150Gb usage in 24 hours added - no explanation from Vodafone

Forums › One New Zealand (including Vodafone, WxC, Farmside) › 150Gb usage in 24 hours added - no explanation from Vodafone

1 | 2 | 3

62 posts

Master Geek

#1022486 9-Apr-2014 21:25

xpd: If you can, for a good chunk of a day, unplug your router, record the time it was unplugged - then when you plug it in again, check the usage meter, if its showing usage during the unplugged time, theres something going on with your line.

Great suggestion, I'll try that. I've always been a bit suspicious of their usage meter.

GoodSync

GoodSync. Easily back up and sync your files with GoodSync. Simple and secure file backup and synchronisation software will ensure that your files are never lost (affiliate link).

Rhinosaur

62 posts

Master Geek

#1022489 9-Apr-2014 21:30

freitasm: What router are you using, and does it have Firewall enabled? Perhaps it's not secure from the WAN side and being used for an amplification DDoS attack?

There's a pair of Motorola SB5101 modems supplied by Telstra, one for internet and one for T-Box, unchanged since Telstra installed them. And there's a LinkSys WRP400 supplied by Xnet (for the benefit of VoIP). I'm not too sure re the firewall to be honest. I have an IT buddy who's going to login to the router and have a poke around, I'll ask him to check that too.

Mantis;
No I haven't sold any routers on Trademe, but I had been thinking about selling a couple of old ones lately. It wouldn't even have occurred to me reset them first, thanks for mentioning it!

freitasm

BDFL - Memuneh
79060 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1022491 9-Apr-2014 21:31

Don't worry about the modems, think about the router.

One question: have you ever had a Vodafone xDSL service before? If yes, what have you done with the old modem?

NikT

1710 posts

Uber Geek

Trusted

#1022687 10-Apr-2014 10:58

Interesting that this is all downstream traffic, as it rules out the usual culprits like P2P left seeding in the background. I'd like to take a look at the results of the investigation, could you please send me a PM with your account number?

Sideface:
Rhinosaur: Thanks, I think our cable is 15mbps... .

I have never heard of 15 Mbps cable - sounds remarkably slow. I have heard of 30 Mbps, 50 Mbps, 100Mbps and 130 Mbps.
Please give details.

15Mbps was the 'standard' speed pre-DOCSIS 3.0 upgrade, and is still provisioned on entry-level plans. Cable speed tiers that have been available in my time with the company: 2Mbps, 5MBps, 10Mbps, 15Mbps, 25Mbps, 50Mbps, 100MBps, 130Mbps.

freitasm: Don't worry about the modems, think about the router.

One question: have you ever had a Vodafone xDSL service before? If yes, what have you done with the old modem?

Completely different systems at play here. Wouldn't be possible for an ex-iHug-Vodafone xDSL modem to affect an ex-TCL-Vodafone cable customer's usagemeter.

Product Manager @ PB Tech

Smartphones @ PB Tech | Headphones @ PB Tech

r2b2

571 posts

Ultimate Geek

#1022716 10-Apr-2014 11:45

Rhinosaur: Well the investigation came back saying that "the usage in question is valid".

Perhaps some of the angst would have been averted if the response to the investigation was a bit more descriptive as in "the usage in question looks valid from our side. it appears to be a large amount of downloads coming from funnycatvideos.com"

xpd

Geek @ Coastguard NZ
13704 posts

Uber Geek

Retired Mod

ID Verified

Trusted

Lifetime subscriber

#1022772 10-Apr-2014 12:26

r2b2:
Rhinosaur: Well the investigation came back saying that "the usage in question is valid".

Perhaps some of the angst would have been averted if the response to the investigation was a bit more descriptive as in "the usage in question looks valid from our side. it appears to be a large amount of downloads coming from funnycatvideos.com"

No ISP that Im aware of does logging at that level unless they have a particular reason to do so.

Can you imagine the size of the logs to log everyones browsing habits etc jsut so people can argue their data usage? (Then come into privacy etc etc)

Gavin / xpd / FastRaccoon / Geek of Coastguard New Zealand

LinkTree - kiwiblast.co.nz - Lego and more

Support Kiwi music! The People Black Smoke Trigger Like A Storm Devilskin

NZ GEEKS Discord______________________________

Rhinosaur

62 posts

Master Geek

#1022776 10-Apr-2014 12:28

freitasm:
One question: have you ever had a Vodafone xDSL service before? If yes, what have you done with the old modem?

I have another wireless router that was once used with Telstra broadband, but it's sitting in the technology coffin in the wardrobe.

Rhinosaur

62 posts

Master Geek

#1022783 10-Apr-2014 12:36

H Nik, I really appreciate the offer! I have PM'd you.

Sidestep

1013 posts

Uber Geek

Lifetime subscriber

#1022791 10-Apr-2014 12:40

Possibly a Kid infestation..
Chewed wiring & droppings on the floor is likely rats, same thing + massive data usage and you've got kids loose in the house.

r2b2

571 posts

Ultimate Geek

#1022801 10-Apr-2014 12:48

xpd:
r2b2:
Rhinosaur: Well the investigation came back saying that "the usage in question is valid".

Perhaps some of the angst would have been averted if the response to the investigation was a bit more descriptive as in "the usage in question looks valid from our side. it appears to be a large amount of downloads coming from funnycatvideos.com"

No ISP that Im aware of does logging at that level unless they have a particular reason to do so.

Can you imagine the size of the logs to log everyones browsing habits etc jsut so people can argue their data usage? (Then come into privacy etc etc)

So the question I'd have is what measures do they check to ensure that the usage is valid?

Demeter

709 posts

Ultimate Geek

Trusted

One NZ

#1022811 10-Apr-2014 13:00

r2b2:
xpd:
r2b2:
Rhinosaur: Well the investigation came back saying that "the usage in question is valid".

Perhaps some of the angst would have been averted if the response to the investigation was a bit more descriptive as in "the usage in question looks valid from our side. it appears to be a large amount of downloads coming from funnycatvideos.com"

No ISP that Im aware of does logging at that level unless they have a particular reason to do so.

Can you imagine the size of the logs to log everyones browsing habits etc jsut so people can argue their data usage? (Then come into privacy etc etc)

So the question I'd have is what measures do they check to ensure that the usage is valid?

XPD is correct - we can in rare cases retrieve more specific information, but only if the usage is very recent because the data cannot be logged for very long. Also only if the customer agrees to it. Normally for bandwidth disputes, we do a report from our Radius server to check if the traffic was initiated from your IP (instead of several different ones indicating a duplicate session on the network). We also check if the data was racked up over a period of several hours, or just one big blob (which could be an error). Not sure about the Cable side personally, and perhaps Nik might be able to correct me here if it is different.

Basically, if the usage came from your IP address and doesn't looks dodgy (ie. 1 massive chunk) then it's generally regarded as legitimate.

mclean

581 posts

Ultimate Geek

Subscriber

#1022813 10-Apr-2014 13:01

Last time this happened to me it was my wife's laptop trying to send an oversize email, something timing out, then sending again, etc. It took me two weeks to track it down and it moved a massive amount of data. Of course that was upload, not download.

Rhinosaur

62 posts

Master Geek

#1040792 9-May-2014 12:52

Just a quick follow up to let you know that Vodafone was able to trace the traffic to my modem's serial number, which confirms the traffic was 'valid'. They have also offered to reduce the overage fee which I am very grateful for. I'm still left with a huge overage bill, which stings, but I'm grateful they didn't leave me out in the cold completely.

I still don't know what the traffic was, but we've decided (without evidence) to blame it on an Apple TV glitch as that is the only internet-connected device that was left on during that time. Apparently it had a kids movie (previously purchased from iTunes) paused on screen during that time. Who knows, maybe it freaked out and tried to continuously re-download it or something. Anyway, time to move on!

Thanks for your help NikT.

Unfortunately I can't edit the thread title - sorry Vodafone ;)

Lias

5575 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#1040819 9-May-2014 13:29

xpd:
r2b2:
Rhinosaur: Well the investigation came back saying that "the usage in question is valid".

Perhaps some of the angst would have been averted if the response to the investigation was a bit more descriptive as in "the usage in question looks valid from our side. it appears to be a large amount of downloads coming from funnycatvideos.com"

No ISP that Im aware of does logging at that level unless they have a particular reason to do so.

Can you imagine the size of the logs to log everyones browsing habits etc jsut so people can argue their data usage? (Then come into privacy etc etc)

Paradise (one of the ISP's that became part of TelstraSaturn -> TelstraClear -> Vodafone) used to do exactly that. It was bloody brilliant, and my personal opinion is that any ISP not solely offering unlimited plans should provide that capability.

I'm a geek, a gamer, a dad, a Quic user, and an IT Professional. I have a full rack home lab, size 15 feet, an epic beard and Asperger's. I'm a bit of a Cypherpunk, who believes information wants to be free and the Net interprets censorship as damage and routes around it. If you use my Quic signup you can also use the code R570394EKGIZ8 for free setup.

xpd

Geek @ Coastguard NZ
13704 posts

Uber Geek

Retired Mod

ID Verified

Trusted

Lifetime subscriber

#1040873 9-May-2014 15:11

Seen how many connections a single webpage makes ? Now times that by the amount of pages you visit over a day/week/month.......... youre talking thousands (100's of 1000's more likely) of connections needing to be recorded.... then add the number of customers for the ISP....

Its an insane amount of I/O.

Paradise may have done it, because they didnt have a huge number of customers compared to ISPs of today, and the number of sites to browse etc were a lot more smaller....

Gavin / xpd / FastRaccoon / Geek of Coastguard New Zealand

LinkTree - kiwiblast.co.nz - Lego and more

Support Kiwi music! The People Black Smoke Trigger Like A Storm Devilskin

NZ GEEKS Discord______________________________

1 | 2 | 3