Data Usage Puzzle

[killbill2]

We are on a 1500/256 + 25Gb plan. On checking our account online today I noticed you could check Current Data Usage by month or day and actually check usage per hour.

We have a wireless network at home with secure encryption and password entry. I noticed that, frequently, there purports to be hundreds of Mb of data activity between midnight and 3 or 4am when all the PC's are switched off. 3-400Mb is quite common, a large slice of which is often "peering".

Now, the children use Live Chat with their friends which I understand to be "peering" but I don't see how this could account for the level of activity - in any event the PC's are OFF.

Could someone who knows more about these things than me please offer an explanation. Is my network unsecure? Is People billing inaccurate?

PS: I phoned People tech support twice this morning. Both times after lengthy delays I was flipped through to what sounded like a call centre in Mumbai! Between a bad line and difficult to understand accents on both occasions I had no idea what they were saying; the whole experience was rather unsatisfying.

[PT_Albert]

Hello killbill2,

I can assure you the data usage meter is accurate.

One way to test this is to disable the wireless for several nights if you are using WEP you don't want to rely on this.
Occasionally you may get small amounts of data usage as there are requests destined for your computers that are off and this hits your ADSL modem.

Albert

[PT_Suzi]

Now, the children use Live Chat with their friends which I understand to be "peering" but I don't see how this could account for the level of activity - in any event the PC's are OFF.

Could someone who knows more about these things than me please offer an explanation. Is my network unsecure? Is People billing inaccurate?

Two things of note ..
The live chat your children are using, is fairly likely to NOT be peering.
Peering is a oft confused term now.
In the case of traffic accounting, peering refers to internet activity that goes from one computer to another via a very specific path. This path is via an internet connection that WE have with another ISP. (This will be local to state only, and only includes those providers that are part of the special peering network)

The peering you are thinking about is 'peer-to-peer' which means computer-to-computer, inferring a server is not required in the middle.

As for the traffic, if the PC's are off, and the wireless router is on - watch the router for blinking lights showing traffic. Do the same on the internet modem. Or if it's when you are asleep, simply poweroff the modem for the night and see if it stops, as albert mentioned.

The security on your wireless may or may not be sufficient. Any wireless security is arguably breakable if you are savvy enough, and have enough time.

If your wireless has been broken into, it's remotely possible an intruder coud have gotten your DSL password, and under the right conditions could log in elsewhere. Changing your password is a good way to 'fix' that.

Hope that helps.

[killbill2]

Albert

In your email to me today you state as follows:



All Pc's are thoroughly protected with a variety of anti-virus and anti-malware apps all kept up to date and scans run weekly. The bottom line is that data = my money. So, are you suggesting that the only way to prevent this overload after midnight is to switch the modem off because that sounds rather impractical to me.

I would have thought I'm not the first to raise this issue. I would have thought that 99.9% of modems are left on 24/7. Am I correct? Is this the case and if so how have other cases been resolved? You see my priority is that I pay good money for bandwidth and data capacity and I feel rather short-changed if a good part of the data usage is being virtually stolen while I'm asleep.

Both you and Suzi suggested I turn the modem off at night. Well that is impractical, if only because it is used for VOIP as well. If I were to test it for say a week, I would no doubt find that the usage in the early hours drops to zero, but that wouldn't tell me anything other than that the PT metering is inaccurate, despite your assurances.

I really would like to speak with someone in support rather than exchange here, but am not inclined to waste my time with a call centre somewhere overseas. Are you please able to send a private message and let me know how I can speak with an English speaking locally based technician. You would agree that the amount of data "leakage" I am referring to is not insignificant.

Many thanks.

[darren_cp]

In my experience, the usage meter is accurate. I would suggest that the usage is genuine, and there is likely a real reason for it. It could be that your wireless network is not as secure as it could be, or perhaps there are people within the household quietly responsible for the usage.

If you want to verify this, I'd suggest one or several of the following;
- Change modem filter settings to block all traffic but VOIP between midnight and 8am (you can typically include or exclude particular PC's)
- Turn off modem overnight as a test to see if this impacts on the usage
- Change your wireless key
- Change your ADSL network password
- Enable MAC based client security
- Log on to router each night and record download usage statistics. Log in again in morning and compare

If you need help with any of these suggestions, let me know what make and model router you are using, and I may be able to offer further advice.

You stated that "I would no doubt find that the usage in the early hours drops to zero, but that wouldn't tell me anything other than that the PT metering is inaccurate, despite your assurances". This make no sense. If the usage drops to zero, surely it proves that the usage meter is accurate, and that traffic from you modem is correctly responsible for the usage data.

If peer-to-peer software (used to download music, movies, etc) is left on overnight, this could easily account for the usage that you see. This type of traffic certainly does count towards your monthly download limit and shouldn't been confused with "free peering traffic".

The fault finding suggestions of Albert and especially Suzi are sound, and are certainly worth implementing or investigating.

[PT_Suzi]

Both you and Suzi suggested I turn the modem off at night. Well that is impractical, if only because it is used for VOIP as well. If I were to test it for say a week, I would no doubt find that the usage in the early hours drops to zero, but that wouldn't tell me anything other than that the PT metering is inaccurate, despite your assurances.

As darren_cp notes, turning off the modem WILL demonstrate where the problem lies. While your modem is on, there's the potential for traffic flow, whether it be sourced from your network, or caused by a packet storm of some sort destined for your network (your modem repying to incoming network activity, is 'traffic')

What is the VOIP you are using ? is it something similar to an engin box that sits connected to your modem perhaps ? many of these devices will software update over the network of their own accord, and this may account for downloads. Alternatively, if the VOIP is a peer-to-peer service, the peer services may be causing a lot of chatter.

I really would like to speak with someone in support rather than exchange here, but am not inclined to waste my time with a call centre somewhere overseas. Are you please able to send a private message and let me know how I can speak with an English speaking locally based technician. You would agree that the amount of data "leakage" I am referring to is not insignificant.

We can arrange this, but to debug this properly, the first thing you will be asked to do, is exactly what has have noted above. It's no different to if you called our water or electricity provider querying your usage.. the first thing they will do is ask you to turn off everything, and see if the meter is still ticking..

-suz

[killbill2]

Thanks for the replies all.

I apologise for my last post - I know you are all trying to assist. I'm just a bit frustrated that's all.

darren: Modem/router is Netgear DG834G v3 & VOIP Adapter is Netgear TG612V. I would appreciate some assistance in changing the modem settings as you suggest. Also, when I set up the home network I used the Netgear Wizard as I didn't find the process intuitive to do manually. I am not entirely sure of the difference between the ADSL network password and the wireless key. The security is WEP with an automatically generated WEP key.

Feel free to PM if you prefer to as opposed to posting here.

Suzi - VOIP box is as above. Our account is with MyNetFone.

Thanks all.

[Kayhe9]

Umm WEP is now fairly busted, can now be cracked in about 60 seconds, if possible upgrade to WPA. Hard if you have some devices on the network that do not support WPA.

Here's a link to a discussion of the problem http://www.grc.com/sn/SN-089.htm you can also load the podcast from the TWIT network.

[darren_cp]

Instructions for Netgear DG834G

Monitoring

Before you retire for the night, do the following;
- Login to your Netgear DG834G
- Click on "Router Status" on the left hand menu
- Click on the "Show Statistics" button
- Record the receiving packets (RxPkts) for the internet (WAN). It may also be interesting to record your wireless network (WLAN) packets as well.

Log into your modem again in the morning and compare the statistics. If you find that there have been mysterious increases in the WAN and WLAN packets during the night, then it is likely that there has been some wireless networking activity, either from inside or outside the household, that has taken place.

Checking for unwelcome clients

- Log into your Netgear router
- Click on "Attached Devices" on the right hand menu
- Check the list of clients for see if there are any that you cannot identify. There should be an entry on the list for each of your home PC, as well as one for the VOIP adapter. If you have a networked printer, it may also appear on the list.

Blocking Traffic other than VOIP during the night

- Log into your Netgear DG834G router
- Click on "Schedule" on the left hand menu
- Untick "All Day" and set the start time and end time of when you want the block to occur
- Click on "Firewall Rules" on the left hand menu
- Under "Outbound Services" click on "Add"
- Select the "Any(ALL)" service
- Under "Action", select "Block by schedule, otherwise allow"
- Under "LAN users" and "WAN users" select "Any"
- Click "Apply" to store this new rule
- Under "Outbound Services" click on "Add"
- Select the first of your VOIP services (likely UDP 5060 and 5061)
- Under "Action", select "Allow Always"
- Under "LAN users" and "WAN users" select "Any"
- Click "Apply" to store this new rule

All internet traffic other that VOIP should now hopefully be block for the times that you have specified in the schedule.

Changing Wireless from WEP to WPA security

- Log into your Netgear DG834G router
- Click on "Wireless Settings" on the left hand column menu
- Under "Wireless Network", change the name (SSID) to something new. Adding a "1" to the end of the name should do the job
- Under "Security Options", select "WPA-PSK (Wi-Fi Protected Access Pre-Shared Key)"
- Under "WPA-PSK Security Encryption", type in a security key. It has to be something over 8 character and should perhaps have a degree of complexity
- Click on the "Apply" button to store these changes.
- Go to each of your home wireless PC's, and have them look for wireless networks. They should detect the new SSID and WPA security. Enter your new security key and reconnect to the wireless network

If you wish to further strengthen your wireless security, you can also go into the "Wireless Station Access List" and configure the list with MAC ID's of known wireless devices on your network.

On a side note, if you suffer from poor call quality when using VOIP, especially when there is data traffic, you should considering getting a router with QoS (Quality of Service). Something like the Billion 7300G would do the job nicely, but there are of course other options.

Let me know how you get on !