For the last 2 months, Xfinity has claimed that we have exceeded our allotted amount of data, but I disagree with that.

[jnelsoninjax]

As the title says, this little game is getting beyond ridiculous with Xfinity. We are being held hostage by them as there is no other choice for internet providers to our address and they know this. I was in the hospital for ~2 weeks at the beginning of this month, and we do not play online games, we do not have any gaming systems, we do not even have a TV, so the only thing that is being done with the internet is mainly YouTube, and I find it very hard to believe that YouTube could use 1.2GB of data in a month unless we were streaming 4K 24/7, which we don't. It will not do any good to argue this point with Xfinity, as there is no way for me to say 100% certainly that we aren't using that much data. Our network consists of 3 wired desktops, 2 laptops that are not used, 2 tablets that are used infrequently, 4 cell phones, and 4 PoE camera's that are local only. Our WiFi password would not be easy to crack, and we do check to make sure there are no rouge connections (which there haven't been) So my question is what recourse do I have? Is there any method for monitoring the amount of data that the network is using? With 3 desktops I would imagine that it might be a difficult task. I know that we had this issue sometime ago and when I called them on it, I was basically told that they are correct, but also had one slip up and state that they could not monitor our usage because we are using our own modem, not one leased from them. To give you an idea of the usage, I am attaching a screenshot of what they show me:

Notice that August and September were almost identical in usage, then October hits, and suddenly they show twice the amount of data used then in the previous months.

[Mindovermaster Moderator]

What modem do you have? I think there is a problem with your modem sending information to IPS or just going bad..

 

Wait for @BudManHe should be helpful.

[jnelsoninjax]

On 19/11/2021 at 18:10, Mindovermaster said:

What modem do you have? I think there is a problem with your modem sending information to IPS or just going bad..

 

Wait for @BudManHe should be helpful.

Modem in question: https://smile.amazon.com/gp/product/B0741FKSZ8 been using it since November 2018

[adrynalyne]

Its easy to use that much data with YT.

 

I have a home of three, and I am seeing over 1TB in a three week period. I'd say almost none is 4K.

[+mram Subscriber²]

Background processes are a big deal.    Heck even foreground processes.  What resolution videos are downloaded?  What's done on mobile/tablets?  

Whenever I talk with clients I discuss "baselines" a lot -- you need to have a good idea of what "normal" is to really identify the "abby-normal".  In this case you probably would be served well to seriously investigate your network traffic over a lengthy period of time, going machine by machine.

 

I don't mean to compare or sell, but I get xfinity unlimited internet for $25 (on top of gigabit internet at $100) and considering my family's usage and my own, I can easily download a few ISOs and movies and data in like 30g a day.  I just didn't want to worry about it.  I have kids - nuf said there.  Considering I get all of my entertainment via internet it's well worth it with zero worry.... overage worry is not worth it.  Internet is lifesblood to me.

[jnelsoninjax]

On 19/11/2021 at 18:28, mram said:

Background processes are a big deal.    Heck even foreground processes.  What resolution videos are downloaded?  What's done on mobile/tablets?  

Whenever I talk with clients I discuss "baselines" a lot -- you need to have a good idea of what "normal" is to really identify the "abby-normal".  In this case you probably would be served well to seriously investigate your network traffic over a lengthy period of time, going machine by machine.

 

I don't mean to compare or sell, but I get xfinity unlimited internet for $25 (with gigabit internet at $100) and considering my family's usage and my own, I can easily download a few ISOs and movies and data in like 30g a day.  I just didn't want to worry about it.  I have kids - nuf said there.  Considering I get all of my entertainment via internet it's well worth it with zero worry.... overage worry is not worth it.  Internet is lifesblood to me.

Honestly, I had passing thoughts of upgrading to unlimited, but I would have to lease a modem from them, and I really do not want to spend the extra to do so, I understand that without a baseline of what is "normal" it will be hard to say that this usage is not normal, but I was basing my statement off of the fact that August and September usage was at half of what October was.

On the tablets, mine is a Kindle Fire, and I only use it to read books that are stored on the device. My niece does digital art on hers, but everything is offline, there is an option for cloud storage, but she does not use it. She uses her cellphone for listening to Spottily or YouTube for music. She has a Nintendo Switch as well, I am not really sure how much data it uses, except for downloading/installing new games which she has not done lately.

My BIL has the other desktop and he downloaded 27GB of music off of YouTube and/or other sources for a DJ that he does work for, he also said he might have downloaded a few mods for some of the games he plays, but nothing huge, otherwise he plays offline games and watches YouTube. Like I said, I was in the hospital for a week starting the 29th of October, and then 2 weeks later I ended up back in the hospital, and during the times that I was home, I was not doing much of anything except I did a fresh install of the OS, but purposely waited to do any major reinstalling of my games since most of them are on other drives. 

On 19/11/2021 at 18:27, adrynalyne said:

Its easy to use that much data with YT.

 

I have a home of three, and I am seeing over 1TB in a three week period. I'd say almost none is 4K.

OK, can you give me an idea of how much time per day your household is online?

[adrynalyne]

On 19/11/2021 at 17:35, jnelsoninjax said:

Honestly, I had passing thoughts of upgrading to unlimited, but I would have to lease a modem from them, and I really do not want to spend the extra to do so, I understand that without a baseline of what is "normal" it will be hard to say that this usage is not normal, but I was basing my statement off of the fact that August and September usage was at half of what October was.

On the tablets, mine is a Kindle Fire, and I only use it to read books that are stored on the device. My niece does digital art on hers, but everything is offline, there is an option for cloud storage, but she does not use it. She uses her cellphone for listening to Spottily or YouTube for music. She has a Nintendo Switch as well, I am not really sure how much data it uses, except for downloading/installing new games which she has not done lately.

My BIL has the other desktop and he downloaded 27GB of music off of YouTube and/or other sources for a DJ that he does work for, he also said he might have downloaded a few mods for some of the games he plays, but nothing huge, otherwise he plays offline games and watches YouTube. Like I said, I was in the hospital for a week starting the 29th of October, and then 2 weeks later I ended up back in the hospital, and during the times that I was home, I was not doing much of anything except I did a fresh install of the OS, but purposely waited to do any major reinstalling of my games since most of them are on other drives. 

OK, can you give me an idea of how much time per day your household is online?

I work online 12-15 hours a day but am not on YT except at night. My daughter is in college and taking 16 credits in classes but plays games at night. My wife works quite a bit too. So we aren’t binging it 24/7 or anything. The thing with YT is that it’s not just a video stream. There are ads, data tracking and various other things happening in the background. I save quite a bit of data with a network ad blocker. Unlike browser ad blockers that still suck down that data but don’t render it, my machines are prevented from even pulling it down. I have YT and a few other things whitelisted. 
 

I am not saying your culprit is YT, but it doesn’t need to be running a 4K stream 24/7. 

[theefool]

I use to use Networx to monitor my bandwidth when comcast first introduced the 1TB limit:  https://www.softperfect.com/products/networx/.  You can install that on all your computers.

 

Not sure if you have smart phones or what not, but should be able to check usage there also.

 

Also may want to look at IOT devices, but hard to check them unless you have something built into your router.

 

Then I switched to ubiquiti and it shows overall usage per device plus much more.

 

 

[adrynalyne]

If you are certain the data usage is not legit, look for unauthorized users on your network.

[jnelsoninjax]

On 19/11/2021 at 22:24, theefool said:

I use to use Networx to monitor my bandwidth when comcast first introduced the 1TB limit:  https://www.softperfect.com/products/networx/.  You can install that on all your computers.

 

Not sure if you have smart phones or what not, but should be able to check usage there also.

 

Also may want to look at IOT devices, but hard to check them unless you have something built into your router.

 

Then I switched to ubiquiti and it shows overall usage per device plus much more.

IOT devices, would that be like the smart lights and Google home/Alexa devices? I will look into Networx, thanks for the suggestion.

On 19/11/2021 at 22:36, adrynalyne said:

If you are certain the data usage is not legit, look for unauthorized users on your network.

Our WiFi password is very strong, it would take a very long time to brute force it, and we check every few days to see what is connected to our network.

[theefool]

Yeah, IOT (keurig, nest, ring, etc) but, they typically use very little bandwidth.  But, everything adds up.

[theefool]

Here is a link for the past month, not current month from ubiquiti (13 devices):

 

 

 

[Mindovermaster Moderator]

I just thought of something. You might want to try this: https://www.glasswire.com/

 

Not for the malware and ad blocking end, but for usage per device per day/week/month/year/decade.

[theefool]

On 20/11/2021 at 00:15, Mindovermaster said:

I just thought of something. You might want to try this: https://www.glasswire.com/

 

 

I currently use this, mostly to track new processes accessing the internet.

[jnelsoninjax]

On 20/11/2021 at 00:15, Mindovermaster said:

I just thought of something. You might want to try this: https://www.glasswire.com/

 

Not for the malware and ad blocking end, but for usage per device per day/week/month/year/decade.

I have it on my system already, I guess I can add it to the others as well

[Mindovermaster Moderator]

On 20/11/2021 at 08:23, jnelsoninjax said:

I have it on my system already, I guess I can add it to the others as well

If you have Glasswire, show us the usage tab..

[+BudMan MVC]

On 19/11/2021 at 15:43, jnelsoninjax said:

state that they could not monitor our usage because we are using our own modem, not one leased from them

Not sure where you got that tidbit of  misinformation?  But its just not true, they can for sure monitor the amount of traffic you move.

 

Don't you have camera's - you sure they are not sending video to the mothership for you to view?

 

I would for sure put something at the edge to monitor, ie your router.. While something like the glasswire would be useful for device it can run on.. Do you have iot, pretty sure you have cameras - or was that someone else?

 

Or solution would be to put a cheap switch between your modem and your router that provides this info.. Atleast then you would amount of data moved, etc.. Here I run my wan connection through my switch, and can see total amount of data moved..

 

Now you would need to remember when to clear this counter that matches up with your billing cycle - but such a switch can be had for cheap.

 

 

So back to if they can monitor amount of traffic moved.. I own my own modem, as you can see the isp panel matches up pretty freaking close to what my router says for bandwidth moved through wan for the different months.

 

 

I could dig deeper and monitor specific IPs to find who is using the most bandwidth specifically, etc.  2 packages off top of head would be bandwidthd and darkstat, I currently do not have them enabled.  There is also ntopng, etc.  I would go back farther - but isp recently implemented the bandwidth limits.. I got pretty close that one month to my 2.5TB limit   That was a crazy month of me download stuff, wasn't normal usage for sure..

 

What you could do, again with something as simple smart switch that can do span port, capture that traffic going to and from internet, etc.  This might be difficult for wifi and such if your just using wifi via some soho router.. But also look into tools available on 3rd party firmware for your router to track this stuff..   Or update what your using for your router/wifi to something that provides this info.. My one son is using google wifi and do believe it supports this sort of info.

 

There are many ways to skin the cat for sure - and if all you had is pc/laptop something running on those would be fine.. But if you have IOT devices of any sort you really need to take those into account, etc.  for all you know one of your iot devices has been compromised and used in some bot army moving a bunch of traffic..

 

edit: wasn't it you - or was that someone else that their daughters laptop/pc was streaming something in the background?  Most of the services and I even believe YT is suppose to or can be set to stop streaming after X amount of time if not actually being used from what it can tell, etc.

[jnelsoninjax]

Yes, I have 4 PoE cameras, but they only broadcast locally (how can I check for sure?). As far as the statement of them not being able to monitor usage, that came directly from them when I called them the last time we had this issue, they told me that they could not monitor the usage unless it was a leased device. Now I know that is not the case, but I still think that something is not configured correctly on there end, because nothing has changed as far as how much we use the internet, and suddenly these last 2 months show double the amount of data used compared to the previous two months. 

Not sure exactly how to read this.

[Mindovermaster Moderator]

On 20/11/2021 at 15:44, jnelsoninjax said:

they told me that they could not monitor the usage unless it was a leased device.

That's BS. They can monitor from their station to your house, they don't need a modem to detect it.

 

On 20/11/2021 at 15:44, jnelsoninjax said:

 

 

What is that NT Kernel thing? That shouldn't be that high.. You know about this, BudMan?

[Gone]

Things you should check also: If you are using Windows, make sure that you aren't sharing your updates with anyone outside of your local network.

 

Check your wifi to see if someone has cracked your password and is torrenting or streaming without your permission.

On 19/11/2021 at 22:36, adrynalyne said:

If you are certain the data usage is not legit, look for unauthorized users on your network.

This.

 

Change your password on your Wifi and prior to doing that, conduct an nmap scan to discover unauthorized persons. Also look to see your DHCP leases. Note: If someone assigns their own IP info, I don't believe the router generally detect that if it is a consumer router.

[jnelsoninjax]

On 20/11/2021 at 19:18, SpeedyTheSnail said:

Things you should check also: If you are using Windows, make sure that you aren't sharing your updates with anyone outside of your local network.

 

Check your wifi to see if someone has cracked your password and is torrenting or streaming without your permission.

This.

 

Change your password on your Wifi and prior to doing that, conduct an nmap scan to discover unauthorized persons. Also look to see your DHCP leases. Note: If someone assigns their own IP info, I don't believe the router generally detect that if it is a consumer router.

No unauthorized people on the network, that is one of the first things we check, and we check frequently. The WiFi password is complex and would not be easy or quick to try to brute force. I checked the update settings, and it is set to local machines only.

[theefool]

click on this, should bring up more info, then send the info here.

 

 

For example:

 

 

Also, out of curiosity, change the day to month, wonder if that is still the highest on that page.

 

 

 

Edited November 21, 2021 by theefool

[+BudMan MVC]

Yeah I would be really curious to what that 45GB is.. Its to some IPv6 address, is that local? 

 

All of that data moved like 3am in the morning - am I reading that graph right?  That sure seems odd.. Backup maybe?

 

But 45GB a day would work out to 1.3TB in a month...  That would for sure put you over your limit..

 

Again as to them monitoring how much data you move - that sure and the hell would not be done on each modem, that would be done upstream somewhere their equipment, not at the actual modem..  Keep in mind as well to why they are full of ###### when they say that they can not monitor your "modem"  When a cable modem joins an ISP, the "firmware" loaded on the modem comes from the ISP..

 

https://arris.secure.force.com/consumers/articles/Drivers_and_Firmware/Upgrading-Firmware-on-Cable-Modems-Gateways/?l=en_US&fs=RelatedArticle

Question

Can I upgrade the firmware on cable modems & gateways?

Answer

The Cable Operators (MSOs) have complete control of what cable modem/gateway hardware they will allow installed and the firmware it uses, on their cable plant.  This means anything directly connected to the cable plant (COAX) in your house.  They do this to ensure that nothing happens to anyone upstream from your connections.  Cable Operators follow the DOCSIS Specifications that control this methodology of firmware upgrades as well as providing security for the firmware upgrades.  

Cable Operators also run both the products and firmware through their own test cycles to approve any manufacturers’ modems, wireless gateways, and the associated firmware updates for deployment.  This is not an ARRIS only implementation, but the required implementation of any cable device manufacturer.  After an MSO has tested and approved a new version of firmware for a cable device, they will then “push” that new firmware out to the devices. 

 

A cable modem you "buy" vs one you rent from them is no different to them.. Once it joins their network, its under their control.  Now if you put their gateway into modem mode, and run your own router behind that - they wouldn't have any control over your router, like they could if using their gateway which is a modem/router combo.  But they clearly still have insight into metrics from the device.  But again how much actual data you move would be done somewhere upstream in their network.  If they couldn't then your usage graph would be ZERO now wouldn't it   Maybe what they meant??  Was that if you were using their device in gateway mode they could look to see what device on your network was using the most data.

 

edit: btw your running torrents, and backblaze - both could be high users of data..

[jnelsoninjax]

OK, I made a few adjustments to backblaze, don't need to backup Dropbox, OneDrive, and MegaSync when they back themselves up. I clicked on NT Kernel & System and it does not show a breakdown other then to show 37 hosts, the biggest on being 2601:341:c200:c51:211:32ff:fe95:dd7e, which is not my IPV6 address, but I can not get any additional info as to what/who it is. Also the monthly breakdown shows the same numbers, I have not had Glasswire installed and running for more then a week, so it will not give an accurate picture of the monthly use, yet.

@BudManTorrent traffic only consists on ~500 Mbs, that was for one of the office programs  I believe. Should I change BackBlaze to weekly or monthly backups instead of daily? I reached out to Xfinity and inquired about unlimited, and they told me that it is an additional $30 month and does not require the use of their devices, so that would put the cost of service at $100 / month

[+Raze Subscriber²]

On 21/11/2021 at 08:50, jnelsoninjax said:

OK, I made a few adjustments to backblaze, don't need to backup Dropbox, OneDrive, and MegaSync when they back themselves up. I clicked on NT Kernel & System and it does not show a breakdown other then to show 37 hosts, the biggest on being 2601:341:c200:c51:211:32ff:fe95:dd7e, which is not my IPV6 address, but I can not get any additional info as to what/who it is. Also the monthly breakdown shows the same numbers, I have not had Glasswire installed and running for more then a week, so it will not give an accurate picture of the monthly use, yet.

Here's what I found regarding that IPv6 address, 2601:341:c200:c51:211:32ff:fe95:dd7e - Link