People increasingly rely on online services for daily activities like remote work, entertainment, or social interaction. However, users may experience varying performance across similar applications due to ISPs' (Internet Service Providers) traffic differentiation practices. Some ISPs may intentionally block, slow, or prioritize specific Internet traffic based on the application, service, or user. This practice relates to the contentious issue of network neutrality: the principle that all traffic on the Internet should be treated equally. Some advocate for legal regulation against all traffic differentiation, while others argue that differentiation is part of a free economy and should be implicitly regulated by the market. Despite the different opinions, there is a widespread agreement that transparency is vital for consumers to make informed and fair choices when selecting ISPs. However, how can we ensure that ISPs are honest about the traffic differentiation practices they disclose? In prior work, Wehe proposed a reliable test for detecting differentiation through end-to-end throughput measurements. Wehe detects differentiation but can not pinpoint the responsible network. Since multiple ISPs exist along the network path, any claim that an ISP differentiates must come with the strongest, most reasonable evidence, especially given that such practices are illegal in certain jurisdictions.

In this thesis, we present a system, WeHeY, designed for Internet users to localize differentiation, i.e., obtain concrete evidence that differentiation happens at a specific network. WeHeY is based on two key elements: (1) It looks for similar performance patterns using end-to-end measurements, which (2) are collected along two paths that intersect only at that specific network.

On the one hand, similar performance patterns enable us to find evidence that the application traffic flows sent along different paths are differentiated together at a common bottleneck queue. We developed two algorithms to determine whether traffic shares a common bottleneck. The first targets the typical scenario used today, where the user's traffic is differentiated separately from other network traffic. The second targets the more general scenario where the user's traffic shares a queue with other traffic. The main challenge we had to solve with these algorithms was detecting performance similarity with short and imperfect end-to-end measurements. We have evaluated the two algorithms extensively using simulation, emulation, and real network operators.

On the other hand, ensuring that paths intersect only at the suspected network makes it possible to attribute any bottleneck queue detected by the previous algorithms to that network. We show that it is feasible to find such paths in practice.

We provide a prototype of WeHeY, which was evaluated with real network operators but has not been deployed for users yet.