For my ADSL connection, I'm using the Orcon-provided NetComm NB-14. Single ethernet port, no wi-fi.

Out of curiosity, I decided to look up my current usage. Over the last couple of months, I've used about 50 GB. This is just within my 30 GB/month limit, so that's fine. The catch is that for all but a handful of those days, there hasn't been anything connected to the modem!

I'm in a long, drawn out, house move, so a couple of months ago I packed up all my computer stuff, and have just been directly plugging my laptop in to the modem on the odd few days I'm there. So there's been no wi-fi router, in fact not even anything with an ethernet port (besides the modem), running in the house. Being the lazy guy I am, I just left the modem turned on and plugged in to the phone jack with nothing connected to the ethernet port.

However, over those couple of months there's been about 40 GB of usage clocked up during days when there's been nothing plugged in to the modem. It's varied between 10 MB a day all the way up to 3.5 GB a day. There was a definite peak from the 10th of May until the end of May, where it was averaging a couple of gig a day. On a per-day basis, it's a very consistent download:upload ratio of somewhere between 4.7:1 and 5.0:1, averaging 4.82:1.

I've had a look through the web UI, and there's no port forwards or anything else set up. Also, I would expect a 1:1 ratio of downloads and uploads if someone had hacked my modem and set it to relay traffic. If it was bot-net-ized and pumping out spam I'd expect to see a lot more upload traffic than download traffic.

Has anyone seen anything like this? I've got the modem completely unplugged now as it was getting very close to blowing my data cap this month. From a forensics point of view, does anyone know how to pull the full firmware from the modem? It's currently running "NetComm_NZ(LEM_86)_A01_(21230_3112140)" according to the status page (matching the label on the bottom of the modem), so if I can get the full firmware off my modem and the original firmware I might be able to identify what's been done to it.