Right but a a spike is a spike. It could be indicative of tethering but it's not conclusive evidence of tethering. Usage questions don't have one-size-fits-all answers. If you have tons of massive attachments in email then you could have massive email-related data use. If it's text only, not so much. And what's "normal web browsing"? Again, it depends on your specific data use. If you don't know how much you use then use some tools to determine your usage. What's normal for you isn't necessarily so for the next person.