Crystal Web ADSL performance feedback thread Part 3...

[SauRoNZA]

Then I'm going to bet it's no hacking at all.

You don't maybe have the same DSTV Explora issue?

 

[AfricanTech]

The first thing I did was check the IS stats. Only my landline is listed.

Then you have to pin the culprit down the hard way. See above re stepping through one device at a time.

The only thing I can think of is a torrent client set to run without limits. Your router would normally load balance the amount of traffic going through which is why you wouldn't notice while the rest of you are on.

 

[Sinbad]

Get a router with accounting

 

[Bryn]

Then I'm going to bet it's no hacking at all.

You don't maybe have the same DSTV Explora issue?

I don't have that Explora addon that MickeyD does. I can see all wifi activity in my Ubiquiti UniFi interface. Of the TV stuff, only the Apple TV is using wifi, and a paltry amount at that due to a lack of recent use.

Then you have to pin the culprit down the hard way. See above re stepping through one device at a time.

Get a router with accounting

I get good usage indicators in my Ubiquiti UniFi interface though. Every device belonging to a family member or friend has been accurately named (eg. Taylor's phone, Mike's laptop, Apple TV etc.), so a new device with just a MAC address for a name will stand out immediately. Not to mention the data usage would make it stand out.

So far not a squeak since changing to a prepaid account.

 

[AfricanTech]

I don't have that Explora addon that MickeyD does. I can see all wifi activity in my Ubiquiti UniFi interface. Of the TV stuff, only the Apple TV is using wifi, and a paltry amount at that due to a lack of recent use.





I get good usage indicators in my Ubiquiti UniFi interface though. Every device belonging to a family member or friend has been accurately named (eg. Taylor's phone, Mike's laptop, Apple TV etc.), so a new device with just a MAC address for a name will stand out immediately. Not to mention the data usage would make it stand out.

So far not a squeak since changing to a prepaid account.

Ask CW to cancel your account and create a new one for you.

 

[Bryn]

Ask CW to cancel your account and create a new one for you.

I don't want to do anything that could jeopardise my ability to reclaim losses though. Getting rid of the problem account won't help unless a hacker is confirmed and I get a refund. For now I want to see if the suspicious behaviour resurfaces.

Up and running on a full replacement account for the month.

 

[AfricanTech]

I don't want to do anything that could jeopardise my ability to reclaim losses though. Getting rid of the problem account won't help unless a hacker is confirmed and I get a refund. For now I want to see if the suspicious behaviour resurfaces.

Up and running on a full replacement account for the month.

Are there any younger family members (15 - 22) with access?

 

[Sinbad]

Get a router with accounting. That way you can see exactly what traffic went where.

 

[Orihalcon]

Being DDOS'd maybe?

 

[Sinbad]

Being DDOS'd maybe?

Good possibility. That happened to me too.

 

[Bryn]

Oh my god. I can stream Twitch in source quality for the first time in months. I assume that means my issues were specific to CW then.

Are there any younger family members (15 - 22) with access?

Just one that age group. Uses a laptop that can't get faster than 20Mbps, and isn't a particularly data heavy user.

Get a router with accounting. That way you can see exactly what traffic went where.

What do you recommend? I have a pretty expensive Zyxel SBG3300-N. Not keen to buy another router tbh, especially when my current one can handle ADSL, VDSL and fibre.

Being DDOS'd maybe?

Wouldn't that result in me losing connectivity? I haven't noticed any degraded service at all throughout all this crap.

 

[AfricanTech]

Oh my god. I can stream Twitch in source quality for the first time in months. I assume that means my issues were specific to CW then.

Just one that age group. Uses a laptop that can't get faster than 20Mbps, and isn't a particularly data heavy user.

What do you recommend? I have a pretty expensive Zyxel SBG3300-N. Not keen to buy another router tbh, especially when my current one can handle ADSL, VDSL and fibre.

Wouldn't that result in me losing connectivity? I haven't noticed any degraded service at all throughout all this crap.

From what I can see, you should be able to see the mac address of every device that is connected to the router - have your cross referenced all of them?

You'll probably want to be spending some quality time during business hours with the CW folk to see if you can get to the bottom of the issue.

 

[wingnut771]

It probably is a ddos attack, and by changing isp's you're changing your IP. You could also leave your router off for 20 mins to get a new IP.

 

[Orihalcon]

A DDOS won't dc you. It will however eat your bandwidth. Your reporting software also won't catch it as it happens on route level.

You'll need a pFsense box running to monitor that.

I know this because I was, like a few other CW clients, DDOS'd a few months ago. Lost my cap in a single day. No other connection shown in their logs...nothing.

I also considered the hack option, but no.

Ask CW to pass the investigation up the tech chain to investigate a possible DDOS on your account.

 

[Bryn]

From what I can see, you should be able to see the mac address of every device that is connected to the router - have your cross referenced all of them?

You'll probably want to be spending some quality time during business hours with the CW folk to see if you can get to the bottom of the issue.

I did cross reference the MAC addresses. As expected, the only omissions from the UniFi interface were my PC, the other wired PC, the switch and the CCTV DVR. Sigh. This situation really sucks. Going to use a voucher system from now on perhaps. Nice and Orwellian.

 

[AfricanTech]

A DDOS won't dc you. It will however eat your bandwidth. Your reporting software also won't catch it as it happens on route level.

You'll need a pFsense box running to monitor that.

I know this because I was, like a few other CW clients, DDOS'd a few months ago. Lost my cap in a single day. No other connection shown in their logs...nothing.

I also considered the hack option, but no.

Ask CW to pass the investigation up the tech chain to investigate a possible DDOS on your account.

I did cross reference the MAC addresses. As expected, the only omissions from the UniFi interface were my PC, the other wired PC, the switch and the CCTV DVR. Sigh. This situation really sucks. Going to use a voucher system from now on perhaps. Nice and Orwellian.

The DDoS info above appears to fit your situation perfectly.

 

[AfricanTech]

A DDOS won't dc you. It will however eat your bandwidth. Your reporting software also won't catch it as it happens on route level.

You'll need a pFsense box running to monitor that.

I know this because I was, like a few other CW clients, DDOS'd a few months ago. Lost my cap in a single day. No other connection shown in their logs...nothing.

I also considered the hack option, but no.

Ask CW to pass the investigation up the tech chain to investigate a possible DDOS on your account.

Do you have any additional info that you can share on how this attack is executed?

If it's sole purpose it to consume individuals' bandwidth, then this seems like a pretty directed attack on the ISP

 

[Orihalcon]

Do you have any additional info that you can share on how this attack is executed?

If it's sole purpose it to consume individuals' bandwidth, then this seems like a pretty directed attack on the ISP

I think SinBad was also hit by this when it happened a few months back. It was against IS customers specifically at that time.

I don't think the sole purpose is to steal bandwidth. That is just a side effect of being on a capped account. I mean if you're on uncapped then it will just continue.

No idea why this would be happening to Bryn now though. His situation just sounds 1:1 identical to what happened to me.

No strange MAC addresses, no connections, no tracking in my logs on BOTH the router and PCs.

Just on the IS page I could see my connection having used a ton of data in a short span of time.

From what he's said I am 9/10 convinced this is a DDoS against him. Explains why when using another ISP account this does not happen.

Anyway. He should kick it up to CW tech support to check the account.

 

[Sinbad]

I think SinBad was also hit by this when it happened a few months back. It was against IS customers specifically at that time.

I don't think the sole purpose is to steal bandwidth. That is just a side effect of being on a capped account. I mean if you're on uncapped then it will just continue.

No idea why this would be happening to Bryn now though. His situation just sounds 1:1 identical to what happened to me.

No strange MAC addresses, no connections, no tracking in my logs on BOTH the router and PCs.

Just on the IS page I could see my connection having used a ton of data in a short span of time.

From what he's said I am 9/10 convinced this is a DDoS against him. Explains why when using another ISP account this does not happen.

Anyway. He should kick it up to CW tech support to check the account.

yeah I was getting 100mb/sec of large UDP packets to random ports on my IP.

 

[snail112]

I did cross reference the MAC addresses. As expected, the only omissions from the UniFi interface were my PC, the other wired PC, the switch and the CCTV DVR. Sigh. This situation really sucks. Going to use a voucher system from now on perhaps. Nice and Orwellian.

Bryn, try moving your cctv dvr to an offline router. They could be trying to access your cctv cameras to look what is going on in your house.

Just a thought.