Unexplained Data Usage

  • 4
  • Question
  • Updated 3 years ago
  • Answered
  • (Edited)
On December 31, 2016, we changed our internet service from WildBlue to Exede. In all the years we were with WildBlue, we only bumped up against our limit twice (this limit much lower than our new limit is with Exede). We chose a 10 GB plan with Exede believing that, given our previous use of the internet (no movie, video or music downloads), we'd never bump up against the 10 GB limit. But, we were wrong. In 19 days, we hit the 10 GB maximum and had our speed severely limited. On 1/27/17 (19th day), I purchased an additional 2 GB of data. In three days , that 2 GB was also used up. This morning, I purchased an additional 1 GB of data and in three hours, 0.1 GB of data had been used up in spite of the fact that Wi-Fi service is turned off on all our devices except for this laptop. We've watched no movies, no videos and have downloaded no music. Nor has anything been uploaded except for a few emails with no attachments. This can't possibly be accurate. Could there be a problem with our satellite itself? Our account is protected with a password so no one else can be accessing it (and no one lives close enough to access it anyway). We are mystified and need your help to find a solution to this anomaly. Thank you for your help. (We have also sent this question to Exede via email.)
Photo of Debra Ireland

Debra Ireland

  • 10 Posts
  • 0 Reply Likes

Posted 3 years ago

  • 4
Photo of Gwalk900

Gwalk900, Champion

  • 451 Posts
  • 471 Reply Likes


Just to keep the amount of typing down I'm to post a repost that applies to your data use issue. Be aware that while you have not made any changes many websites have lately, more auto-start videos and many now are going with "pre-fetching" of videos "just in case you wish to see them". For that you have to load a browser extenuation.

At this point I'd say watch what and when you allow devices on your wireless network and install the free version of Glaswire on the computer so as to see what is running in both programs and processes.

There are many background processes that use large amounts of data. There has been a change in the way the Microsoft presents updates across the board as "roll[-ups".

Many more websites now have auto start videos and now more are doing a "pre-fetch" on their clips. About all you can do is install ad-block, flash-block and now Flash Control to ease the per-fetch issue.

Then we get into routers and wireless security.

There have been three notable security issues reported by Cisco, Netgear and D-link that need to be patched by router firmware updates. It really is a jungle out there.

Additionally a security audit should be done to insure that certain things are done:

> Default username and password for the routers GUI is changed<

>All guest accounts are disabled<

> Remote Access is disabled<

>Wireless encryption at least to the WPA2-Personal standard in enabled on all available freque ncies<

> WPS is disabled<

> All internal cloud and sync functions are disabled<

>All internal "Services" be disable or reviewed for data cost/benefit<

For Windows computers I suggest that you install the free version of Glasswire so that you can more easily track usage of both programs and processes.


Suggested settings:

Output results:

It is important to remember that Glasswire will only track and report the usage on the single computer upon which it is installed. Multiple computers will require that Glasswire be installed on each machine and the data correlated.

Due to privacy issues your ISP is not going to track your data usage in anything more than a general way with out a court order.

If you choose to "Network" your connection the responsibility of administering and securing that Network falls on you, not your ISP.

Glasswire will truly help on the Windows computer within your Network but the wireless channels are a more difficult matter.

Do NOT overlook wireless printers. Depending on settings and permissions they can use massive amounts of data if allowed to update their software s uite. Some of the HP printer driver/software bundles can run into the 100's of MB's

There recently was a Hughesnet user who found that a misconfiguration of her printer was allowing her husbands laptop to access the Network using the printer as a wireless access point. This was during periods where is 'net access was curtailed due to excessive usage. His computer searched out available connections and connected automatically.

In other hardware related issues. Nvidia, one of the major graphic chip/card manufactures as constructed their latest video  card driver to collect and share "telemetry" with the company. This is said to be using large amounts of data.

Windows 10, in addition to "forced updates" in most cases also collects telemetry data and shares it with Microsoft. This behavior can also be found in Win7 and 8.1 depending on what Win Updates you have installed over the last several months.

I suggest that you check the capabilities of your present router to see if it allows the tracking of usage by device.

Every byte of data that you use HAS to go through your router so that is the most central point for you to monitor your usage as a counterpoint to usage claimed by your ISP.

If your router does not have this capacity I strongly urge you to get one that does.

As an example here are some screenshots of my Asus RT-AC3100 and its "Traffic Analyzer" function:

Usage by date and device:

By Statistics:

The 3100 may be a little pricey for some budgets but there are less expensive models that also have the Traffic Analyzer function so read the specs carefully to be sure you are getting a model with this important feature.

At times you can find factory refurbs with full warranty's available at considerable savings at places like newegg.com among others.

Photo of Danielle Brennan

Danielle Brennan

  • 95 Posts
  • 136 Reply Likes
Debra, there is most likely nothing wrong with your equipment. When you witched to Exede your speed increased to around 12 Mbps, much more than the speeds you had with the Wildblue Legacy plan, which was likely in the 500 Kbps to 1 Mbps range.  When you visit a website, the site will detect your speed and adjust the data being sent to your  computer, thus you get higher resolution images and text. You cannot compare the data usage that you used on the old plan with that you will ue on your higher speed Exede service.
Photo of Jim16


  • 2458 Posts
  • 2187 Reply Likes
Danielle's post needs to be read very carefully. People upgrading to a faster internet will need to alter their web browsing habits.  Faster speeds mean you will go through data faster.  I shake my head when I read about people using up their data before the end of their month and then upgrade to a little more data plan and also get the boost modem, doubling their internet speed.
Photo of Deku (The #1 Hero Data Saver)

Deku (The #1 Hero Data Saver)

  • 931 Posts
  • 505 Reply Likes
^ i to have to agree with jim16 on this one. also lets NOT forget that the modems do automatic updates onto the modem itself.
Photo of pearl


  • 8 Posts
  • 1 Reply Like
I had the same problem with data disappearing. On my first phone conversation, I was told it was because there were 98 devices using my router! I bought a new computer and router, changed passwords but still had the same data loss. On the 2nd phone call, I was told all of these devices listed as using my router (now close to 200) have nothing to do with my data loss! My router only shows the devices we use - none of the ones on the Exede list. The only way we can save our data is to unplug the modem when not in use.
Photo of Brad

Brad, Viasat Employee

  • 3563 Posts
  • 1340 Reply Likes
Have you done a virus scan/Malware scan?
Photo of Phyllis Jones

Phyllis Jones

  • 0 Posts
  • 2 Reply Likes
I would check for a virus. In changing my service from ATT to Excede I checked to see my monthly average usage so I could choose the right plan on excede. Five days later got an alert from ATT that I was over my plan with them. Changed to Excede and within a week had used half of my plan. Then my printer printed out a file that that stated all its series and ss# and then a Revision # and and a patch;
the same day 6 files appeared on my computer about wirerless router. The Excede Tech told me to check for a virus ----Never thought a Mac could get infected -well it didl
Photo of GabeU

GabeU, Champion

  • 2597 Posts
  • 1609 Reply Likes
Besides scanning for a virus and malware with your installed antivirus program, a good extra program that specifically targets malware is Malwarebytes.  It's free and does a very good job of rooting malware out of your system.  The free version is not automated, so you will need to initiate a scan manually.   Again, don't buy it, just use the free version, which works just fine.  You can get it here...

Photo of pearl


  • 8 Posts
  • 1 Reply Like
Thank you. I will try the malwarebytes. My frustration, confusion comes from the long list of devices Exede shows as being connected to my router and being told 2 different things. One person said they were the cause of my data loss. I bought a new computer and router because of this. Still had the same problem. The next person said they have nothing to do with it. Our router does't show these devices; just the ones we use.
Photo of GabeU

GabeU, Champion

  • 2587 Posts
  • 1607 Reply Likes
I highly doubt that you have upwards of 200 devices connected to your router.  If so...WOW.  To connect 200 devices to a single router is quite a feat!  I'm seriously impressed!  LOL.  :) 

With that little bit of humor out of the way, in addition to the Malwarebytes, the info in Gwalk's post above can be very helpful, especially the part about Glasswire and how it helps you to be able to see not only if your computer is using a lot of data that you don't know about, but also just what on that computer is using the data.  If it's a Windows based computer, I would definitely install Glasswire.  It's free, completely non intrusive, and doesn't use any data, other than the data it takes to download the installation file.

I'm also glad that you have made sure to set your router's password (believe me, quite a few people don't realize how important this is).  Also, chances are there is a way to view the connected devices from within your router's GUI.  That's the part of the router where you go in and change the settings and such.  Usually there's a place to view your connected devices, and you can make sure that those 200 devices aren't connected.  LOL.   
BTW, I'm not trying to make the second paragraph sound like a canned reply, as it's very similar to a reply I just gave to Larry in his thread, but excess data usage can often be figured out with a few simple steps.  Process of elimination and things like mentioned above. 
And also like I mentioned to Larry, I don't personally have Exede, but excess data usage is a VERY common theme with capped data ISPs, and with Exede's direct competition, too.  It most often happens when people come over from a non capped ISP to a capped one (I know that's not  your case), but it happens even when one's been with their ISP for a long time.  A little effort, even when it feels like you shouldn't have to give such or when you are sure it's not your system, might go far in discovering what is going on, and I hope that you successfully find what's causing it and are able to implement a solution.  
Good luck.  
Photo of pearl


  • 8 Posts
  • 1 Reply Like
GabeU, Thank you for your reply. Normally I would have enjoyed your humor but this problem has cost me several hundred dollars already. My router shows what devices are connected through WiFi (and it only shows ours.) A page on my Exede account show a long list of devices along with the date they were first 'used' and the most recent usage date. I was told by the Exede rep over the phone that they were the cause of our data loss and it was up to us to get rid of them. I am trying Glasswire and Malwarebytes (with my fingers crossed.) I live in a rural area and do not have close neighbours. The list on Exede shows our satellite, modem, router and the devices that use the router - most of which we have never owned nor do we allow anyone else use our WiFi.
Photo of GabeU

GabeU, Champion

  • 2587 Posts
  • 1607 Reply Likes
It's too bad that you ended up buyinga new computer and router when it really wasn't necessary.  I feel for you.  I had a problem with DirecTV nearly two years ago in which three service reps assured me that the problem was with my TV.  Nearly $400 and a new TV later, I find out that the problem was not my TV at all, but the problem was in their equipment.  I was hot, to say the least, as I had saved up the money over many months for something else.

Why they would be showing nearly 200 things that are connected, or had been connected, to your router is beyond me.  It's VERY odd.  Perhaps it is mistaking processes and programs on your computer that are connecting to the net for things connected to the router and it's assuming they are devices.  I don't know.  Something obviously isn't right.  
Photo of Old Labs (VS1-329-L12FZ)

Old Labs (VS1-329-L12FZ)

  • 4281 Posts
  • 4368 Reply Likes
It's been suggested in the past (without any official confirmation from ViaSat as always), that the eSVT tool is simply deriving device types from the user agent string that accompanies all http requests since any router should not be exposing the device types connecting behind it (think of the security ramifications - but there are some protocols that will do so if permitted - typically those protocols aren't available with consumer oriented routers). 

Different applications use different user agent strings - although some include device info not all do, nor is it really intended to accurately identify the device when included but rather application compatibility with a specific device; similarly most user user agent strings identify the browser (or application) and some will erroneously interpret that browser as being only used on a specific device when once again it's only an indication of browser/application compatibility not the actual - FWIW someone posted a screen capture a while back that had an asterisk noting that devices were "derived" supporting that theory.

Those who really want to verify their usage would do better to simply invest in  a router that can robustly analyze all traffic, although pricey they do offer some peace of mind and can be used to better make the case that the usage meter is wrong  - as noted by Gwalk, Asus routers are a good choice for Exede -  but I would recommend opting for one that specifically has the Traffic Analyzer feature listed under its specifications.       
Photo of GabeU

GabeU, Champion

  • 2587 Posts
  • 1607 Reply Likes
 since any router should not be exposing the device types connecting behind it (think of the security ramifications - but there are some protocols that will do so if permitted - typically those protocols aren't available with consumer oriented routers).  
That's what I was thinking, too.  I didn't quite understand how they would have access to someone's router.  I thought that, perhaps, they were going by what was accessing what, net wise, but even that would be a slippery slope, privacy wise.  

Thanks for clearing this up.  
Photo of Old Labs (VS1-329-L12FZ)

Old Labs (VS1-329-L12FZ)

  • 4281 Posts
  • 4368 Reply Likes
On occasion when pressed on remaining data, I use the User Agent Switcher add-on to specify that a Windows Phone, iPhone or Android user agent string be used for all browser requests. Effectively it makes my browser emulate one of those devices and well composed sites will serve up a lower data footprint for mobile devices - handy if wanting to save data.

Despite not hanging access to it, I suspect the eSVT tool would show I've used any number of devices not in my arsenal.
Photo of pearl


  • 8 Posts
  • 1 Reply Like
How odd. The long list of devices that had been shown as using our router has suddenly disappeared. They were still listed as being active as of yesterday -now the list is gone completely. Others might want to try myesvt.exede.net/eSVT/CPEpage.php?mac and see what they can find out. For those of us who aren't computer nerds the "Home Network" page shows a picture of a satellite dish (labeled outdoor unit) with a line to a black box (labeled modem) with a line to another box (router) with a symbol connecting to a list of 'Applications and O/S' with a column for 'first seen', 'last used' and even a column with a drawing to show if it is a desktop computer, tablet, or cell phone (including the brand name and model).
By the way, I run the virus check frequently and upgraded my ASUS router to a higher level. It also has Traffic Manager. Neither the old nor the new one showed any other devices then the ones we use. One computer on the list showed a browser I had never heard of before. With the cell phones, we use an older model of phone that doesn't connect to the internet. We live in a rural area. There are more cell phones on the list then we have neighbours!

Thank you to everyone who offer assistance to those of us seeking help. Please remember not all of us have a computer/digital background. The terms 'User Agent Switcher' or 'user agent string' may be elementary to you, but not to others. Often, those of us looking for help are the ones with the least computer/digital background. I will try to improve my computer/wifi lingo but in the meantime, please try to translate into English.
Thank you