Embodiments of the present invention relate to the field of communications, and provide a method, a node, a mobile terminal and a system for identifying a network tethering behavior. The method includes: receiving, by a gateway general packet radio service support node (GGSN), an Internet protocol (IP) packet sent by a to-be-networked device and forwarded by a mobile terminal; acquiring a time to live (TTL) value in the IP packet; determining whether the acquired TTL value is different from a specified TTL value; and if yes, determining that the to-be-networked device performs a network tethering behavior. Further provided are a corresponding gateway general packet radio service support node, mobile terminal and system. The present invention improves accuracy of identifying a network tethering behavior and expands a range of applicable scenarios for identifying a network tethering behavior.