Detecting tethering in networks
A system for detecting a computing device tethered to a mobile device is described. The system includes communicatively coupled the computing device to the mobile device with an IPv4 domain protocol. Additionally, the mobile device is communicatively coupled to the mobile data network with an IPv6 domain protocol. A network module, associated with a mobile data network, receives a DNS request packet from the mobile device. An IPv6 hostname and an IPv6 destination address is associated with the DNS response packet, when the DNS response packet is associated with the IPv6 address. Additionally, an IPv4 hostname and an IPv4 destination address is associated with the DNS response packet, when the DNS response packet is associated with the IPv4 address. A communication packet, generated by the mobile device, is also received by the network module. The communication packet includes a destination address and a hostname. The computing device is tethered to the mobile device when the destination address matches the IPv4 destination address and the hostname does not match the IPv6 hostname.
1. A method for detecting a computing device tethered without authorization to a mobile device, the method comprising:
communicatively coupling the computing device to the mobile device with an IPv4 address;
communicatively coupling the mobile device to a mobile data network with an IPv6 address;
enabling a network module associated with a mobile data network to receive a DNS response packet associated with the mobile device;
determining an IP address selected from an Ipv6 address and an IPv4 address for the DNS response packet;
adding an IPv6 hostname and an IPv6 destination address when the DNS response packet is associated with the IPv6 address;
adding an IPv4 hostname and an IPv4 destination address when the DNS response packet is associated with the IPv4 address;
generating an IPv6 table that includes the IPv6 hostname and the IPv6 destination address;
generating an IPv4 table that includes the IPv4 hostname and the IPv4 destination address;
detecting a TCP packet generated by the mobile device, with the network module, wherein the TCP packet includes a TCP destination address and a TCP hostname; and
determining the computing device is tethered without authorization to the mobile device, with the network module, when the TCP destination address matches the IPv4 destination address and the TCP hostname does not match the IPv6 hostname.
2. The method of claim 1 further comprising determining the computing device is untethered to the mobile device when the TCP destination address matches the IPv6 destination address.
3. The method of claim 1 further comprising determining the computing device is untethered to the mobile device when the TCP destination address matches the IPv4 address and the corresponding hostname matches the IPv6 hostname.
4. The method of claim 1 further comprising determining the computing device is untethered to the mobile device when the TCP destination address does not match the IPv6 destination address and the IPv4 destination address.
5. The method of claim 1 further comprising,
generating an IPv6 hash table that includes the IPv6 hostname and the IPv6 destination address, and
generating an IPv4 hash table that includes the IPv4 hostname and the IPv4 destination address.
6. A system for detecting a computing device tethered without authorization to a mobile device, the system comprising:
the computing device communicatively coupled to the mobile device with an Ipv4 domain protocol;
the mobile device communicatively coupled to a mobile data network with an Ipv6 domain protocol;
a network module associated with a mobile data network that is configured to receive a DNS response packet associated with the mobile device;
an IP address selected from an Ipv6 address and an Ipv4 address for the DNS response packet;
an Ipv6 hostname and an Ipv6 destination address associated with the DNS response packet when the DNS response packet is associated with the Ipv6 address;
an Ipv4 hostname and an Ipv4 destination address associated with the DNS response packet when the DNS response packet is associated with the Ipv4 address;
an Ipv6 table that includes the Ipv6 hostname and the Ipv6 destination address;
an Ipv4 table that includes the Ipv4 hostname and the Ipv4 destination address;
a TCP packet generated by the mobile device communicating with the network module, wherein the TCP packet includes a TCP destination address; and
wherein the computing device is tethered without authorization to the mobile device when the TCP destination address matches the Ipv4 destination address and the corresponding hostname does not match the Ipv6 hostname.
7. The system of claim 6 wherein the computing device is untethered to the mobile device when the TCP destination address matches the Ipv6 destination address.
8. The system of claim 6 wherein the computing device is untethered to the mobile device when the TCP destination address matches the Ipv4 address and the TCP hostname matches the Ipv6 hostname.
9. The system of claim 6 wherein the computing device is untethered to the mobile device when the TCP destination address does not match the Ipv6 address and the Ipv4 destination address.
10. The system of claim 6 further comprising,
an Ipv6 hash table that includes the IPv 6 hostname and the Ipv6 destination address, and
an Ipv4 hash table that includes the Ipv4 hostname and the Ipv4 destination address.
11. A method for detecting a computing device tethered without authorization to a mobile device, the method comprising:
communicatively coupling the computing device to the mobile device with an Ipv4 address;
communicatively coupling the mobile device to a mobile data network with an Ipv6 address;
enabling a network module associated with a mobile data network to receive a DNS response packet associated with the mobile device;
determining an IP address selected from an Ipv6 address and an Ipv4 address for the DNS response packet;
adding an Ipv6 hostname and an Ipv6 destination address when the DNS response packet is associated with the Ipv6 address;
adding an Ipv4 hostname and an Ipv4 destination address when the DNS response packet is associated with the Ipv4 address;
generating an Ipv6 table that includes the Ipv6 hostname and the Ipv6 destination address;
generating an Ipv4 table that includes the Ipv4 hostname and the Ipv4 destination address;
detecting a communication packet generated by the mobile device, with the network module, wherein the communication packet includes a destination address and a hostname; and
determining the computing device is tethered without authorization to the mobile device, with the network module, when the destination address matches the Ipv4 destination address and the hostname does not match the Ipv6 hostname.
12. The method of claim 11 further comprising determining the computing device is untethered to the mobile device when the destination address matches the Ipv6 destination address.
13. The method of claim 11 further comprising determining the computing device is untethered to the mobile device when the destination address matches the Ipv4 address and the hostname matches the Ipv6 hostname.
14. The method of claim 11 further comprising determining the computing device is untethered to the mobile device when the destination address does not match the Ipv6 destination address and the Ipv4 destination address.
15. The method of claim 11 further comprising,
generating an Ipv6 hash table that includes the Ipv6 hostname and the Ipv6 destination address, and
generating an Ipv4 hash table that includes the Ipv4 hostname and the Ipv4 destination address.
16. A system for detecting a computing device tethered without authorization to a mobile device, the system comprising:
the computing device communicatively coupled to the mobile device with an Ipv4 domain protocol;
the mobile device communicatively coupled to a mobile data network with an Ipv6 domain protocol;
a network module associated with a mobile data network that is configured to receive a DNS response packet associated with the mobile device;
an IP address selected from an Ipv6 address and an Ipv4 address for the DNS response packet;
an Ipv6 hostname and an Ipv6 destination address associated with the DNS response packet when the DNS response packet is associated with the Ipv6 address;
an Ipv4 hostname and an Ipv4 destination address associated with the DNS response packet when the DNS response packet is associated with the Ipv4 address;
an Ipv6 table that includes the Ipv6 hostname and the Ipv6 destination address;
an Ipv4 table that includes the Ipv4 hostname and the Ipv4 destination address; and
a communication packet generated by the mobile device communicating with the network module, wherein the communication packet includes a destination address and a hostname;
wherein the computing device is tethered without authorization to the mobile device when the destination address matches the Ipv4 destination address and the hostname does not match the Ipv6 hostname.
17. The system of claim 16 wherein the computing device is untethered to the mobile device when the destination address matches the Ipv6 destination address.
18. The system of claim 16 wherein the computing device is untethered to the mobile device when the destination address matches the Ipv4 address and the hostname matches the Ipv6 hostname.
19. The system of claim 16 wherein the computing device is untethered to the mobile device when the destination address does not match the Ipv6 destination address and the Ipv4 destination address.
20. The system of claim 6 further comprising,
an Ipv6 hash table that includes the Ipv6 hostname and the Ipv6 destination address, and
an Ipv4 hash table that includes the Ipv4 hostname and the Ipv4 destination address.