hmm, apart from ttl, you can use other tcp fields e.g. windows, tcp-options, packet-length etc. then, from a captured trace run passive os fingerprinting to find out with reasonable certainty the device generating the traffic.

these can/may be manipulated via ip-tables, but then you still have a huge data-volume to account for...

Can iPhone just route all your traffic through some encrypted VPN? I've heard there's a port of OpenVPN for iOS — that should be sufficient.

At least you'll be sure telco guys are not inspecting your packets by any means, be it "teethering detection", blocking some kind of traffic, or something more malicious, like profiling your Google searches. (Timing analysis may still apply.)

Not to mention things like adobe checking for updates

Yeah, it is trivial to analyze traffic of somebody else when you are working in FBI with court order...

> [from Reddit link]> well there's no way you can set it to 256.

With GNU/Linux iptables it's just one rule in the "mangle" table with TTL target.

On *BSD with pf "packet normalization" can be done with pf's "scrub" directive with min-ttl option.

Unfortunately, I've never used iOS and/or OS X/Darwin, so I don't know what are possibilities are there. But I believe there should be some.

It can't be set to 256 because it's only 8 bits.

(Edit: on reflection, if you know enough to know about the forwarding chains, I'm sure you know that TTL is 8 bits. Sorry.)

My bad, I probably didn't explain myself correctly.

I was talking about modifying TTL of the forwarded packets on the phone, to make the packets look like they were originated from the phone itself.

OK, yeah. I don't know how MyWi works; if it forwards everything by hand, then it can definitely do that. If not, yeah, it's dependent on what the kernel can do.