Turned on Traffic Analysis and found the host, a Win 7 PC and seemed to be the XBox App.  Can that run as an App on Windows?

Windows 7 PC with internet access?! That's brave, since support was dropped back in Jan last year.

You can upgrade to Windows 10/11 with that same product key which activated your Windows 7, and Windows 10 is surprisingly good on older hardware, just upgrade any HDDs to SSDs and it'll fly.

Unsure about the xbox app. Never used it, but most likely.

Sounds like someones downloading a game/app on that PC, thats all. 

Yep, I tracked it down through the Traffic Analysis to be a PC of our tenants.  Looked like downloading a game onto a PC.  So I used the WAP to limit the bandwidth for the WLAN (SSID) they are on.  That did the trick for getting us bandwidth back.  However, I'll maybe need a better method of QoS or similar, so they aren't throttled when we aren't using the bandwidth.  Probably through the ERL, rather than via the WAP.  This is the first time with an issue in over a year though.

Interesting that the host using using the bandwidth was on their VLAN with a 192.168.3.x IP address, but as you can see from the ERL Dashboard screenshot, the usage wasn't showing against that VLAN's interface.  So I initially thought it was a host on 192.168.1.x

Tenant ? Sure you arent breaching any T&C's ? ;)

If youve got people using the connection you have no real control over, I'd be upping to a gig plan, and limiting them to 100. Then plenty of bandwidth for them, and plenty for you, problem solved :D

Yeah T&Cs and plan etc are all good. 

What I'm most interested about here, is given the host was in VLAN 20 (192.168.3.x), why the high bandwidth didn't show against the VLAN interface in the Dashboard?  In the screen shot in the OP, you can see it just showed against the eth0 and eth1 interfaces but not the eth1.20 interface. I thought any Edgerouter people might be able to shed some light on that.

Is the traffic actually coming over the vlan? That looks like it's coming as untagged traffic?

Lias:

 

Is the traffic actually coming over the vlan? That looks like it's coming as untagged traffic?

 

Everything on the guest SSID on the WAP is tagged as VLAN 20 and goes in 192.168.3.x.  That seems to be working OK, as the host in question had a 192.16.3.x address.  It showed up in the Traffic Analysis screen with that.  Also, when I set this up a year ago, I tested the firewall rules by connecting a laptop to the SSID and trying to ping 192.168.1.x.  That all worked OK.  

Probably because the traffic is showing on the base interface. The VLAN 10 and PPPoE interfaces are also showing no traffic, but presumably they are actually also sitting about 110/2.5 Mb/s

Re: Traffic not appearing on the expected VLAN, this happens on my Edgerouter as well. Download traffic on a VLAN (eth1.9) shows up as being sent to eth1. Upload traffic from said VLAN shows up as received on both eth1 and eth1.9:



Might be a bug? /shrug