wireless communication network, the node comprising: a receiver 610, a processor 620, a memory 625, and a sender 630. The receiver 610 is arranged to receive an internet protocol packet for a wireless communications device. The processor 620 is arranged to edit the hop limit for the internet protocol packet such that the hop limit will expire upon the internet protocol packet arriving at the wireless communications device. The sender 630 may be arranged to send the internet protocol packet to the wireless communications device.

The processor 620 is arranged to receive instructions which, when executed, causes the processor 620 to carry out the above described method. The instructions may be stored on the memory 625.

The node may be further arranged to: receive an error message from the wireless communications device, the error message indicating that the internet protocol packet cannot be routed; and record an indication of tethering by the wireless communications device.

The error message may be an ICMP error message. The recording may comprise sending an indication of tethering to another node in the wireless communications network. The processor may be further arranged to determine the number of hops from the wireless communications device to the node in the wireless communications network.

communications network may be a cellular communication network.

There is further provided an apparatus for detecting tethering in a wireless

communications network, the apparatus comprising a processor and a memory, said memory containing instructions executable by said processor whereby said apparatus is operative to: receive an internet protocol packet for a wireless communications device; edit the hop limit for the internet protocol packet such that the hop limit will expire upon the internet protocol packet arriving at the wireless communications device; and send the internet protocol packet to the wireless communications device.

There is further provided an apparatus for detecting tethering in a wireless

communications network, the apparatus comprising a processor and a memory, said memory containing instructions executable by said processor whereby said apparatus comprising: a module for receiving an internet protocol packet for a wireless communications device; a module for editing the hop limit for the internet protocol packet such that the hop limit will expire upon the internet protocol packet arriving at the wireless communications device; and a module for sending the internet protocol packet to the wireless communications device.

The device is adapted to store a message e.g. in a memory such as a flash drive or a hard disk of the device.

It will be apparent to the skilled person that the exact order and content of the actions carried out in the method described herein may be altered according to the requirements of a particular set of execution parameters. Accordingly, the order in which actions are described and/ or claimed is not to be construed as a strict limitation on order in which actions are to be performed.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design many alternative embodiments without departing from the scope of the appended claims. The word “comprising” does not exclude the presence of elements or steps other than those listed in a claim,“a” or“an” does not exclude a plurality, and a single processor or other unit may fulfil the functions of several units recited in the claims. Any reference signs in the claims shall not be construed so as to limit their scope

The method may also be embodied in a set of instructions, stored on a computer readable medium, which when loaded into a computer processor, Digital Signal

Processor (DSP) or similar, causes the processor to carry out the hereinbefore described method in a node of a wireless communication network.

Equally, the method may be embodied as a specially programmed, or hardware designed, integrated circuit which operates to carry out the method on video data loaded into the said integrated circuit. The tethered device may be a user apparatus. The tethred device may be any kind of personal computer such as a television, a smart television, a set-top box, a games- console, a home-theatre personal computer, a tablet, a smartphone, a laptop, or even a desktop PC.

Further, while examples have been given in the context of particular communications standards, these examples are not intended to be the limit of the communications standards to which the disclosed method and apparatus may be applied. For example, while specific examples have been given in the context of LTE, the principles disclosed herein can also be applied to an NR system, other wireless communication system, and indeed any communication system where a user device may use tethering.

It will be apparent to the skilled person that the exact order and content of the actions carried out in the method described herein may be altered according to the requirements of a particular set of execution parameters, such as speed of encoding, accuracy of detection, resolution of video sources, type of compression standards in use with the statistical multiplexing method, and the like. Accordingly, the order in which actions are described and/ or claimed is not to be construed as a strict limitation on order in which actions are to be performed.

Claims

1. A method in a node of a wireless communication network, the method comprising:

receiving an internet protocol packet for a wireless communications device; editing the hop limit for the internet protocol packet such that the hop limit will expire upon the internet protocol packet arriving at the wireless communications device; and

sending the internet protocol packet to the wireless communications device.

2. The method of claim 1, wherein the hop limit may be a time-to-live value.

3. The method of claim 1 or 2, further comprising:

receiving an error message from the wireless communications device, the error message indicating that the internet protocol packet cannot be routed; and

recording an indication of tethering by the wireless communications device.

4. The method of any preceding claim, further comprising determining the number of hops from the wireless communications device to the node in the wireless communications network.

5. The method of any preceding claim, wherein the node in the wireless communications network is a packet gateway or a tethering detection node.

6. The method of any preceding claim, wherein the wireless communications device is a user equipment device and the wireless communications network is a cellular communication network.

7. A node of a wireless communication network, the node comprising:

a receiver arranged to receive an internet protocol packet for a wireless communications device;

a processor arranged to edit the hop limit for the internet protocol packet such that the hop limit will expire upon the internet protocol packet arriving at the wireless communications device; and a sender arranged to send the internet protocol packet to the wireless

communications device.

8. The node of claim 7, wherein the hop limit may be a time-to-live value.

9. The node of claim 7 or 8, further arranged to:

receive an error message from the wireless communications device, the error message indicating that the internet protocol packet cannot be routed; and

record an indication of tethering by the wireless communications device.

10. The node of any of claims 7 to 9, wherein the processor is further arranged to determine the number of hops from the wireless communications device to the node in the wireless communications network.

11. The node of any of claims 7 to 10, wherein the node is a packet gateway or a tethering detection node.

12. The node of any of claims 7 to 11, wherein the wireless communications device is a user equipment device and the wireless communications network is a cellular communication network.

13. An apparatus for detecting tethering in a wireless communications network, the apparatus comprising a processor and a memory, said memory containing instructions executable by said processor whereby said apparatus is operative to:

receive an internet protocol packet for a wireless communications device;

edit the hop limit for the internet protocol packet such that the hop limit will expire upon the internet protocol packet arriving at the wireless communications device; and

send the internet protocol packet to the wireless communications device.

14. An apparatus for detecting tethering in a wireless communications network, the apparatus comprising a processor and a memory, said memory containing instructions executable by said processor whereby said apparatus comprising: a module for receiving an internet protocol packet for a wireless communications device;

a module for editing the hop limit for the internet protocol packet such that the hop limit will expire upon the internet protocol packet arriving at the wireless communications device; and

a module for sending the internet protocol packet to the wireless

communications device.

15. A computer-readable medium, carrying instructions, which, when executed by computer logic, causes said computer logic to carry out any of the methods defined by claims 1 to 6.