Inexplicable high usage, and how to track it

ChrisB

Active Member
Joined
Aug 6, 2003
Messages
99
Reaction score
3
Location
South Africa.
There has been some discussion on this but never anything definitive or particularly useful. Mainly, I need to monitor data usage on an ADSL line for a little old lady whose cap is being hit early in the month for no apparent reason.

The problem is the customer (Little Old Lady) uses less than 2 GB a month on her own, but when she has visitors from the UK it goes through the roof. Seems obvious, right, but in the current case the visitor has brought only an iPad, and *while it was closed* (and presumably in sleep mode - its owner was) the overnight usage of 3 GB used up the remainder of one month's cap plus one auto-purchased booster (1.5 GB) and half of the next one. Not so obvious any more. The only other device is LOL's laptop which is used for email and scrabble.

M-Web's copy-paste response letter tells you (after a two day delay during which you think you have lost them) about all the usual suspects: WiFi pirates, viruses, children, streaming video etc etc, none of which appear to be applicable here.

I have tried Untangle, a software gateway that you have to install on its own dedicated machine; it gives beautiful results, but only on the obvious ports (POP3, SMTP, HTTP/S, and maybe FTP). If for instance anyone is using torrents it won't show up, at least not in a way that I was able to find. I also read on one of these forums about Ucap, an open source project that apparently needs some special hardware (or at least a special version of firmware on a very narrow range of commercially available routers). Doesn't anyone know of some way that is simple to implement and inexpensive? I'm sure there are commercially available hardware sniffers at several "k" ront but in general, at the current cost of bandwidth there doesn't seem to be anything cost-effective - it seems to be a case of "shrug it off, what's the problem". Well, it is a problem when you are paying M-Web prices (yes, I know - move to a cheaper, better ISP. Easier said than done if you have an M-Web e-mail address and are over 70).
 
Untangles free version is virtually useless.
Rather try pFsense or Smoothwall.
 
Get a standalone "firewall" as above. Install applicable addons so that it can keep logs of IP/NAME/DATA usage.
2GB is really nothing. Little old ladies were complaining about using it up 8 years ago.
The iPad could have done updates to its apps or to it's OS automatically. I'm assuming windows updates are turned off?
 
pfSense + Squid (in Transparent Mode) + lightsquid + Bandwidthd = every possible report you could need.
 
Sophos also have a great free for home use firewall available now.
 
TP Link WDR3600 + gargoyle

Then setup quotas.
 
Sounds like the iPad or windows box did a firmware or system update in the background. Those can be large, especially if it fails/retries a few times..

Also check LoL's machine for viruses etc. She may be participating in a botnet for all we know (unknowingly).
Its fairly rare to find a non hosed windows machine in my long years of experience, especially in the LoL market segment - Bonzai Buddy - that looks interesting... etc

I like the TPLink + Gargoyle (or wrt) suggestion.

I used to setup my router to transparently proxy http, and log it. you can do that with wrt (dd/open), or variants like gargoyle. Usually interesting to see what traffic goes through stuff..
Its probably http traffic though.
 
How much is LoL paying for her capped mwebalicious data? Is moving to uncapped not an option?
 
Top
Sign up to the MyBroadband newsletter
X