About this subject: I tried it and sniffed the packets. TTL is being changed. But Win ICS is still able to share the connection, I don’t know, maybe MS did something.
So for now on two networks we are doing the reverse thing - detecting ttl that is not 128 and not 64 and adding the client to a list or marking the packets.
But this is still stupid because 90% of these bastarbs use a home router. And the competition lets 'em have whatever TTL so … this is useful when theres no competition.