Systems, methods, and computer-readable media for identifying and managing wireless devices that are performing tethering services are described. The system may include a database and server. The database stores records of services subscribed by wireless devices in a wireless network. The server may poll the database to generate a list of wireless devices that are not subscribed to a tethering service. In turn, the server receives notification messages from each wireless device that is tethering at least one other network element. The wireless devices are identified as unauthorized by the server when the notification message indicates existence of a configured network address translation table at the wireless device and the wireless device is located on the list of wireless devices that are not subscribed to the tethering service.