A Policy-Aware Cross-Layer Auditing Service for Tiering and Throttling in Starlink

This paper presents a policy-aware, cross-layer auditing methodology that successfully identifies Starlink service tiers and throttling states by analyzing distinct signatures in goodput, RTT, and an internal-to-user ratio derived from aligned terminal telemetry and host-side probes, without requiring operator visibility.

The Gist

Imagine you have a high-speed internet connection from a satellite company (Starlink). You pay for a specific plan, but sometimes your internet slows down to a crawl. Usually, you might think, "Oh no, there must be a storm, or a tree is blocking the signal, or the network is just busy."

But what if the slowdown isn't an accident? What if it's a deliberate policy by the company? Maybe you ran out of your "fast data" quota, and they've quietly switched you to a slower "economy" lane, or maybe you're on a different subscription tier entirely.

This paper is like a detective story where the authors try to figure out why your internet is slow without asking the company for the answer. They want to know: "Is this a traffic jam (network issue), or is this a toll booth (policy issue)?"

The Detective's Toolkit: "Plan Hopping"

To solve this mystery, the researchers didn't just sit and wait. They played a game of "Plan Hopping."

Imagine you have a car with a smart dashboard. The researchers took their Starlink dish and, over several weeks, constantly switched their subscription plan back and forth. They would switch from a "Priority" plan (fast lane) to a "Stay-Active" plan (slow lane), then to a "Post-Quota" plan (throttled lane), and back again.

By doing this, they created a controlled experiment. They knew exactly when they were supposed to be fast and when they were supposed to be slow, according to the company's website (the "Portal").

The Two Clues: Speed and the "Magic Ratio"

The researchers collected two main clues to identify which "lane" they were in:

1. The Speedometer (Throughput): How fast is the data actually moving?

   • High Speed: 100+ Mbps (The Fast Lane).
   • Low Speed: Around 1 Mbps or 0.5 Mbps (The Slow Lanes).

2. The "Magic Ratio" (R): This is the paper's cleverest invention.

   • Think of the Starlink dish as a factory and your computer as the customer.
   • The factory has an internal counter saying, "We are producing 100 units of data per second."
   • The customer (your computer) only receives 10 units per second because of the speed limit.
   • The Ratio (R) compares what the factory says it's doing vs. what the customer actually gets.
   • In the Fast Lane: The factory and the customer are in sync. The ratio is low and stable (around 10.7).
   • In the Slow Lane: The factory is still churning out data internally, but the customer is getting very little. The gap widens, and the Ratio jumps up (to around 18 or 21).

The "Aha!" Moment

The researchers found that these two clues create a fingerprint for every state:

• The Fast Lane: High speed + Low Ratio.
• The Slow Lanes: Low speed + High Ratio.

Even better, they found that the "Slow Lanes" aren't all the same.

• One slow lane (Stay-Active) is like a slow drip (0.5 Mbps).
• Another slow lane (Post-Quota Throttling) is like a trickle (1 Mbps).

By looking at the speed and the "Magic Ratio" together, they could tell exactly which policy the company was enforcing, even without seeing the company's internal code.

The "Enforcement Delay" Surprise

There was one funny thing they noticed. When you run out of your fast data quota, the internet doesn't stop instantly.

• The Scenario: You use up your 100GB of fast data. The website says "Quota Empty!"
• The Reality: For a few minutes, you are still flying at high speeds!
• The Catch: The "Magic Ratio" starts to wiggle, acting like a canary in a coal mine, warning you that the switch is coming. Then, bam, the speed drops to the slow lane.

It's like a toll booth that doesn't close the gate immediately after you run out of cash; it lets you drive a little further before gently tapping the brakes.

The Simple Solution: A "Traffic Light" Rule

The authors built a simple rule (a detector) that anyone could use on their own computer:

1. Run a quick speed test.
2. Check the "Magic Ratio" (using data from the Starlink dish).
3. If Speed is High AND Ratio is Low: You are in the Fast Lane.
4. If Speed is Low AND Ratio is High: You are being throttled or are on a slow plan.

Why Does This Matter?

Usually, when your internet is slow, you blame the weather or your router. This paper gives you a way to say, "No, it's not the weather. The company is actively slowing me down because of my plan."

It turns the "black box" of satellite internet into something transparent. Instead of guessing, you can now audit your connection and know exactly what "lane" you are driving in, just by looking at your own dashboard.

In a nutshell: The authors taught us how to spot the invisible "speed limit signs" on Starlink by comparing what the satellite dish says it's doing versus what our computer actually receives.

Technical Summary

Here is a detailed technical summary of the paper "A Policy-Aware Cross-Layer Auditing Service for Tiering and Throttling in Starlink."

1. Problem Statement

Low-Earth Orbit (LEO) satellite constellations like Starlink offer broadband connectivity but operate under complex commercial policies, including multiple tariff tiers, data quotas, and post-quota throttling mechanisms.

• The Challenge: When a user experiences a drop in throughput, it is difficult to distinguish whether the cause is policy enforcement (e.g., hitting a data cap or being on a lower-tier plan) or incidental network issues (e.g., congestion, physical obstructions, or weather).
• The Gap: Existing measurement studies often treat commercial plans as fixed background variables or rely on "black-box" end-to-end metrics. There is a lack of systematic, edge-side methodologies to diagnose specific policy regimes (such as stay-active vs. post-quota throttling) without access to the operator's internal scheduler or metadata.

2. Methodology

The authors propose a policy-aware, cross-layer auditing methodology that aligns terminal-side telemetry with host-side active probing.

• Experimental Setup:
  • Location: A residential Starlink deployment at the University of Cambridge (UK) with open-sky visibility.
  • Hardware: A Raspberry Pi 5 connected via Ethernet to the Starlink terminal.
  • Data Collection:
    • Terminal Telemetry: Collected via starlink-grpc-tools (5s polling) and bulk history export (1 Hz), providing internal metrics like downlink_throughput_bps, PoP RTT, and obstruction flags.
    • Host Probing: Active ICMP pings (RTT/loss) and speedtest-cli runs (TCP goodput) every 4–5 seconds and 120 seconds, respectively.
• Plan-Hopping Campaign:
  • The researchers ran a multi-week campaign (232.8 hours) where they actively switched the subscription between different tariff and quota states:
    • S1: Stay-active (low-rate).
    • S2: Priority (pre-quota, high-speed).
    • S3: Post-quota throttling (low-rate).
    • S4: Residential (high-speed).
  • Portal status was used only as ground truth for labeling; the detection algorithm itself relied solely on edge-observable data.
• Key Metric ($R$):
  • The authors introduced a novel cross-layer ratio: $R = C_{int} / T_{user}$.
  • $C_{int}$: Internal downlink throughput indicator from the terminal telemetry.
  • $T_{user}$: Host-side TCP goodput from active speed tests.
  • This ratio captures the discrepancy between what the terminal "sees" internally and what the user actually receives.

3. Key Contributions

1. Policy-Observability Framework: A method to audit tariff and quota regimes on LEO links using only edge-side data, without requiring operator cooperation or internal scheduler access.
2. Discovery of Distinct Fingerprints: Identification of stable, state-dependent signatures in throughput, Point-of-Presence (PoP) RTT, and the internal-to-user ratio ($R$).
3. Lightweight Detection Algorithm: A simple, threshold-based heuristic that separates high-speed and low-rate operations using windowed medians of throughput and $R$, avoiding the need for complex machine learning.
4. Enforcement-Delay Observation: Documentation of a specific "enforcement-delay window" ($G$) occurring after quota depletion but before throttling begins.

4. Key Results

A. Distinct Operating Regimes

The study identified three dominant signatures in the throughput-latency space:

• High-Speed Regime (S2/S4): Throughput ranges from tens to hundreds of Mbps.
  • $R$ Ratio: Tightly concentrated around 10.7 (median).
  • RTT: Lowest median PoP RTT (~22.7 ms).
• Low-Rate Regime 1 (S1 - Stay-Active): Stable plateau around 0.5 Mbps.
  • $R$ Ratio: Median ~21.6.
  • RTT: Higher median PoP RTT (~27.2 ms).
• Low-Rate Regime 2 (S3 - Post-Quota): Stable plateau around 1.0 Mbps.
  • $R$ Ratio: Median ~18.1.
  • RTT: Highest median PoP RTT (~31.6 ms).

B. The Internal-to-User Ratio ($R$)

• In high-speed modes, the terminal's internal indicator ($C_{int}$) and user goodput ($T_{user}$) are relatively proportional ($R \approx 10.7$).
• In throttled modes, $T_{user}$ collapses while $C_{int}$ remains higher, causing $R$ to jump significantly (to ~18–22). This creates a disjoint gap between high-speed and low-rate states in the feature space.

C. Quota Depletion Dynamics

• The study observed a minutes-scale gap (enforcement-delay window $G$) between the portal reporting zero quota and the actual activation of the 1 Mbps cap.
• During this window, throughput gradually declines from ~200 Mbps to ~120 Mbps before abruptly dropping to the cap. The ratio $R$ remains low during this delay and only spikes once the strict cap is enforced.

D. Detection Performance

• Using a 180-second sliding window, the authors defined conservative thresholds:
  • Throughput Threshold ($T_d$): 50 Mbps.
  • Ratio Threshold ($T_r$): 14.5.
• Result: On this specific dataset, the rule (Throughput > 50 AND $R$ < 14.5) perfectly separated the high-speed regime from the low-rate regimes with zero errors.

5. Significance and Limitations

• Significance:
  • Provides a replicable template for edge-side auditing of LEO networks.
  • Demonstrates that commercial policy enforcement leaves detectable "fingerprints" in standard network metrics, allowing users or third parties to diagnose throttling vs. congestion.
  • Offers a low-compute solution (simple thresholds) suitable for deployment on edge devices.
• Limitations:
  • Deployment Specificity: The numerical thresholds (e.g., $R \approx 10.7$) are specific to this terminal, firmware, and network path. They are not universal constants for all Starlink terminals.
  • Single Site: The study is a single-site case study; future work is needed to validate these fingerprints across different geographies and hardware configurations.
  • Black-Box Nature: While the method detects that a policy is active, it does not reverse-engineer the operator's specific internal queueing algorithms.

Conclusion

The paper successfully demonstrates that policy-aware cross-layer auditing is feasible on LEO networks. By combining terminal telemetry with active probing, the authors derived a compact, two-dimensional feature space (Throughput vs. $R$) that allows for the reliable, real-time detection of tariff and quota enforcement states, distinguishing them from incidental network performance degradation.