Topic 'Re: Suddenly gobbling up data' in forum 'Comcast HSI' - dslreports.com

Re: Suddenly gobbling up data

Thu, 08 Nov 2012 07:44:01 EDT

mahohmei posted : The problem seems to have been solved. I ran a full-disk scan with Microsoft Security Essentials on the one XP PC in the house, and it found six nasties.

I started the scan overnight, and the bandwidth hogging also came to a stop overnight. I'll keep monitoring it today and see if we keep racking up the GB...or if this is the end of it.

Re: Suddenly gobbling up data

Wed, 07 Nov 2012 23:24:38 EDT

NetFixer posted : When you check the usage meter on the Comcast web site, do you see more than one modem listed, and is the modem's MAC address the same as the MAC address shown on the Comcast web site?
--
We can never have enough of nature.
We need to witness our own limits transgressed, and some life pasturing freely where we never wander.

Re: Suddenly gobbling up data

Wed, 07 Nov 2012 22:37:39 EDT

mahohmei posted : Well, I fired up Wireshark, and there's no unusual activity between any of my LAN devices and the modem. I'm going to shut off the modem overnight and see if Comcast keeps counting up my usage...

Re: Suddenly gobbling up data

Wed, 07 Nov 2012 17:45:35 EDT

Tsume posted : I noticed this on my home network, and since I have a custom firmware on my router it was easy for me to track it down. The problem was an infection that replaced svchost.exe on a machine with one that was constantly accessing the internet. The machine in question had used 125GB of bandwidth from Nov 1 - Nov 5. Microsoft security essentials didn't pick up the infection. Malwarebytes did, but was unable to remove it. We ended up reloading Windows on the machine since that was easiest.

My suggestion would be to thoroughly scan your machines for infections. If you want to narrow it down, unplug all the computers and start by adding one to the network, monitoring the bandwidth usage, and keep doing that until you find the bad one. Something like DUmeter on each machine might work but it may not catch traffic generated by malicious services.
--
to whoever anonymously gave me premium membership... thanks!

Re: Suddenly gobbling up data

Wed, 07 Nov 2012 15:09:33 EDT

anon posted :

said by mahohmei:

I occasionally go to comcast.com and see how much bandwidth we've been using. We normally get nowhere near the limit, but I've been seeing something weird:

August: 35 GB
September: 37 GB
October: 229 GB
November so far: 148 GB, and it's been climbing by about 1 GB per hour, even when we're not home.

A "leak" of 1 GB per hour translates to a nonstop stream across our cable modem of roughly 2 mbps. Since our speed is 20/4, we'd hardly notice that with our daily use. We don't have any spyware-laden PCs, and the router doesn't show that anyone is mooching our connection via either wi-fi (we have WPA2/AES) or tapping the Cat 5e in the crawlspace. My wife streams one TV show per week, and I download numerous Revision3 and other tech shows to the TiVo Premiere, but those have not been a usage problem in the past.

Any thoughts on what could be causing this sudden surge or how I could track it down? The modem is a Motorola SB6120 connected to a Linksys E4200 router, on which I'm too chicken to install DD-WRT, due to it being a "work in progress". I'm going to turn my modem and router off and on tonight just in case that's it...

Also, Comcast's website says "Note:enforcement of the 250GB data consumption threshold is currently suspended"; I've heard rumors that's to change the system to make the cap 300 GB. Should I just write off the bandwidth monitor as unreliable while they're working on it?

Thanks!

I had this issue and it was roommate hooked up an old computer that had utorrent running sharing everything he ever downloaded... idiot.. although you'd probably be getting Cease and desist.

Re: Suddenly gobbling up data

Wed, 07 Nov 2012 14:19:30 EDT

noc007 posted : Have you tried to turn off or disconnect everything except the modem and see if your usage drops? Turn one device on at a time to see what's the bandwidth hog. That includes the WiFi as well; when turning it back on, don't connect anything to it.

Just because you don't have spyware and your PCs aren't glitching like Windows ME, doesn't mean that you don't have some sort of malware. Plenty of malware go unnoticed and run for a long time before they're discovered. Also, there may be an app that you've forgotten about that's hogging data; if you're running Windows, Task Manager will let you know the NIC interface utilization and may provide a hint on where to start looking.

Re: Suddenly gobbling up data

Wed, 07 Nov 2012 14:15:48 EDT

graysonf posted : OK. Just run snmpwalk on the modem's IP address. Coming up with the community string will probably be the gotcha unless it is the default of 'public' or it's documented somewhere.

Re: Suddenly gobbling up data

Wed, 07 Nov 2012 14:05:29 EDT

mahohmei posted : Our router is a Linksys E4200, which, according to the Googles, does _not_ support SNMP. The Motorola SB6120 cable modem, however, does support SNMP...unless Comcast has it disabled.

I run Ubuntu 12.04 on my desktop, so...no problem.

Re: Suddenly gobbling up data

Wed, 07 Nov 2012 14:01:42 EDT

graysonf posted : I have it running on an always on Linux box that sits on the LAN. It monitors the router which is also always on, as is the cable modem.

IOG is primarily aimed at *nix type systems, but it could be forced onto Windows. IOG is the easy part, the harder parts are that it needs perl, apache, and cron - things not typically found on Windows machines.

The first thing you should do is verify that your router can be monitored via SNMP.

On my Comcast connection, there is a constant amount of traffic on the WAN port, amounting to about 4MB of per hour.

Re: Suddenly gobbling up data

Wed, 07 Nov 2012 13:55:38 EDT

mahohmei posted : And you can do the whole thing from a single desktop PC on the LAN? Cool.

Sorry to be asking so many questions. I'm at work and will download this thing as soon as I get home. :-)

Re: Suddenly gobbling up data

Wed, 07 Nov 2012 13:54:35 EDT

graysonf posted : I have IOG monitoring the WAN interface on my router. That's all I am currently watching, but monitoring individual machines' ethernet adapters individually is also possible.

It uses SNMP to do this, so whatever you wish to monitor must have that capability.

Re: Suddenly gobbling up data

Wed, 07 Nov 2012 13:43:20 EDT

mahohmei posted : If it's running on a desktop on my LAN, can IOG monitor the amount of traffic passing through the WAN port on the router?

It's not really an option to install IOG on every device in the house, since the hog could be a smartphone, tablet, the TiVo, or the Wii.

Re: Suddenly gobbling up data

Wed, 07 Nov 2012 13:40:20 EDT

graysonf posted : You should run something yourself that tracks your bandwidth usage, preferably by monitoring your router's interfaces. There are probably quite a few things that can do this.

I use IOG because it does this very well, and that's all it does.

»www.dynw.com/iog/

Suddenly gobbling up data

Wed, 07 Nov 2012 12:55:35 EDT

mahohmei posted : I occasionally go to comcast.com and see how much bandwidth we've been using. We normally get nowhere near the limit, but I've been seeing something weird:

August: 35 GB
September: 37 GB
October: 229 GB
November so far: 148 GB, and it's been climbing by about 1 GB per hour, even when we're not home.

A "leak" of 1 GB per hour translates to a nonstop stream across our cable modem of roughly 2 mbps. Since our speed is 20/4, we'd hardly notice that with our daily use. We don't have any spyware-laden PCs, and the router doesn't show that anyone is mooching our connection via either wi-fi (we have WPA2/AES) or tapping the Cat 5e in the crawlspace. My wife streams one TV show per week, and I download numerous Revision3 and other tech shows to the TiVo Premiere, but those have not been a usage problem in the past.

Any thoughts on what could be causing this sudden surge or how I could track it down? The modem is a Motorola SB6120 connected to a Linksys E4200 router, on which I'm too chicken to install DD-WRT, due to it being a "work in progress". I'm going to turn my modem and router off and on tonight just in case that's it...

Also, Comcast's website says "Note:enforcement of the 250GB data consumption threshold is currently suspended"; I've heard rumors that's to change the system to make the cap 300 GB. Should I just write off the bandwidth monitor as unreliable while they're working on it?

Thanks!