I signed up for a tethering plan with ATT... where can I see tethering data consumed? All I see is media net/phone.
I am using mywi for tethering.
I am using mywi for tethering.
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
iPhone TTL modification to cloak tethered packets - let's make them work harder to catch us.
- Thread starter Fry-man22
- WikiPost WikiPost
- Start date
- Sort by reaction score
- Status
Yes - you can change the TTL of the iPad by either installing a terminal client and using the sysctl command on the device or you can ssh into the device and execute it there. The command to change it is the exact same as the one posted above for OSX.
And it's impossible to do this without JB'ing the iPad? There's no way to go in and change one single digit of code?
And it's impossible to do this without JB'ing the iPad? There's no way to go in and change one single digit of code?
Now I'm really praying for a jailbreak for the iPad2. I'm pretty much shut out from affecting any code on that device until then
.So far I've received the text, email, and a letter. They are on to me
LOL!nvmd, figured it out and it works
unzip the attached. Place com.scott.TTLmod.plist into /Library/LaunchDaemons on the iPad. Make sure ownership is root:wheel and permissions are 644. Place TTLmod.sh into /var/mobile/Scripts. Make sure permissions are 775. Might have to create the Scripts folder.
Reboot and running
sysctl net.inet.ip.ttl
should return 65.
Hey that is a really slick script, thanks.
I have a question about whether there is any way this script could be causing the IOS mail to display every email as no sender, no content, and from a date in the 60s or 70s on a gmail exchange account? I have googled and seen that people have had this problem ever since ios 4 but it seems to be caused by various things. It only started happening after I did this script and only when I tether with wifi but not when using a regular wifi. I also updated isslfix in cydia around the same time so that is another possible cause. It only seems to be fixed by rebooting the device.
My ipad is running ios 4.3.3.
Along this line I was also wondering what the keepalive commands are needed for in the plist that is placed in the launch dameon?
Thanks again for such a great solution.
I got the email
A month ago I got the email, text, and letter from AT&T about the unauthorized tethering. I called them and the lady on the phone told me that anytime you connect the phone to another device to watch movies, listen to music or use the internet, you are tethering. I confronted her on this since I sync my iPhone 4 to my Apple TV to watch movies that I have on my phone and listen to music. She said this was considered tethering. To make a long story short I got really pissed because basically she was telling me that all the things that the phone is able to do was considered tethering, including docking it to my truck stereo, and that they were going to change my plan from the unlimited to the 4GB tethering plan. I then contacted the FCC and filed a complaint. It went through and I got a phone call from Corporate AT&T. This lady was a little nicer and more knowledgeable than the last. Since I filed the FCC complaint they had to contact me in regards to it. After a 30 minute conversation I asked the lady how they go about determining who is tethering or not. She told me that the network engineers have got a monitoring system that filters through all the data that is going in and out of the network whether through the phone APN or the tethering APN. It looks for the TTL in the packet header to determine how many jumps the packet has made. If it is more than the default amount, and the number is lower than expected, the system flags the account and verifies whether it is on a tethering plan. If not then the system proceeds to send out the notices to the customer. I have not been using tethering lately, I hardly ever use it at all even before this happened to me, so I can not verify that changing the TTL number to 65 will work, but it should it the lady at corporate AT&T was telling me the truth on how they detect the tethering.
A month ago I got the email, text, and letter from AT&T about the unauthorized tethering. I called them and the lady on the phone told me that anytime you connect the phone to another device to watch movies, listen to music or use the internet, you are tethering. I confronted her on this since I sync my iPhone 4 to my Apple TV to watch movies that I have on my phone and listen to music. She said this was considered tethering. To make a long story short I got really pissed because basically she was telling me that all the things that the phone is able to do was considered tethering, including docking it to my truck stereo, and that they were going to change my plan from the unlimited to the 4GB tethering plan. I then contacted the FCC and filed a complaint. It went through and I got a phone call from Corporate AT&T. This lady was a little nicer and more knowledgeable than the last. Since I filed the FCC complaint they had to contact me in regards to it. After a 30 minute conversation I asked the lady how they go about determining who is tethering or not. She told me that the network engineers have got a monitoring system that filters through all the data that is going in and out of the network whether through the phone APN or the tethering APN. It looks for the TTL in the packet header to determine how many jumps the packet has made. If it is more than the default amount, and the number is lower than expected, the system flags the account and verifies whether it is on a tethering plan. If not then the system proceeds to send out the notices to the customer. I have not been using tethering lately, I hardly ever use it at all even before this happened to me, so I can not verify that changing the TTL number to 65 will work, but it should it the lady at corporate AT&T was telling me the truth on how they detect the tethering.
Really, I wasn't aware that someone had posted that a rep from AT&T explicitly stated that AT&T looks at TTL in the packet header to determine if someone is tethering or not.
I found the post you complained about to be a lot more informative that the one you put up
I know this has been discussed that AT&T is most likely keying on the fact that the TTL on packets coming through the iPhone router have an unexpected TTL (63 for OSX/iOS, 127 for Windows) to detect tethering. When they reach ATT's node packets should always have ttl=64 so we can get around this on a client by client bases by setting the TTL on each one to 65. This of course makes it where when the first hop to the phone occurs the packet ttl is decremented to the expected 64.
On OS X clients the TTL can be set appropriately by pasting the following in terminal:
sudo sysctl -w net.inet.ip.ttl=65
To modify the default TTL in Windows, do the following:
Click on Start and Run (or Search) and type "regedit" to open the Windows registry editor.
Navigate to the following registry key: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
In the right-hand pane, right-click and select "New - DWORD (32-bit value)" and set its name to "DefaultTTL" and its value to 65 - I make no guarantees this does not adversely affect your Windows box
I have not researched how to modify this on the iOS side (for my iPad) because if I mess with anything in iOS I want it to be a more robust hack than just changing this on EVERY freaking device I connect to my network, it's just my luck some jerk would connect to MyWi and send some data and I get busted.
So now to the point of the thread. I have seen Linux scripts that set ALL traffic routed though a device to a certain value - I want this on my iPhone. Basically I just want to hard code the TTL on ALL packets that leave the phone - regardless of what it was at the source. I don't know what to start with that though so I thought I'd share with the brain trust here and see what we can come up with. At the end of the day I bet we could sell our TetherCloak on Cydia for at least a dollar
LOL!!!!
Hey... How is this working out for you?
Great ideas here, but...
There is so much attitude and bickering, sadly, nothing substantial will likely come of it.
There is so much attitude and bickering, sadly, nothing substantial will likely come of it.
If you missed the really long thread, I have tried tethering with TTL set to that and also with a VPN and still got a text a few weeks later. So nope it doesn't work unless AT&T doesn't really care anymore since your max "unlimited data" is pretty much capped at 3GB anyways.
Did anybody else try doing this TTL hiding method and still got the message from AT&T? I already got the txt message once and stopped tethering that was around 1 year ago and I never went over the 2gb mark when tethering, (I have the unlimited data plan) my buddy with who I share the plan right now lately uses his data (phone only no tethering) over 50gb a month and he never got a message from AT&T so it's definitely something else then the data usage that they use to figure out wether your tethering or not. I got the new iPad and really want to tether but don't want to loose the grandfathered unlimited plan, anybody can verify 100% that this TTL method works???? Please let me know thanks!!!
what if you do the ttl hiding on your computer and iphone and change the computer name from your name or whatever to an ip address and change the browser useragent string on your computer to an ip instead or with ttl what if you change your computers ttl and then iphones ttl to be exactly 65 bytes when added together 33 on computer and 32 on iphone just a thought
nvmd, figured it out and it works
unzip the attached. Place com.scott.TTLmod.plist into /Library/LaunchDaemons on the iPad. Make sure ownership is root:wheel and permissions are 644. Place TTLmod.sh into /var/mobile/Scripts. Make sure permissions are 775. Might have to create the Scripts folder.
Reboot and running
sysctl net.inet.ip.ttl
should return 65.
I have not been able to get this script to run. I used iExplorer 3 with afc2add from cydia installed on the iPad to access the respective files and place the scripts. My iPad still returns ttl=64 after reboot.
Can anyone assist me in checking/changing the associated permissions through mobile terminal?
Is it possible that these instructions are for a mobile terminal installation only? . . or did I miss something?
Any assistance would be greatly appreciated.
This is a really old thread I know but I have tried everything to change the TTL to 65 but ping test still shows 64 on my iPad running 9.3.3
Can any smart soul help ?
A great blast from the past!
I followed this thread with great interest when it was active, and would routinely modify the TTL number in my MBP, and installed the file and script so my iPad (running OS 5.1.1) would boot up with a fake TTL number. But that was years ago. It's well worth noting that there was never any definitive proof of the method(s) AT&T used to detect tethering.
More recently, I have been tethering without bothering to change TTL, and have averaged well over 100 GB / month tethering Apple TV and other devices. My feeling is that AT&T is no longer going after unauthorized tethering much (if at all) now that they've built out their infrastructure to better support their subscribers.
Last edited:
"For anyone looking for a fix while tethering to MacOS, changing the TTL to 65 also works in this case. Remember, you must have an active full tunnel VPN. Temporarily change MacOS TTL to 65: `sudo sysctl -w net.inet.ip.ttl=65`. I can't paste a link for reference, but google "How do you change the TTL in macOS High Sierra? StackedOverflow" for further reading. "
This isn't working on VZW anymore.
Can anyone test/confirm that the TTL trick is still working for VZW as of 2019?
This isn't working on VZW anymore.
Can anyone test/confirm that the TTL trick is still working for VZW as of 2019?
As of 28 August 2019 this seem to be working with Verizon.
My tethered data was reached before implementing, and resulted in tethered speeds of about 0.16mbps down/ 0.54 mbps up on a MBA tethered to an iPhone 7.
After changing mba's ttl to 65 from 64, I retested at 4.38mbps down/ 4.40 mbps up. (I ran a couple tests, these are averages.)
NOTE that speeds tested on the iPhone are 26.36mbps down/ 15.23mbps up. Not sure why the tethered vs on device speeds are so different.
It worked for me in my test with just testing the speeds. My hotspot is capped at 15GB. I used it already because I was recently downloading. My tethered speeds dropped to 0.36 Down and 0.64 Up. After I entered the commands in terminal to my surprise the speeds increased dramatically. They were pretty consistent through for WiFi and USB tethering. Around 22-23 Down and 22-23 Up. With VPN on the speed test crashed. My speeds from my iPhone were 40 Down and 25 Up.
