Hello All,

Ive been trying to find out where my internet usage is going.

I'm on the Orcon genius plan. Sometimes I upgrade to 60gb data, other times i drop back to 30gb data.

In the last few of days Ive been watching the usage meter, and it just doesnt feel right. Ive since started to investigate where the data is going so I can "stem the flow".

Each of the last two days has had ~1.7gb of total usage (inbound + outbound - zero rated data)
Nobody has been using the internet much the last two days. After asking around household members with the devices below offered up the following usage:

Day 1.
20 Minutes of Youtube usage.
40 Minutes of web browsing (stuff, nz herald, google. news | Adblock enabled to strip those flash ads)
30minutes of *cough* late night blue movie streaming | Adblock enabled to strip those flash ads.
30 Minutes of web browsing (stuff.co.nz, slashdot, geekzone, anandtech | Adblock enabled to strip those flash ads)
10 minutes of misc streaming video (stuff.co.nz & similar | Adblock enabled to strip those flash ads)
30 minutes of online gaming (Team Fortress 2)

Day 2.
10 Minutes of Youtube Usage
20 minutes of web browsing | Adblock enabled to strip those flash ads
20 minutes of web browsing | Adblock enabled to strip those flash ads
20 minutes of web browsing on ipad (so no flash ads)
40 minutes of streaming pandora radio high quality (5mb per song, about 10 songs)

If i do some very rough calculations (considering NONE of the streaming clips were HD, more like 480p, but TF2 uses quite a bit of data, I play on Orcons server so should be mostly zero rated)

Then maybe Day1 should have been about 600MB usage max, and Day 2 about 200MB usage max.

I've tried calling Orcon twice. Both time the customer service agent checked my router. Neither one could help me break down the usage anymore than whats on their website. The 2nd guy told me I had "11 ethernet devices". Which is total rubbish, the Orcon genius modem only has 3 ethernet ports available to use, and I'm only using one. Without a switch/hub.

I have one ethernet device:
1x Custom PC Tower Windows 7 Circa 2007 - Automatic Updates Turned Off

We do have a lot of wifi devices, broken down as follows:
1x HP Windows 7 Laptop Circa 2010 - Automatic Updates Turned OFF
1x Custom PC Tower Windows XP Circa 2004 - Automatic Updates Turned Off
1x ideos Android Gingerbread Phone Circa 2010
1x Samsung Galaxy Gingerbread phone Circa 2010
1x Samsung Galaxy Tab 2 7.0 inch Android 4 Circa 2012
1x iPad2 iOS 6.01 Circa 2011
1x iPhone 4 iOS 6.01 Circa 2010
1x iPhone 5 iOS 6.02 Circa 2012
1x Macbook Air 2012 OS X 10.8.1

For wireless security I have WPA PSK Encryption, Hidden SSID, & Mac Address Whitelist Filter.

The orcon customer service agents both insisted that hackers are working around the clock, and my WIFI network has been compromised, and advised that I should turn WIFI off.

As you can see with all the WiFi devices, turning wifi off is not really an option.

Also I don't believe there is anyone parked outside or next door mooching my wireless because:

1. The signal is quite weak, i cant even get a wifi signal 1 meter from the house, in the driveway. Theres almost no way someone on the street could use it.

2.It is a quiet cul de sac street (where the neighbourhood children play on the road is so quiet), fairly tight knit community where we would quickly notice an outsider hanging around.

3.Im the resident computer geek, and have visited all my immediate neighbours in recent times to look at odd things on their computers. Most are elderly and don't know the first things about wireless. (Maybe their hacker grandson has been staying over??)

I'm wondering if the usage meter is not reporting correctly. However Im not trying to "bring the pain" on Orcon. Really I just want to know where all the data is going so I can effectively manage (stop) it.

After getting no help from the Orcon customer phone support, I tried to escalate the case. This is difficult with Orcon. The service support agent tried repeatedly to not escalate the case saying "they wont be able to help you anymore than I have". Then told me the manager was quite busy and wouldn't be able to to talk to me in a timely manner. I told them I didn't mind, and they could call me back. I was told to expect a call back the next day. This never happened, and its been two days now.

I have been monitoring my devices closely the last couple of days, checking the computers network usage in the resource monitor/activity monitor. Seeing if any rouge applications/services are sending or receiving data.

I noticed a trickle of data from the print spooler service on the Ethernet cabled win7 machine. This seemed to just be lan traffic as part of the printer sharing. But Ive disabled the print spooler service in the meantime just in case. (Will re-enable it when i need to print)

Ive tried changing my pre-shared key as a precaution.

My next options would be to setup some kind of firewall that does monitoring of data. This sounds like it will tie up quite a lot of hardware, time, frustration, as linux & iptables etc are not something im expert in)

Or disable wireless devices until I can find one that makes a significant difference. But this is in an environment of usage and might be hard to spot a clear trend.

AND Turn off gmail syncing on the phones or switch them to 3g only for a while.

In the past Ive seen people who are with telecom can get them to breakdown what port/address is chewing through the data. Orcon cant/dont want to do this.

Any suggestions are welcome...

TL:DR?
~800MB estimated usage VS ~3.7GB actual usage over 2 days.
How do i track it down?