Sometimes the IP TTL can give a clue. Sometimes the timing of the packets as well. As usual, it depends.
