How Airtel could detect hotspot use on Unlimited 5G

Airtel's Unlimited 5G Data Policy: What's the Real Story?

Airtel's Unlimited 5G Data policy has been at the center of a recent controversy, with many customers expressing concerns about the company's stance on hotspot use. According to a source, Airtel does not check whether a customer uses data through a mobile hotspot or directly on the handset, and the only operative limit on its Unlimited 5G Data is the 300 GB fair usage threshold. This means that customers can use their data as they see fit, without worrying about being penalized for tethering.

However, the policy does reserve the right to throttle speeds in cases of commercial use. This has led some to question whether Airtel's Unlimited 5G Data policy is truly unlimited. The company has not put out a formal statement on the matter yet, but it's clear that the issue is causing concern among customers and regulators alike.

The Technicalities of Hotspot Detection

So, how does Airtel detect hotspot use? The answer lies in the technicalities of network traffic management. When a customer connects a laptop through a phone's hotspot, the laptop's traffic travels over the same mobile connection as the phone's own traffic. It carries no marker identifying its source device. An operator that wants to enforce a hotspot restriction has to infer a second device from patterns in the traffic, which security researchers describe as reading signals in the data packets, the small units into which network traffic is broken, rather than any explicit label.

In the current dispute, a user said customers alter the Time-to-Live (TTL) value in their packets and route traffic through Virtual Private Networks (VPNs), which can mask the characteristics of a connection, to keep tethered data from standing out. What signals would reveal tethering? Security literature and technical write-ups of the Airtel row cite several signals an operator can read: Time-to-Live (TTL): a counter in each packet's header, the addressing label on the outside of a packet, that drops by one every time the packet passes through a device. Traffic routed through the phone shows a TTL one lower than traffic starting on the phone, which can reveal a second device.

Operating-system fingerprinting: the network identifies technical traits in the traffic, such as how a device handles network connections and the Maximum Transmission Unit (MTU) size, the largest chunk of data it sends at once, which differ between a laptop and a phone. Deep Packet Inspection (DPI): examines the contents of packets rather than only their headers. Does detection mean reading your traffic? Not necessarily, and the distinction is the privacy question. TTL checks, operating-system fingerprinting, and MTU reads work on the packet header, the addressing information on the outside of each packet. DPI goes further and inspects the payload, the data inside. Security vendors describe the distinction as judging a book by its cover versus reading its contents. An operator can flag most tethering from header signals alone, so the sharper privacy concern arises only if it inspects payload.

India's Net-Neutrality Rules

In November 2017, TRAI recommended a rule barring operators from 'any form of discrimination or interference in the treatment of content, including practices like blocking, degrading, slowing down or granting preferential speeds or treatment.' TRAI said the principle applies to 'any discriminatory treatment based on the sender or receiver, the network protocols, or the user equipment.' The same recommendations exempt 'reasonable traffic management practices' from that bar. The DoT adopted the recommendations in 2018 and amended operators' licence conditions, making a breach a licence violation. TRAI has not stated whether restricting a data benefit by device type falls within the discrimination bar or the traffic-management exemption. Who would enforce the rule anyway? DoT, not TRAI, holds the power to act on licence-condition breaches, and as MediaNama has reported, there has been little public information on monitoring or enforcement since the rules took effect. A multi-stakeholder body TRAI recommended to develop technical standards for traffic management has not materialised in the form proposed. That gap leaves practices like usage-based throttling largely untested against the rules.