Huge spike in data usage

Forums › 2degrees (including Slingshot, Orcon, Flip, Stuff Fibre, MyRepublic, 2talk and Vocus) › Huge spike in data usage

OldGeek

989 posts

Ultimate Geek
+1 received by user: 409

ID Verified

Lifetime subscriber

#197940 19-Jun-2016 12:36

I periodically check My Orcon, and it shows a huge spike in data usage since around midnight Saturday. Normally I use around 2 to 2.5 gigs per day, but in the last 12 hours or so 36.6 gigs data usage is shown. I have taken several actions:

- Power-cycled the Orcon black Genius router.

- Isolated the Sky On Demand connector (it is turned off).

This seems to have averted the problem in that data consumption has slowed down. I am on a 100gig plan and did have data alerts set (50 and 80 gigs) but both alerts came through overnight so I did not see them until this morning.

We certainly did not use Sky on demand during this period (and rarely use it at all). I don't think there was anything we did to provoke such data usage - given that we usually average around 2.2 gigs daily, the period of high consumption is too much in such a short time to be from a single device such as the only PC turned on and/or the Sky connector. My home network is secured WIFI. I looked at the DHCP list of devices and there was nothing strange there (so not likely to have been hacked though they might have been and gone).

If anyone at Orcon is lurking here I would appreciate anything that would explain this data consumption. I have no confidence that the Orcon help desk would be able to help - I have called but I wont tolerate being on hold for more than 5 minutes, so gave up on that.

1 | 2

13730 posts

Uber Geek
+1 received by user: 6202

ID Verified

Lifetime subscriber

#1576546 19-Jun-2016 12:57

have you confirmed that you dont have an update thats stuck in a download loop? or something like that?

scanned for malware and viruses?

what OS are you using?

OldGeek

989 posts

Ultimate Geek
+1 received by user: 409

ID Verified

Lifetime subscriber

#1576548 19-Jun-2016 13:10

All devices (except the Sky connector) were powered off overnight during the period that data was downloaded. I am using Windows 10 on 3 PCs, Windows 8.1 on the other.

michaelmurfy

meow
13579 posts

Uber Geek
+1 received by user: 10910

Moderator

ID Verified

Trusted

Lifetime subscriber

#1576558 19-Jun-2016 13:52

Why not just go to unlimited?

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.

OldGeek

989 posts

Ultimate Geek
+1 received by user: 409

ID Verified

Lifetime subscriber

#1576559 19-Jun-2016 13:59

Irrelevant to the thread - but seeing as I normally use around 60 gigs of data, the 100gig plan I am on is the least expensive. Why pay more for unlimited?

michaelmurfy

meow
13579 posts

Uber Geek
+1 received by user: 10910

Moderator

ID Verified

Trusted

Lifetime subscriber

#1576704 19-Jun-2016 19:18

OldGeek:

Irrelevant to the thread - but seeing as I normally use around 60 gigs of data, the 100gig plan I am on is the least expensive. Why pay more for unlimited?

Well why I say this is because you're more under the illusion that it is the least expensive and it would mean you're not wasting time with trying to figure out what used this data. Sure, it is a good idea to scan each computer for malware but Orcon's 100gb plan is $89/mo (ADSL). For $79/mo you could get unlimited ADSL with BigPipe or even cheaper again with Voyager.

There are many cheaper options out there. In todays day and age there is no reason to not be on an unlimited plan so yes, it is relevant to this thread. 100gb is also bugger all these days.

OldGeek

989 posts

Ultimate Geek
+1 received by user: 409

ID Verified

Lifetime subscriber

#1576734 19-Jun-2016 20:30

michaelmurfy:

OldGeek:

Irrelevant to the thread - but seeing as I normally use around 60 gigs of data, the 100gig plan I am on is the least expensive. Why pay more for unlimited?

Well why I say this is because you're more under the illusion that it is the least expensive and it would mean you're not wasting time with trying to figure out what used this data. Sure, it is a good idea to scan each computer for malware but Orcon's 100gb plan is $89/mo (ADSL). For $79/mo you could get unlimited ADSL with BigPipe or even cheaper again with Voyager.

There are many cheaper options out there. In todays day and age there is no reason to not be on an unlimited plan so yes, it is relevant to this thread. 100gb is also bugger all these days.

No disrespect intended - but I disagree.

I am using Orcon's Genius product with 'built-in' landline calling (Via an Orcon VOIP service) bundled with naked ADSL broadband. To change ISP therefore requires a change back to PSTN and Internet as separate entities to keep the landline. So changing from Orcon is extremely disruptive - heck according to some posters here simply moving address is disruptive. I must admit that when Orcon offered their Genius product I thought other ISPs would follow suit.

Given that I use 60MB of data, have been using a capped ADSL plan for over 10 years and monitoring data use is as easy as using a bookmarked web page, keeping up with data use is no problem. The problem I raised in my OP is very infrequent. I was simply hoping that someone from Orcon'sa second-level support might be able to provide some useful diagnostic info on data consumption.

When Fibre becomes an option I will seriously consider dropping my 'landline' and looking at unlimited plans - but that is years away where I live.

Apple TV

Stream your favourite shows now on Apple TV (affiliate link).

michaelmurfy

meow
13579 posts

Uber Geek
+1 received by user: 10910

Moderator

ID Verified

Trusted

Lifetime subscriber

#1576756 19-Jun-2016 20:56

OldGeek:

No disrespect intended - but I disagree.

I am using Orcon's Genius product with 'built-in' landline calling (Via an Orcon VOIP service) bundled with naked ADSL broadband. To change ISP therefore requires a change back to PSTN and Internet as separate entities to keep the landline. So changing from Orcon is extremely disruptive - heck according to some posters here simply moving address is disruptive. I must admit that when Orcon offered their Genius product I thought other ISPs would follow suit.

Not at all. Voyager have a VoIP product for the same price - if cheaper than your current service and that is VDSL + Unlimited bundled with "Naked" ADSL/VDSL and also with their own managed router. Porting over is simple and painless so you're not at all locked in to Orcon. To be honest I'd look at other options out there as there are many for cheaper, with unlimited data.

100gb is nothing these days. My parents with Netflix and basic internet + VoIP burn through 120gb+ per month and I know all their devices are free of malware. Your provider doesn't know what traffic caused the spike as they simply have data counters on your port. It could have well been an inbound DDOS attack for all we know which caused this to happen. Even though monitoring data use is easy it is still incredibly hard to cater for data spikes or work out what device caused the data spike unless if you have an enterprise grade router like the Edgerouter which does per-device counting. To many, unlimited internet is a godsend since it is one less thing to care about.

I've done moves from Orcon --> other providers before + VoIP so am well experienced here. As per your other part other providers have followed suit (Voyager being one, WXC being another if you want 2 basic examples).

ubergeeknz

3344 posts

Uber Geek
+1 received by user: 1041

Trusted

Vocus

#1576804 19-Jun-2016 22:38

You haven't by any chance disabled the firewall on the Genius router? As turning this off exposes the DNS Server which is often picked up and (ab)used for amplification attacks.

Otherwise I can't think of much we can do to help - save upgrading to unlimited. If it continues / happens again I'd refer to the thread on here about high usage, there are some good pointers in there.

OldGeek

989 posts

Ultimate Geek
+1 received by user: 409

ID Verified

Lifetime subscriber

#1576874 20-Jun-2016 08:56

I have checked the firewall setting on the router and it is on. I did have it off for a while and it may well be have been during the period data was consumed - I simply don't recall the timeframe. Thanks for your suggestion.

I was hoping someone from Orcon might be able to give some clues - ie was there a specific data source being used etc. or is the data consistent with known issues such as DNS amplification attack.

ubergeeknz

3344 posts

Uber Geek
+1 received by user: 1041

Trusted

Vocus

#1576938 20-Jun-2016 10:26

OldGeek:

I was hoping someone from Orcon might be able to give some clues - ie was there a specific data source being used etc. or is the data consistent with known issues such as DNS amplification attack.

We don't capture details on your usage ... so it's not really possible to say. But a sudden spike like that could well be due to you turning off the firewall, have seen it before many times, it does not take long for an open DNS relay to be found these days.

OldGeek

989 posts

Ultimate Geek
+1 received by user: 409

ID Verified

Lifetime subscriber

#1576994 20-Jun-2016 11:20

Perhaps a case could be made for putting warning text on router configuration pages for Firewall settings that this option should always be enabled?

Many thanks for responding.

Lenovo

Shop now for Lenovo laptops and other devices (affiliate link).

Nebbie

458 posts

Ultimate Geek
+1 received by user: 29

Trusted

#1578178 22-Jun-2016 11:03

OldGeek:

Perhaps a case could be made for putting warning text on router configuration pages for Firewall settings that this option should always be enabled?

Many thanks for responding.

Yes kinda agreed, I think everyone knows now that disabling firewalls and/or Antivirus scanners is a BAD thing, firewalls it could be seconds to get owned.

99% of the time unexpected data usage is a DDOS attacking, any data that traverses the PPP connection at Orcon's Termination point is counted, EVERY Ping even if the the firewall is on its counted as long as the router is on some data will be counted. Also DDOS attacks are common place these days but the good thing is most are "Rent A DDOS" and are small (I've personally experienced from 70mbit to 600mbit the largest) this is rather good as 10+gbit aren't nice.

Some people just seem to attract more DDOS's then others it all depends on what you do, for example playing games can sometimes irritate someone especially if your winning and they may DDOS you to flood the connection and as a result you lag and your session drops.

I would recommend you go unlimited you will never have to worry about these things you can spend more time doing what you like doing instead of worrying how much bandwidth you have used, the cost isn't that much more and speed these days is fantastic at any time for any type of traffic. But its up to you.

Capped Data plans are so 2005

---------------------------------------------------------------
Nebukadnessar

OldGeek

989 posts

Ultimate Geek
+1 received by user: 409

ID Verified

Lifetime subscriber

#1578676 22-Jun-2016 21:33

Nebbie:

OldGeek:

Perhaps a case could be made for putting warning text on router configuration pages for Firewall settings that this option should always be enabled?

Many thanks for responding.

Yes kinda agreed, I think everyone knows now that disabling firewalls and/or Antivirus scanners is a BAD thing, firewalls it could be seconds to get owned.

99% of the time unexpected data usage is a DDOS attacking, any data that traverses the PPP connection at Orcon's Termination point is counted, EVERY Ping even if the the firewall is on its counted as long as the router is on some data will be counted. Also DDOS attacks are common place these days but the good thing is most are "Rent A DDOS" and are small (I've personally experienced from 70mbit to 600mbit the largest) this is rather good as 10+gbit aren't nice.

Some people just seem to attract more DDOS's then others it all depends on what you do, for example playing games can sometimes irritate someone especially if your winning and they may DDOS you to flood the connection and as a result you lag and your session drops.

I would recommend you go unlimited you will never have to worry about these things you can spend more time doing what you like doing instead of worrying how much bandwidth you have used, the cost isn't that much more and speed these days is fantastic at any time for any type of traffic. But its up to you.

Capped Data plans are so 2005

I disabled the firewall in the (mistaken) belief that as I have firewalls running on every connected device, firewall at the router level was redundant and potentially contributing to access problems with some servers. This all turned out to be untrue and the cause of a problem, but the fundamental preposition seemed fair at the time.

Although I use a capped plan, the premise for this is because I don't need to pay more for uncapped (however small the difference may be). I noticed the excessive data use problem not because I monitor my data in fear of the data cap, but because performance of websites in particular was noticeably degraded. I went into My Orcon suspicious that continued poor performance might be caused by frequent reconnects and found what turned out to be an unexpected root cause.

Having said all this, I have been considering a change of ISP for some time. When I joined Orcon it was owned and run by founder Seeby Woodhouse. Since then it has morphed into an NZ subsidiary of an Australia-domiciled company (M2). Along the way it has lost the mojo that it had when owned and run by its founder, and instead it has acquired its various departments such as accounts, support and most significantly marketing and advertising departments along with a call centre with strange accents.

Looking around, as one of the early posters in this thread has observed, there are direct competitors for the Genius product and I will look at them all over the coming months.

Many thanks to all for your help.

clinty

1201 posts

Uber Geek
+1 received by user: 402

Lifetime subscriber

#1578678 22-Jun-2016 21:40

For the record Seeby is the MD of Voyager that is mentioned above

mclean

584 posts

Ultimate Geek
+1 received by user: 182

Subscriber

#1578844 23-Jun-2016 09:32

Going back to the original post: You're not trying to send an email that's too big and is stuck in an upload loop?

1 | 2