# US 2013/0159503 A1 · Method and apparatus for detecting tethering in a communications network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2013/0159503 A1 - Document ID: US20130159503A1 - Status: Published application - Kind: A1 - Application number: 13/330,432 - Filed: 2011-12-19 - Published: 2013-06-20 - Earliest claimed: 2011-12-19 - Assignees: AT&T Intellectual Property I, L.P. - Inventors: Jeffrey Erman; Alexandre Gerber; Oliver Spatscheck - Web page: https://patentgrep.com/patent/US20130159503A1 ## CPC - H04W 12/12: Detection or prevention of fraud - G06F 15/163: Interprocessor communication - H04W 12/106: Packet or message integrity - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - H04W 24/08: Testing, {supervising or monitoring} using real traffic - H04W 76/14: Direct-mode setup - H04W 88/04: adapted for relaying to or from another terminal or user - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method, non-transitory computer readable medium and apparatus for detecting a tethering function being performed by an endpoint device in a communications network are disclosed. For example, the method analyzes a data packet directed towards the endpoint device, detects a signature based upon analyzing the data packet, and identifies the endpoint device as performing the tethering function based upon detecting the signature. ## Claims ### Claim 1 A method for detecting a tethering function being performed by an endpoint device in a communications network, comprising: analyzing a data packet directed towards the endpoint device; detecting a signature based upon analyzing the data packet; and identifying the endpoint device as performing the tethering function based upon detecting the signature. ### Claim 2 (depends on 1) The method of claim 1, wherein the analyzing comprises examining a header of the data packet. ### Claim 3 (depends on 1) The method of claim 1, wherein the analyzing comprises examining the data packet for an announcement identifying an operating system that the data packet is intended for. ### Claim 4 (depends on 1) The method of claim 1, wherein the analyzing comprises examining a source port and a destination port of the data packet. ### Claim 5 (depends on 1) The method of claim 1, wherein the detecting the signature comprises: identifying the data packet as being not compatible with the endpoint device. ### Claim 6 (depends on 1) The method of claim 1, wherein the endpoint device is identified as performing the tethering function if a predetermined number of tethering instances is detected within a predetermined period of time. ### Claim 7 (depends on 1) The method of claim 1, wherein the endpoint device is a wireless endpoint device associated with a subscription to a service provided by a network service provider of the communications network. ### Claim 8 (depends on 1) The method of claim 1, further comprising: if the endpoint device is identified as performing the tethering function, then determine if the endpoint device is an authorized tethering endpoint device; and if the endpoint device is not an authorized tethering endpoint device, then notifying a user of the endpoint device to change to a tethering subscription plan for the endpoint device. ### Claim 9 A non-transitory computer-readable medium having stored thereon a plurality of instructions, the plurality of instructions including instructions which, when executed by a processor, cause the processor to perform a method for detecting a tethering function being performed by an endpoint device in a communications network, comprising: analyzing a data packet directed towards the endpoint device; detecting a signature based upon analyzing the data packet; and identifying the endpoint device as performing the tethering function based upon detecting the signature. ### Claim 10 (depends on 9) The non-transitory computer-readable medium of claim 9, wherein the analyzing comprises examining a header of the data packet. ### Claim 11 (depends on 9) The non-transitory computer-readable medium of claim 9, wherein the analyzing comprises examining the data packet for an announcement identifying an operating system that the data packet is intended for. ### Claim 12 (depends on 9) The non-transitory computer-readable medium of claim 9, wherein the analyzing comprises examining a source port and a destination port of the data packet. ### Claim 13 (depends on 9) The non-transitory computer-readable medium of claim 9, wherein the detecting the signature comprises: identifying the data packet as being not compatible with the endpoint device. ### Claim 14 (depends on 9) The non-transitory computer-readable medium of claim 9, wherein the endpoint device is identified as performing the tethering function if a predetermined number of tethering instances is detected within a predetermined period of time. ### Claim 15 (depends on 9) The non-transitory computer-readable medium of claim 9, wherein the endpoint device is a wireless endpoint device associated with a subscription to a service provided by a network service provider of the communications network. ### Claim 16 (depends on 9) The non-transitory computer-readable medium of claim 9, further comprising: if the endpoint device is identified as performing the tethering function, then determine if the endpoint device is an authorized tethering endpoint device; and if the endpoint device is not an authorized tethering endpoint device, then notifying a user of the endpoint device to change to a tethering subscription plan for the endpoint device. ### Claim 17 An apparatus for detecting a tethering function being performed by an endpoint device in a communications network, comprising: a processor configured to: analyze a data packet directed towards the endpoint device; detect a signature based upon analyzing the data packet; and identify the endpoint device as performing the tethering function based upon detecting the signature. ### Claim 18 (depends on 17) The apparatus of claim 17, wherein the processor detects the signature by identifying the data packet as being not compatible with the endpoint device. ### Claim 19 (depends on 17) The apparatus of claim 17, wherein the endpoint device is identified as performing the tethering function if a predetermined number of tethering instances is detected within a predetermined period of time. ### Claim 20 (depends on 17) The apparatus of claim 17, wherein the processor is further configured to: if the endpoint device is identified as performing the tethering function, then determine if the endpoint device is an authorized tethering endpoint device; and if the endpoint device is not an authorized tethering endpoint device, then notify a user of the endpoint device to change to a tethering subscription plan for the endpoint device.