No, at&t cannot tell the difference of packets being passed on their network.
No carrier has that capability. The amount of resources needed to monitor packets in a way that is effective, at an effective rate, is basically not cost effective at this point.
The tethering notices are completely based off of data usage. It's been determined that most carriers take notice of you if you exceed 5gb. So if you manage to use over 5gb of data without tethering, you could very well receive one of these texts.
With that said, they can see packet routes. So if your already being watched, and are tethering, and happen to be using it for say...pirating, it could lead to further action. I've only heard one case of this, but still worth noting.
Also, contract prevents at&t, or any carrier for that matter, from adding tethering to your bill. Their work around for that is that if you exceed a data limit, or a fair use limit, they can and will charge you for that.
I tether causally; causally being non-data heavy lurking. I've owned a blackberry bold 9000, an iphone 3g, and now my captivate...all were made tether capable. All were used for tethering. None had received a notice.
Hope this is helps!
tl;dr- no, at&t can't tell if you're tethering.
Sent from my SAMSUNG-SGH-I897 using XDA App