Identifying a tethered device using TCP error transmissions
Various embodiments comprise systems, methods, mechanisms, and apparatus by which a network operator such as a wireline internet service provider (ISP) may determine that an endpoint device has one or more other wireless devices tethered to it, such as a mobile handset providing dual-Wi-Fi ad-hoc tethering (i.e., connected to a high-speed Wi-Fi network while simultaneously providing Wi-Fi connections to wireless devices tethered to the mobile handset), by monitoring Transmission Control Protocol (TCP)/IP traffic flow associated with endpoint devices (i.e., to or through endpoint devices), characterizing these traffic flows in accordance with one or more error indicative criteria to establish thereby a baseline profile of error indicative criteria that is indicative of a TCP/IP traffic flow associated with an endpoint device that is not associated with tethering (e.g., a rate or number of duplicate ACKs), wherein deviations from the baseline profile of error indicative criteria beyond a threshold are indicative of a TCP/IP traffic flow associated with an endpoint device that is associated with tethering.
1. A method for detecting a tethering function being performed by an endpoint device in a communication network, the method comprising:
at a network element, monitoring Transmission Control Protocol (TCP)/IP traffic flow associated with an endpoint device and determining for the endpoint device an average baseline value R B of a rate of occurrence of a TCP/IP error condition for TCP/IP traffic terminating at the endpoint device;
at the network device, monitoring a TCP/IP traffic flow of interest received by the endpoint device and determining for the TCP/IP traffic flow of interest a rate of occurrence R A of the TCP/IP error condition; wherein
in response to the rate of occurrence R A of the TCP/IP error condition being outside of a statistical margin of error of the average baseline value R B rate of occurrence of the TCP/IP error condition, determining that the TCP/IP traffic flow of interest is associated with a wireless device tethered to the endpoint device.
2. The method of claim 1 , wherein the TCP/IP error condition comprises a transmission by the endpoint device of a duplicate ACK.
3. The method of claim 1 , wherein the average baseline value R B of a rate of occurrence of a TCP/IP error condition for TCP/IP traffic terminating at the endpoint device is determined by averaging the rate of occurrence R A of the TCP/IP error condition for each of a plurality of TCP/IP traffic flows received by the endpoint device.
4. The method of claim 3 , wherein each of the TCP/IP traffic flows used to determine the average baseline value R B of a rate of occurrence of a TCP/IP error condition comprises a TCP/IP traffic flow associated with a predefined application instantiated at the endpoint device.
5. The method of claim 4 , wherein the predefined application instantiated at the endpoint device comprises an application pre-loaded onto the endpoint device by a network operator.
6. The method of claim 3 , wherein at least some of the TCP/IP traffic flows used to determine the average baseline value R B of a rate of occurrence of a TCP/IP error condition comprise TCP/IP traffic flows of interest having a rate of occurrence R A of the TCP/IP error condition within the statistical margin of error of the average baseline value R B rate of occurrence of the TCP/IP error condition.
7. The method of claim 1 , further comprising adapting the average baseline value R B of a rate of occurrence of a TCP/IP error condition in response to an application or service associated with the PC IP traffic flow of interest.
8. The method of claim 1 , further comprising adapting the average baseline value R B of a rate of occurrence of a TCP/IP error condition in response to conditions associated with a wireless access point (WAP) in communication with the endpoint device.
9. The method of claim 8 , wherein the conditions associated with the WAP comprise one or more of a time of day, WAP bandwidth constraints, WAP congestion level, and WAP connected device count.
10. The method of claim 1 , further comprising adapting the average baseline value R B of a rate of occurrence of a TCP/IP error condition in response to conditions associated with at least a portion of the communication network in communication with the endpoint device.
11. The method of claim 10 , wherein the conditions associated with at least a portion of the communication network comprise one or more of a time of day, network congestion levels, and network buffer utilization level.
12. The method of claim 10 , wherein the conditions associated with at least a portion of the communication network comprise one or more of network path length, network equipment availability, and network link availability.
13. The method of claim 1 , wherein the TCP/IP traffic flow of interest is selected in accordance with at least one of a corresponding application type, a corresponding data type, and a corresponding traffic type.
14. The method of claim 1 , wherein the TCP/IP traffic flow of interest is selected in accordance with at least one of a corresponding WAP of interest, and a corresponding endpoint device of interest.
15. The method of claim 2 , wherein the TCP/IP error condition further comprises a retransmission timeout (RTO) condition.
16. The method of claim 1 , wherein the network element comprises provider equipment (PE) within the communications network.
17. The method of claim 16 , wherein the PE comprises one or more of a network manager, a gateway, and a WAP.
18. The method of claim 1 , wherein the method is performed for each of a plurality of endpoint devices capable of tethering and exhibiting a high traffic level.
19. An apparatus in a provider network configured for monitoring TCP/IP traffic flows associated with endpoint devices, the apparatus comprising a processor for executing instructions stored in a tangible and non-transitory computer readable medium to detect a tethering function being performed by an endpoint device in a communication network, the method comprising:
determining for an endpoint device, an average baseline value R B of a rate of occurrence of a TCP/IP error condition for TCP/IP traffic terminating at the endpoint device;
determining, for a TCP/IP traffic flow of interest received by the endpoint device, a rate of occurrence R A of the TCP/IP error condition; and
in response to the rate of occurrence R A of the TCP/IP error condition being outside of a statistical margin of error of the average baseline value R B rate of occurrence of the TCP/IP error condition, determining that the TCP/IP traffic flow of interest is associated with a wireless device tethered to the endpoint device.
20. The apparatus of claim 19 , wherein the apparatus comprises a network manager, a gateway, or a wireless access point (WAP).
21. A computer implemented method of detecting a tethering function being performed by an endpoint device in a communication network, the method comprising:
at a network element, monitoring Transmission Control Protocol (TCP)/IP traffic flow associated with an endpoint device and determining for the endpoint device an average baseline value R B of a rate of occurrence of a TCP/IP error condition for TCP/IP traffic terminating at the endpoint device;
at the network device, monitoring a TCP/IP traffic flow of interest received by the endpoint device and determining for the TCP/IP traffic flow of interest a rate of occurrence R A of the TCP/IP error condition; wherein
in response to the rate of occurrence R A of the TCP/IP error condition being outside of a statistical margin of error of the average baseline value R B rate of occurrence of the TCP/IP error condition, determining that the TCP/IP traffic flow of interest is associated with a wireless device tethered to the endpoint device.