Network Data Usage

[jebt2921]

Being there’s some very knowledgeable people on this forum I’m hoping to get some advise or help.

Our home uses Cox for internet and tv. We currently have their 300 level internet service which allocates 1024 GB per month of data usage before they start charging for overage.

Our problem is over the last couple months there have been a few days (literally two or three) which data usage has gone through the roof. I’m talking 700+ GB in a single day.

I run all Araknis network equipment as follows:

Modem —> Router —> 8 port switch —> 24 port switch / 2 WAPs / Control4 IO extender

The 24 port switch then lights up all my walls (which my Hikvision NVR {9 cams} are connected to).

Net, everything goes through the 8 port Araknis switch.

- Looking at my router data usage I do see a tremendous amount of data (just over half of current month ~750 GB)
- Looking at 8 port switch, which everything essentially goes through, I see much less usage, maybe ~15 GB.

Could something be happening on the Cox side causing the large usage or could I have a piece of equipment which might be bad?

For 10 / 12 months our Cox usage shows around 500 GB which I’m fine with. But last month it showed 1700+ and this month is on pace to go over as well. That’s a TON of data with nothing crazy at our home which I can diagnose.

Any help or suggestions is greatly appreciated!




Sent from my iPhone using Tapatalk

 

[CCTVCam]

Compromised cameras working as servers / bots for DOS attacks?

Straight hack of your network by a neighbour using your wifi for torrents / streaming.

Rogue App / Virus.

Lots of possibilities. Check the IP connections - can be listed from Admin Console - I forget the command off the top or from Windows using several Apps. Secure your network and renew passwords. Port forwarding of cameras is one of the worst offenders and most likely to cause a compromised network. Use VPN for remote camera viewing.

 

[jebt2921]

I don’t have any ports forwarded and have OpenVPN running. And my WAPs are both connected directly to my switch so I see the usage through them. There is nothing connected out of the norm.


Sent from my iPhone using Tapatalk

 

[CCTVCam]

Try downloading the free version of Glasswire.

 

[jebt2921]

I’ve had that running but my home desktop is on WiFi downstairs and don’t see anything out of the norm. But being it’s WiFi maybe it’s not picking everything up.

I have fairly good visibility to everything on my network being wireless or wired via OVRC on my router and switches and there’s not a single thing out of the norm other than the usage on the router itself. The usage of the ports on the switch don’t add up to even a fraction of what the router shows and the switch is the only thing connect to it.


Sent from my iPhone using Tapatalk

 

[jebt2921]

And I do appreciate the advice and thoughts.


Sent from my iPhone using Tapatalk

 

[alastairstevenson]

I don’t have any ports forwarded and have OpenVPN running.

Does the router have UPnP enabled?
Are the 9 Hikvision cameras on NVR PoE ports or on the 24-port PoE switch?
Does the the 8 port Araknis switch have the facility to do port mirroring, such that traffic through the uplink to the router can be monitored / captured?

- Looking at 8 port switch, which everything essentially goes through, I see much less usage, maybe ~15 GB.

That suggests it's not any devices on your LAN that's pulling high traffic from the internet.
How does the TV access work?

Our problem is over the last couple months there have been a few days (literally two or three) which data usage has gone through the roof. I’m talking 700+ GB in a single day.

(Optimistic) Does the data usage indicate how much is inbound or outbound? How do you see the usage stats?
If not maybe ask Cox if large-scale inbound probes, which would be blocked by the modem / router, would contribute to the usage stats.
Does the modem / router (whichever has the firewall) have any logging for inbound access attempts?

 

[c hris527]

I know in my house when the Apple products are cloud syncing (especially after a Holiday or party) lots of hi rez pics, they will use a LOT of band width, especially if my family is over, they auto log on to my guest network, just a thought.

 

[SouthernYankee]

I had the same thing happen in August and September of this year happen with Comcast. Call up support, went up three levels and asked for a detailed list of the traffic to prove the overage. A number of other people were having the same problem. MY router showed one level of usage and Comcast showed a completely different usage level. I told then to fix there problem. Comcast reset my monthly usage to zero for those months and a number of other users had the same experience.

Where is your WIFI connection ? Is someone getting on your WIFI ?

I did find a problem with my ROKU, if left playing, it may continue to play after the TV is turned off. I have my crap ROKUs tied to a switchs, so that when the TV turns off the ROKU powers down, this is a PIA, because the ROKU need to boot when power is reapplied,

I use my own Modem and router, not Comcast provided devices. The Modem and router are separate devices. My modem can collect daily usage stats , not as detailed as I would like.

A suggestion if a separate modem put it on a clock timer switch, so it turns off at bed time and on a hour before you get up. Then look at your usage stats.

You may be under attack, if someone or some thing is hitting your router, even if it is not for you, it counts as your usage. Get a new external IP address, power down your modem of a few hours, see if the address changes.

 

[ctgoldwing]

I had a similar experience as Southern Yankee with Cox service. I started getting notices about approaching and passing our monthly 1tb limit. This was prior to our camera system here and nobody in the house was doing any video streaming. Typical monthly use prior to this was <100gb. I called support and they finally agreed that it was an impossible amount. I disconnected everything and they still claimed I was using about 100gb+/day.
After a help desk escalation they did 'something' that stopped it. They never told me what that was

 

[Jake1979]

Glasswire is good, what about Pi Hole? This helps me show all of my DNS requests.

 

[jebt2921]

I got nowhere talking with Cox level 2 support today. Prob yelled a bit too much

I did have an ah-ha moment as I remembered I had my DB2 doorbell set to record 24/7 with the rest of the cameras on the NVR. Not sure why I had it set to do that to begin with. My usage went down immediately by just changing it to record on motion only.

For glasswire, do I need my computer connected just anywhere on the network and does it have to be hardwired in?

To recap my setup: modem —> router —> switch which connect to everything in the home (another 24 port switch for all walls, 2 WAPs, some Control4 gear). So I should be able to see usage up and down from every single device by looking at the switch after the router.

Should I connect a computer to that switch to run glasswire?



Sent from my iPhone using Tapatalk

 

[K175un3]

Hello jebt2921, you could try something like Wireshark to check if anyone is stealing wifi.

 

[SouthernYankee]

The network monitoring tools are not very good for determining internet usage for a network provider. If some one is pounding your IP address with garbage and never getting passed the modem. It is still counted as your traffic.

If the network provider owned the modem, they may be able to provider some additional software.

I am lucky that I have two network providers in my area. So if the provider is being unresponsive, I tell them fix the problem or I cancel.

 

[zero-degrees]

Few things catch my eye in the string above.

1. First you cite you are using openVPN. Who is using that connection? I have seen where people will connect to a VPN and "forget". They then perform all types of activities - downloads, windows updates, video streaming, etc, and are totally oblivious that they are still on a VPN and routing all that traffic and activity though that connection. Don't get me wrong - 700GB is just crazy for 99% of people out there and I don't even believe an open VPN connection would drive that, but, it depends what and where that connection was left open.

2. Your DB2 Doorbell reference. This device is designed to to record locally via on board SD card, or to an NVR. With that said - this device is not designed to route traffic outside your network and back into your network to the NVR. It's not like this device is uploading to the cloud then downloading to your local NVR - so this device should NOT be the driver of your EXTERNAL CONNECTION usage unless it has been compromised. Also this device really only would transfer a max of 400GB a day around the network at the highest settings (3MP @ H.264 @ Highest Quality setting w/stupid high frame size 50kb recording at 30FPS for 24 hours would only generate 388GB of data and this is with crazy high settings)

3. What "usage" are we actually referring to as after reading though this string a few times I want to assure what's going on here.

1. Are you referring to usage being reported by Cox - like you received an email or message "Mr. Customer you are approaching your usage limit, etc"? OR are you simply looking at a report on your router that talks about "total traffic"? If you are simply looking at total traffic movement (External and internal) in your network that will always be higher than your provider bandwidth (external) usage. For example, if you move 200GB of files from one PC to another via wifi you will have 200GB pass though your router but NOT your external connection and Cox would not see or care about that.

I have noticed a lot of posts lately here that people are creating there own "problems" in there head when there isn't really a problem at all. Sometimes it's just paranoia and other times it's lack of understanding. I'm not saying either is occurring here, but, it is important to assure you know what your reports truly are showing and where that data is being driven from.

Also there are forums all over the internet full of this type of conversation - everything from boxes being updated, the memory leak errors in provider hardware etc is thrown around. There is also plenty of finger pointing between user and provider. At the end of the day, assure you are truely talking about external transfer (up/down) consumption from your modem back to the provider - assure this data is coming directly from one of there reports.