Extracting User Agent Strings from 3G/4G Data
Mobile carriers have limited capabilities of performing mass deep packet inspection on their infrastructure. One proof is the lack of incentive for many carriers to detect DNS tunneling through their mobile networks (DNS traffic is not being charged).
This document presents an overview of 3G and 4G mobile services and methods supporting the lawful interception of targets subscribing to these services: http://www.aqsacom.com/resources/pdf/LI-3G-4G-AQSA_WP_2012_01.pdf
These interception systems cover a wide range of services and technologies, including wire-line voice, wireless voice, wired and wireless data, and emerging services such as VOIP. Deep packet inspection can be performed during these intercepts and data such as user agent strings can be extracted.