Issues with Data Usage

Jere,

Here is a repost of mine that may offer some insight to networking in general and some tools and procedures to get a handle on usage:

Networks, even residential networks are much more complex than most of us realize.

In the not so distant past routers and switches and "Networking" were pretty much limited to businesses and perhaps the more "geeky" subscriber.

A typical satellite users connection looked like this:

A single computer directly connected to the Modem. There is only one path that data can be used. There are no "cross roads" no chance of anything using data beyond those two devices.

Things however even at this level are more complex than meets the eye. That single computer by itself has 65,536 connection ports.

There are broadly speaking two things in play here:

Applications ... Those are PROGRAMS that we start .. we can see them running such as a web browser of an email client program.

A look at Windows Task Manager reveals:

Three running Applications:

An email client program, a web browser and an open file.

However a look at running Processes  shows something much more complex:

I currently have a whopping 102 Processes running in the background  unseen, unknown. Not all of these of course are going to be connected to the Internet at any given time. They "turn on", perform their function and turn off.

In our very simple "network" (single computer directly connected) we could install a program like GlassWire on that computer and it will show all data used by THAT computer and what programs and processes used that data:

Our simple Network now has two "measuring points":

Point A is going to be the point along the single "data path" that is monitored by GlassWire.

Point B is going to be the usage registered by the Modem as "traffic" to be charged against the user monthly data allowance.

The two values should pretty much coincide within reason.

It is possible to look at a usage meter that has yet to "refresh" or register the usage in the last few minutes.

It is possible for the ISP to have "compressed" data and a smaller amount is shown by the Modem as being charged against the allowance than indicated by GlassWire.

At this point the perimeters  are pretty straight forward:

Do the amounts measured at points A (computer) & B (Modem) match ?

If they do NOT and the Modem claims greater usage then I suggest the following process:

Take a screenshot of your remaining allowance (allow for data that has yet to be recorded)

Disconnect the LAN cable from the rear of the Modem and note the exact time.

Let a number of hours pass (overnight ?)

Reconnect the LAN cable and again note the time and the amount of remaining data. Again an allowance must be made for the usage meter to update itself. What we are looking for here is a major discrepancy.

In the event that A and B match then we have to conclude the all of the data used (and charged against the users allowance) was indeed used by the directly connected computer.

A careful look at GlassWire will reveal what program and what processes are using data.

There are many things that can be done to conserve data .. browser extensions that block ads and scripts among other things. Much easier to do once the source of usage has been identified.

As we look at the above example we can see plenty of opportunity for data use and this just by a single computer.

The problem is very few subscribers Networks look like the above.

This is more typical:

The above really multiplies the complexity. It offers multiple connection paths  and each of those by itself has the same complexity as the single computer shown in the example above.

We have to take a much closer look at the Router itself:

The router as a central point in the network has three potential data use avenues:

#1: Its firmware/hardware:

This would include automatic update checks, Remote Access accounts/vulnerabilities, WPS settings/vulnerabilities and "front end" username/password setup to name a few.

#2: Wired LAN connections and the types of devices connected as well as their settings. Specifically end users not understanding the differences between "hard off", "sleep" and "hibernate" as well as other system settings such as Wake On LAN, Wake On Ring and even extending to "scheduled tasks".

We need not even go into the details of forced updates and data "sharing" inherent to Win10 and being back ported to Win7/8/8.1

#3: We come to the most difficult to control ... Wireless activity (on each frequency dual/triple band routers)

We can start with what encryption level, if any, has been set up. We also need to consider the username and password that limits access to the routers front end so that unauthorized users can add themselves to the wireless users list. It needs to be changed from the default values.

We also have the multitude of settings of the many types of devices that can connect wirelessly be they computers, notebooks, tablets, cell phones or even thermostats.

It is often not apparent when all apps on all devices have had their update ability turned off. Very frequently an update will cause other settings to change to their default values.

Considering the number of "connection avenues" provided by a router it is mandatory that it be included in any troubleshooting steps ...

We have to understand the Router is at the center of the Network ...ALL OF THE CONNECTION PATHS  and ALL OF THE DATA USED have to pass through the Router therefore it I suggest a Router that allows the tracking of usage per device.

There are many brands and models available .. a user needs to research which one best serves the users needs.

I have a Asus RT-AC3100 that has traffic monitoring:

Main interface that has the routers options and displays among other things which devices are currently connected:

Which devices used how much data by IP and by date:

And a statistical analysis per device by the top consuming software or process:

One often overlooked area is usage by the Router itself in the form of its internal services:

I had enabled two of the above services and the router internally consumed nearly 1/2 GB within just several days.

Determining the cause of missing data or even excess use requires that a user have some degree of understanding their Network.