In systems and methods of detecting a wireless device utilizing unauthorized tethering, a plurality of wireless devices in communication with an access node is detected, and a suspect device list of wireless devices which are not authorized for tethering is determined from among the plurality of detected wireless devices. An expected hop value is stored for each suspect device, a data packet is received from each suspect device, and a first hop value is determined for each suspect device. Based on a first comparison of the expected hop value and the first hop value at least one suspect device is identified as performing unauthorized tethering.