Bad usage data

  • 1
  • Problem
  • Updated 1 year ago
  • In Progress
  • (Edited)
First day of new billing month 2 gigs per hour! It won't stop! FIX this problem!
Photo of James Irvin

James Irvin

  • 68 Posts
  • 16 Reply Likes

Posted 1 year ago

  • 1
Photo of Old Labs

Old Labs

  • 3702 Posts
  • 3722 Reply Likes
Unfortunately, most of the burden is on us as customers to determine what is consuming the data. An email to one of the moderators at exedelistens@viasat.com (including your account information and a description of the problem) will usually get you a overly generalized categorized breakdown of how the data is being consumed. It appears you may have done that the last two months. If so what were the results.

If you want peer-to-peer support from your fellow customers (the primary purpose of this forum since it's not a direct support vehicle), you'd need to supply us with some information about your setup (router brand/model, devices, operating systems, etc.)

In general, however, see:

https://community.exede.com/exede/topics/data-draining-with-no-connection

otherwise you're going to just sit there bleeding...

The large majority of responses from the moderators (ViaSat employees) will simply be to email exedelistens (just look at the official responses here) where it'll be handled privately  - they're not going to troubleshoot technical, administrative or billing problems in a public forum but might assist in gettiing you through to someone who can.
(Edited)
Photo of James Irvin

James Irvin

  • 68 Posts
  • 16 Reply Likes
Just re-plugged the modem back in after two hours being off and STILL used two more gigs. That's ten since midnite.
Photo of Old Labs

Old Labs

  • 3689 Posts
  • 3702 Reply Likes
Which is exactly why you should become more proactive in determining what's going on from your end - you have an opportunity to document and catch it in the act -read the link above, get back to us. Reticence isn't going to solve it...  
(Edited)
Photo of James Irvin

James Irvin

  • 68 Posts
  • 16 Reply Likes
Tried that. Got nowhere.
Photo of Gwalk900

Gwalk900, Champion

  • 451 Posts
  • 471 Reply Likes

"If you want peer-to-peer support from your fellow customers (the primary purpose of this forum since it's not a direct support vehicle), you'd need to supply us with some information about your setup (router brand/model, devices, operating systems, etc.)"


As Old Labs stated, if you want peer-to-peer help, describe your network.

Do you have the WiFi modem or do you have your own router connected?


"Just re-plugged the modem back in after two hours being off and STILL ....."

What did you have unplugged, the AC power to the modem or the Ethernet cable between modem and router?

 



Photo of Diana

Diana, Viasat Employee

  • 2215 Posts
  • 417 Reply Likes
Hi James,  Please send your account and contact information to exedelistens@viasat.com. We'll check it out.
Photo of James Irvin

James Irvin

  • 68 Posts
  • 16 Reply Likes
I did two months ago, Diana. You said, "something is definitely not right". Then someone else took over and said nothing was amiss and closed out the ticket.

Most of our "usage" shows as browsing which clearly is correct and clearly not using 2 gigs an hour the first few hours of a day 'til we hit 150 gigs and are 'throttled' for the rest of the month.

This is obviously a widespread problem. It's not us and it definitely isn't Windows nor a cloud service.

I will open another ticket with you. Thanks.
Photo of James Irvin

James Irvin

  • 68 Posts
  • 16 Reply Likes
12.7 gig at 10:30 am. That's 8.5 hours since the modem was unplugged for 2.
(Edited)
Photo of Matt B

Matt B, Viasat Employee

  • 788 Posts
  • 393 Reply Likes
James, I've received your email, and am investigating.  You'll get a response from me shortly.

-- Exede Matt B
Photo of James Irvin

James Irvin

  • 68 Posts
  • 16 Reply Likes
15.2 in 13 hours
Photo of Bob Hollinshead

Bob Hollinshead

  • 1 Post
  • 0 Reply Likes
keep us updated!
Photo of Bev

Bev, Champion

  • 3063 Posts
  • 1283 Reply Likes
Do you have any virtual assistant programs running, like Amazon assist, Alexa, a smart home device, something that keeps you updated on a site or service like UPS shipments or something? Something that runs a task or tasks that links to a website to get it's information and, does so in the morning?

It's odd that the unexplained usage is always during the same time frame each day, unless an automatic task is doing it.

Unplugging the modem really isn't a help since it doesn't update usage real time though usually does in 15 minutes or less, it can be up to 24 hours after the usage happens that it is reported.

Is it even remotely possible that someone in your family or outside of it could log on to your wifi without your permission? I know that's probably unlikely but, change your wifi password to one ONLY you know, do not give it to anyone, not even family for 48 hours, see if you still have a usage problem. Just clearing even remote possibilities.
Photo of James Irvin

James Irvin

  • 68 Posts
  • 16 Reply Likes
With the help of Matt, I've at least staunched the bleeding, somewhat.
Unfortunately, it required a complete reinstall of my homeserver and main computer.

As of this morning the usage is back where it should be- BUT I'll need to keep an eye on the "monitor" to see if this hold up.

Also unfortunately, I have NO idea what was causing the problem.
Photo of Old Labs

Old Labs

  • 3678 Posts
  • 3689 Reply Likes
Also unfortunately, I have NO idea what was causing the problem.
Unfortunately, neither do we but wouldn't you like to be more fortunate in the future?

As noted above, provide us with some information about your home network, devices and operating systems. Dependent on those variables, any number of subscribers can provide information on how to know what's causing "unexpected" data usage. Once one knows what is causing it, can usually be addressed short of reinstalling operating systems, but I suspect most of us already know at this point - a simple install of Malwarebytes may have stopped it - right Gwalk??  But adequate monitoring on your home server and  main computer would have identfied the real culprit.
(Edited)
Photo of James Irvin

James Irvin

  • 68 Posts
  • 16 Reply Likes
I had malabytes and many other tracking tools on both the server and the desktop.
I've been at this sat thing a long time. I used to install Starband.

They've come a long way.
Photo of Matt B

Matt B, Viasat Employee

  • 788 Posts
  • 393 Reply Likes
Hey James,

I'm glad we were able to track down the issue.  If there's anything else you need from us, just reply to that last email!

-- Exede Matt B
Photo of Bev

Bev, Champion

  • 3063 Posts
  • 1283 Reply Likes
You don't by chance have SQUL Server, then have change data capture enabled on that do you? That may be the culprit if it's sending the capture logs anywhere. That really should show as storage but SQL server can be a funny creature. 
Photo of Old Labs

Old Labs

  • 3678 Posts
  • 3689 Reply Likes
For whatever reason, James would prefer to remain reticent regarding his setup - let it go ;)
Photo of Bev

Bev, Champion

  • 3063 Posts
  • 1283 Reply Likes
Just asking, don't expect a yes or no but, might point him the right way anyway :)
Photo of Gwalk900

Gwalk900, Champion

  • 451 Posts
  • 471 Reply Likes

To me the answer is found in understanding the "shape" of your Network and monitoring all the connection paths therein.

There are a number of key points within a network, lets define them:

POINT A: The Exede Modem, Every bit and byte of data (other than command and control) will be counted against your data allowance.

POINT B: All of the traffic that travels along the Ethernet cable between each wired device and either the Modem LAN port (in the case of a single connected device) or one of the Routers LAN ports. It is important to note that there can be multiple Point B's

POINT C: The Routers internal Firmware and any internal "services" such as cloud based DNS and IP filtering can use massive amounts of data if enabled:

(Examples from my router)

Cloud based internal protection services:


Cloud based internal filtering services:

Routers can also use and lose data through auto firmware update/fail/fall-back loops as well as vulnerabilities related to remote account access.


POINT D:  Every wireless device on every available frequency. This is the hardest to track because in involves potentially a very large number of devices and includes things such as WPS vulnerabilities, router GUI security, wireless encryptions standards selected and number of other items.


POINT E: Point E would be that point that is central to all traffic that passes through the Network on its way to the Modem ... that is the Router itself IF it has the ability to track data by several criteria:

When: The ability to view data used by a defined period of time.

Whom: The ability to view how much data was used per device.

Where: The ability to see what programs, applications and processes used data.


If you have the above information you can direct your efforts towards the devices that have the greatest return in controlling data use.

If the Network is very simple .... a single Windows computer connected directly to a non-Wifi Modem the answer is simple .... monitor both ends of the single connection path that exists ... POINT A as the Exede measuring point and Point B as the single path Ethernet cable ... we can then install the free version of GlassWire on that single computer.

Our "Network" would look like this:

Exede "claims" their use on one end of the path: Point A

You can monitor your usage with GlassWire across the other end of the path Point B



GlassWire set to exclude "local" traffic:


Example of how to define a period of usage:


The problem with the above is that most of us have a much more complex Network ... looking more like this:


The above has many more "connection paths" and all need to be monitored if we are to KNOW where ALL of our data is going.

ISP's don't steal data. Data is consumed by devices ... software in the form of "programs" and "processes"  and by hardware by way of firmware.

There is just so many hidden things these days .... Nvidia graphics card drivers that collect data and "call home" are one thing that comes to mind. There are many others.

We have a much more complex network shown above, many more "connection paths". We can monitor each on the Point B's if we install GlassWire on each Windows based computers but that still leaves many paths unmonitored .... Network printers, overlooked Guest Networks .... so many things, so easy to miss one or more items.

Here is the central point of our Network, our Router in the case of us that have non-WiFi Modems:


We need to establish POINT E.

Everything that is going to run through the Modem also has to run past Point E, our Router.

If you have a problem with data usage, if you disagree with how much your ISP is charging against your allowance you have to have something more than suspicion, something more than "they are stealing!.

If your Router has the capacity to track data, use it.

See if data tracking can be added to your present router through a firmware update.

We have take a moment to look at the network view if those that have a Wifi router.

Rather than what we have in the above graphic, we have this:

There is only one way to establish a central POINT E if we have a WiFi Modem or a personal Router that lacks the ability to track data and that is:

Purchase a Router that has that capability and install it.

In the case of those with WiFi Modems simply disable the wireless "radios" and install a capable Router to the Modems LAN port and now all connection paths can be monitored.

Before you can fix the problem, you have to know where the problem is.

So lets look at a Router that does track data and how we can use it to zero in on When (the data was used overall) What device(s) used the data, When data usage occurred on an individual device and what applications on that device specifically used the data.

There are a number of Router brands that have the ability to track data. Carefully research your choices to make sure your choice will fill your needs.

I have an Asus RT-AC3100

The 3100 is a bit costly. It, as well as other Asus models that have the ability to track data out of the box can sometimes be found as "factory Refurbs" with full warranties from places such as Newegg.

Here is a list of Asus model numbers that have the Traffic Analyzer. That function can be enhanced by installing the Merlin firmware update:

    


Here are some screenshots showing the Traffic Analyzer function:


Traffic for a defined two day period. It shows traffic total per day as well as all devices that used data:


Next we have overall Statistics showing hours of operation in the upper blue graph and a pie chart below depicting use per device:


Next we can single out the hours of operation of a single device:


From there we can see what applications within that device used data:


You will find it much easier, much faster to find and control your usage after you KNOW when the data was used, which device used it and what programs/processes within the device were active.

The Asus 3100 was recently on Newegg as a factory refurb for $110.00

Other models as stated are less costly and can also be found as factory refurbs at considerable savings if cost is an issue.

If choosing an Asus be sure to consult the model list posted above to insure that it has the Traffic Analyzer function.

 

Photo of James Irvin

James Irvin

  • 68 Posts
  • 16 Reply Likes
I have the asus rt-ac68u router.
Great piece, btw.
Photo of Gwalk900

Gwalk900, Champion

  • 451 Posts
  • 471 Reply Likes

Have you installed the Merlin firmware?

It does enhance the stock traffic monitoring without loading "unstable" stuff.


Photo of James Irvin

James Irvin

  • 68 Posts
  • 16 Reply Likes
I have Merlin but it's not installed.
Photo of James Irvin

James Irvin

  • 68 Posts
  • 16 Reply Likes
For some reason internal wired traffic to my server (backups) is being counted as bandwidth usage).

Weird.
(Edited)
Photo of Jim16

Jim16

  • 2113 Posts
  • 1847 Reply Likes
So the bottom line is Exede wasn't the reason you were burning thru data.  It's so easy to blame everyone else.
Photo of Bev

Bev, Champion

  • 3063 Posts
  • 1283 Reply Likes
That is odd, going through the router shouldn't even touch the modem if no internet connection is requested? Can your server receive backups if the modem is unplugged? If not, something in the setup needs to be looked into.
Photo of James Irvin

James Irvin

  • 68 Posts
  • 16 Reply Likes
I've not reached the bottom line yet...
Photo of James Irvin

James Irvin

  • 68 Posts
  • 16 Reply Likes
The problem cropped up when I switched plans... could be coincidence, I suppose...

It's still using a LOT of bandwidth, just not as much...12 gig in 24 hours.
(Edited)
Photo of Jim16

Jim16

  • 2113 Posts
  • 1847 Reply Likes
Still trying to blame someone else. 
Photo of Old Labs

Old Labs

  • 3689 Posts
  • 3702 Reply Likes
Which modem? Surfbeam 2 or Exede WiFi modem? If Exede WiFi modem, how is the ASUS RT-AC68U configured? As a wireless router or an access point? If Exede WiFi modem, what's hardwired where and which is being used wirelessly? I doubt many get the Exede WiFi modem for it's hardwired capabilities and suppose that hasn't been thoroughly vetted just yet - I've always wondered why they call it Wifi modem rather than WiFi modem/router/voice adapter and generally only tout the WiFi aspect. So I'll never say never. What backup software is being used and how are the clients configured to use it? IP address, URL, Netbios name? Is your "server" accessible to the public? (shouldn't be and is actually against the terms of service but worth checking but and would lead to some interesting possibilities albeit remote an you'd really have to work at it to get it to work).

We're just playing 20 questions and it's usually not what you're telling us but what you aren't. The jury's still out...

As Gwalk has already noted and if simply the Surfbeam 2 modem, the merlin firmware will provide a much better overall picture...  
   
(Edited)
Photo of Gwalk900

Gwalk900, Champion

  • 451 Posts
  • 471 Reply Likes
Exede will not see LAN traffic.