ADSL data bandwidth upload leak

[Rocketscience]

Hi All

I'm having an extremely frustrating problem with my bandwidth being sucked up by something uploading data - 80Gb this month alone, vs 9Gb of download. I have searched this forum and done multiple google searches and tried various suggestions made for similar problems but with no joy.

My ISP - MTN Business - is less than helpful and claim they only authenticate and do not monitor the traffic so cannot tell me what is consuming the bandwidth or to which IP/site most traffic is going. They say that only Telkom can help with this, which I find odd. This is making me seriously consider alternative ISPs - any advice here is welcomed.

I have tried various software apps to try and trace and identify where this possible leak is coming from including placing Netlimiter on my one Windows PC on the network and Wireshark on the Mac. Given my lack of networking skills though I'm really struggling to analyse/understand what I am looking at.

What is the best way to track down what is causing this uploading across my small network? Any help or advice is most appreciated. I cannot afford to continue the costs of the data uploaded.

Some info on my set-up:
Eurobyte ADSL2 Modem
Cisco E4200 Wireless Router
One PC acting as a basic media server, running Windows 8 Consumer Preview
Various Macs running OSX Lion
I am not running any P2P or torrent apps

Thanks for any help.

 

[AfriMan]

Try downloading WireShark, and then you can monitor which IP addresses and MAC addresses are connecting to your network. Hope it helps

 

[The_Unbeliever]

You will need to put in a dedicated monitor between your router and the network.

Does the Eurobyte ADSL2 modem connect via PPPoE? Can it handle bridged mode?

If so, install Smoothwall on any old PC (this will be your dedicated firewall) and you can monitor bandwidth consumption this way.

Also worth a mention is IPCop (a fork of Smoothwall) - you also do get utilities with which to manage your bandwidth.

 

[The_Unbeliever]

How sure are you it's not a wifi leecher/hacker? Your wifi access point secure enough?

What happens if you disable it (if you can)?

 

[bekdik]

Change your ADSL password

 

[fred1]

@ rocketscience
How do you manage to have 0 posts?
You a ghost?

 

[Pada]

I'd try to monitor the traffic going through the routers with the use of SNMP protocol and like PRTG Network Monitor application: http://www.paessler.com/prtg/features

Once you see that you are indeed uploading lots of data via your routers to the Internet, you can try to narrow it down to a specific PC by simply unplugging the devices one by one.

Alternatively, install a router that would allow you to monitor the traffic - like a MikroTik RB750 where you can simply use the Torch function within WinBox to see how much data flows through the network interface.

WireShark can help you, but its going to show way too much information to make any sense of it.

 

[T-Man]

Firstly, have you changed/reset the passwords of your ADSL & Wireless? Maybe someone is using up your bandwidth.

I suppose MTN bussiness has some online tracker of sorts? Just take care that usage is often only updated on a new ADSL session so turn your ADSL off and on between every step as well.
Turn off all the devices and see that usage stops. Then turn the devices on one by one to see which device is causing the problem.
At least then you'll know where to look.

No equipment or fancy programs needed to start off with - just some common sense.

 

[Rocketscience]

Hi All

Thanks for all the replies.

I have changed passwords on the ADSL and am confident that my wifi is secure.

Following some of the advice, one of the suspects may be Outlook on the Mac which seems to be constantly sending out data at around 35kbps. Heck knows why and I can't seem to find anything online re this so for now Outlook will be run on a as needed basis

Am looking at the Smoothwall option as the modem does support bridge mode but a bit weary of this - not sure how to use the modem in this context (PPoE/Bridge mode is bit Greek to me)and the installation instructions does not help in this regard.

Thanks again for all the replies - much appreciated.

 

[Pada]

At 35kbps (kilobits per second) it won't come close to 90GB/month. At 35kB/s (kilobytes per second) it would come very close to 90GB/month (if the month has 31 days).

By default ADSL modems+routers establish the PPPoE connection themselves to the ISP.
When you place the ADSL modem in bridge mode, it only connects to the Telkom DLSAM, but not to the ISP. You then have to establish a PPPoE connection to your ISP from a server or another router/machine if you want to have Internet connectivity.

In essence bridge mode connects (bridges) the LAN port and the ADSL port, allowing devices on its LAN connection to establish PPPoE connections via the ADSL port. There are many ADSL modems that does not support bridge mode - like a lot of the Netgear ones.