Need a Mac expert

  • 1
  • Problem
  • Updated 2 years ago
Two days ago (the first day of our first full billing period), 4.7GB of data disappeared. When I wrote to exede to question the use, they replied that "the data was almost 100% due to iTunes store." They also gave us 4 GB of additional data. OK, so Hubby did an iTunes update during our free period 12am to 5am. He searched his files for anything at all that was updated that date, and found only the 116 MB update that he installed during free hours. NOTHING ELSE for that date. Additional info:
* My computer was not connected to exede during the time in question, and I do not have iTunes installed.
* Hub does not open the iTunes store, as he has only EVER done one download from it.
* His *entire* iTunes catalog (mostly from CDs we own, which he has saved to his computer) is only 500 MB. It has not changed.
* Hub notices when large downloads are happening because it slows his browsing down, and he pays attention.
So, as you can see, it really is not possible that something happened to his computer and it does not show anywhere. We live out in the sticks. Here's a photo of our yard (below). You can't see any houses, not even any lights, and the closest neighbors cannot see our network, nor we theirs (nor can the network be seen from the nearest road, we have checked). We do not have any devices other than the two computers - no "smart" anything.

So, what happened, and how can we prevent this happening again? FYI, our usage before that day averaged 330 MB per day, right on our data budget. I have downloaded Flash Control and GlassWire for my Windows computer. We are looking at PeakHour3 for router traffic monitoring, but would prefer whole-system monitoring that is suitable for my Windows 7 machine. Any suggestions?
Photo of JenniB15

JenniB15

  • 29 Posts
  • 3 Reply Likes

Posted 2 years ago

  • 1
Photo of Andrew Cary

Andrew Cary

  • 9 Posts
  • 7 Reply Likes
Is your wifi coming off the Exede satellite modem/router directly or do you have a separate wifi router connected to the Exede router?

If the latter (which is most common), you should be able to logon to your private wifi router and measure  i/o directly for each internal IP address.  It is usually in the wifi router's administration area called "statistics" and will give the total input and output by each devices IP address. You can usually find which IP address belongs to what device by looking up the DHCP list in the same router. 

Looking at this sounds scary then it is. How you do this is a little different on each router, but there is usually a web interface at  an IP address like 192.168.0.1 (check your router's manual). These interfaces are pretty easy to use. 

If your local wifi router does not show the traffic you are concerned about, rattle Exede's cage with this additional information. (Hey Exede tech person, the I/O used by my network REALLY doesn't agree with what you are showing me...)

By the way so far as I know Exede does not capture the data metrics, but gets them from it's parent company ViaSat. The software tool they use is eSVT (https://myesvt.exede.net/eSVT )and you can use it too to check your utilization.  Your issue may have to bumped to them. 

I had a similar problem that turned out to be a Kindle tucked away in a pack, that connected and burned a couple of gigabytes updating itself and it's library automatically on entering a wifi signal. (Thanks amazon for being so helpful! A lot of devices assume wifi connections to the cloud are unlimited and free--)

As an aside and even as you are rural, make sure your network is password protected. I would go a step further and limit with devices can connect to your network by each device's MAC address.  This would prevent "data leeches" from sucking bandwidth.  
Photo of JenniB15

JenniB15

  • 29 Posts
  • 3 Reply Likes
All good advice, if not for me, then for someone who might also have the same questions that I do. Our exede modem does not contain a router, so I had to dig out an old router to get us by for the moment. So, here are some further questions:

* Since, as I said, we do not own any other devices that access the internet - no digital music devices, or Kindles, either - the only *possible* device that could have used the data was the MacBook Pro. If no files have been updated on the date in question except the one 116 MB update that was done at night, is there any other way to search for a possible large download?
* We are each logging data usage on our own device, since there are only two devices. BUT I understand that it is much more accurate if monitored through the router. My old router does not support traffic monitoring. Can you recommend a router that can be monitored from (and the info archived in) a Windows 7 computer? Hubby does not want to be the traffic cop for the household, so it is up to me.

Thanks for any help!
Photo of Gwalk900

Gwalk900, Champion

  • 451 Posts
  • 471 Reply Likes

." My old router does not support traffic monitoring. Can you recommend a router that can be monitored from (and the info archived in) a Windows 7 computer"


From one of my previous posts to you:


Read your Router manual and see if this feature can be added through a Router firmware update. If not and the source of data usage is important, the purchase a Router that has the features that give you the information that you need to manage and oversee your network.

The screenshot I posted above was a built-in utility within my Router.

It is an Asus RT-AC3100.

It is frankly a little pricey .. but .. there are other Asus models that are considerably less expensive and offer the same Traffic Analyzer function

Some of the models can even be found as Factory Refurbs with full factory warranty form places like newegg.com among others.

The statistics page readout looks like this:

  


Daily usage read-out per device looks like this:


Like I said, the Asus RT-AC3100 is a bit pricey but other models have that same Traffic Analyzer function. Currently $249 at Best Buy.

These are the list of Models that I know that do:


I'm sure that there are other brands out there available but this is the one that I have personal experience with.

Here are some RT-AC67U/1900 options from Newegg starting with a factory refurb at $104

https://www.newegg.com/Product/Product.aspx?Item=N82E16833320174








Photo of Gwalk900

Gwalk900, Champion

  • 451 Posts
  • 471 Reply Likes

JenniB15,

I would suggest that you view my last response in this topic:

https://community.exede.com/exede/topics/have-glasswire-now-what?topic-reply-list%5Bsettings%5D%5Bfi...

There is some information and several questions that are related to router setup and security.


Photo of GabeU

GabeU, Champion

  • 972 Posts
  • 599 Reply Likes
I'm not a Mac expert, but I can tell you that Macs have an app called "Activity Monitor."  Part of that app is a "Network" section, and this monitors the data being used by your Mac, and what's using it.  

https://support.apple.com/en-us/HT201464
 
(Edited)
Photo of JenniB15

JenniB15

  • 29 Posts
  • 3 Reply Likes
Gabe and gwalk (Greg?), thank you SO MUCH for putting in the time and effort to answer questions for new users like me. I've read everything you linked to, and it's all very informative. I started this thread to try and see if there was any way that such a large data sucking app could lurk in Hubby's MacBook without him being able to see it, but now I have learned more than I ever thought I would need to.

So here's our approach:
1. Hub has been checking the activity monitor (too bad, not in time to save any data from the day in question, as he had shut down the machine). He's watching like a hawk, and says it is totally impossible that his computer could do such a large download without him noticing.

2. I've installed glasswire, and I appreciate the tips on how to use it.from the other thread.

3. I looked at my router two days ago, with the intention of trying to update the firmware with one that has a better interface. However, the answer I got from the firmware site you had recommended was "not possible" (I guess this little old Belkin model does not talk SNMP). I looked that same day at ASUS routers on ebay, and the choices were dizzying. What you said above about the new interface makes sense, and I am looking hard at the refurb on Newegg you linked to.

I intend to use the router interface as the final word on how much data is going through our satellite, and only use the single-machine monitors to track down any culprit apps. Since they monitor ALL use no matter which ISP we're using, the totals are not so useful.

Luckily, we have another ISP we can use, when it is working and we don't need a high-speed connection, LOL. For now, we are only powering-up the dish to learn more about what it's going to take to control the data usage. Redundancy is good.

One last question: I understood from the original thread I commented on that, if I shut the router down, it would dump any data. Does the ASUS interface archive the data into the computer it's being monitored on? Or do we have to keep the router powered-up? We are off-grid, but Hub is a solar electrician, and can supply power to the router without running our inverter (which actually uses way more power than the router does). I assume that shutting down the modem/satellite dish is not an issue?
Photo of Gwalk900

Gwalk900, Champion

  • 451 Posts
  • 471 Reply Likes

Sadly the router dumps the data when power is removed.

I'll try to do some digging and see if there is a way to take snapshots. The thing is the data can be looked at from so many different perspectives in the router that it is a shame to lose that ability.

As to shutting down the Modem, there are internal logs but the biggest and most confusing aspect for users is that the Exede usage meter will be inaccurate until it once again gets in sync with the Gateway.

Many user have a hard time understanding that background processes (as well as known program) are nearly always having some level of connection, using some level of data that is "in motion" if you will and has yet to be reported to the Gateway and then the Gateway reports back and the usage meter is updated .... to that now past instant.

There is a lag. It (the usage) really should be minor unless a really intense type of activity is being engaged in (streaming in HD?) or some serious virus/malware activity is going on.

A couple of things;

I posted the link to the other thread because it brought up some questions (8 I think) that were related to  .... call it general Router knowledge and some critical areas of Router security ... some of them were loaded questions is that they probed a bit in some areas.

Another area too is .... wireless network printers. Not only are they easily overlooked as a potential "consumer" of data but the amount of data they can use can be tremendous depending on permissions and settings. Had a Hughes user recently who's Hubby would leave his laptop connected to sites that not only suck data but auto refresh.

She put time limits on Hubs computer and thought all was OK ... except data data still came up missing. Careful study of the router logs and device usage revealed that Hubs computer would disconnect from the network as limited by the settings both in the laptop and the router ... and then proceeded to look for another wireless connection. It found one ... due to a improper setting Hubs laptop connected to the printer (that was authorized to connect to the network) and used it as an access point.

Sometimes you just have to  .... dig .... until you find the culprit.


Photo of JenniB15

JenniB15

  • 29 Posts
  • 3 Reply Likes
Haha, my printer is connected to my computer with a hardwire. Hub's computer does not know how to find it. But good to know about that "backdoor!"

As I said, we can keep the router powered-up without too much trouble. And so far, our data usage is minimal enough (with the exception of that one big dump) that having the meter synced is not an issue.

I copied and pasted a lot of your router setup advice -- thanks very much for the detailed step-by-step! Once I get the new router, and do the basic setup, I will go through your recommendations and make sure I have not left any back doors open.
Photo of Jeff Buller

Jeff Buller

  • 23 Posts
  • 13 Reply Likes
So depending on your Mac's OS version this may be different. But mine is up to date with Mac OS Sierra v10.12.3. 
Open "System Preferences"
Click on "APP Store"
Make sure that your preferences are UNchecked:



You can set the TIME of day that the APP Store will automatically check for updates simply by opening the APP Store and pressing check for updates now. And then it will automatically check for updates regularly around the same time of day from then on. So Just get up really early sometime and open up the App Store and Check For Updates. Then you can choose when to download and install the updates. so that your data is being used when you choose it to be. 
Photo of JenniB15

JenniB15

  • 29 Posts
  • 3 Reply Likes
Yes, of course, that's the way to control when you do your updates. On our old Centurylink 1.2 Mbps connection, with "permanent bandwidth exhaust" (often runs at 0.05 to 0.5 Mbps), automatic updates were not even possible, LOL. Even updates selected to run at deliberate times would fail on the MacBoook, every time. Hub unchecked those boxes a long time ago. He checks manually for updates. He sometimes has to drive to town with his MacBook to do the updates. He examines his preferences at least once a week.

I was just wondering, if a person controls their updates, and knows how to use their "finder" to see what files are new to a specific day, is there any way a large download like that could be lurking in a place a normal person could not find it? They did give us 4 GB of data back, but I would love to find out where this data went, if that's possible.
Photo of Jeff Buller

Jeff Buller

  • 23 Posts
  • 13 Reply Likes
weird. 
I can't think of how you'd use 4GB of data on anything like that... if not an update. But there is an "activity monitor" if you want to check it out on the mac.
I can't think of anything else. 
Photo of JenniB15

JenniB15

  • 29 Posts
  • 3 Reply Likes
Thanks. We can't figure it out either. He did figure out the "activity monitor" within a day, but unfortunately he had done a restart, so the time period in question was gone.

New router is on the way, and I will be glad to have one capable of monitoring usage by device. Of course, monitoring is only as good as the person that is watching it...
Photo of Gwalk900

Gwalk900, Champion

  • 451 Posts
  • 471 Reply Likes

 "Of course, monitoring is only as good as the person that is watching it..."

Its a piece of cake really.

Define a period of time:

The above is for a two day period. It lists the total for each day along with the names of the devices that connected and the amount used by each individual device.


Next we can call up a statistical view for all devices showing the time that activity occurred and general categories and the later can be pulled up for each device:


You can also pull up the hours that each device was connected and some reasonable details of which application used the data:

It is much better than guessing, believe me.