Very high broadband Usage

Panrich

I was thinking of moving from Virgin to SIRO but my usage is mad and I don't know why.

We have a few Amazon echo devices (4), Philips Hue lights and Netflix/Amazon Prime etc but what gets me is the amount that the usage tracker says that we are uploading.

Have a look at this for the current period:

Downloaded:
314.77 GB
Uploaded:
1328.29 GB


And here are the past few months:

Billing period Downloaded Uploaded Total
07 Oct - 06 Nov 314.77 GB 1328.29 GB 1643.06 GB
07 Sep - 06 Oct 672.83 GB 964.67 GB 1637.50 GB
07 Aug - 06 Sep 1150.99 GB 1052.51 GB 2203.50 GB
07 Jul - 06 Aug 900.80 GB 992.60 GB 1893.40 GB
07 Jun - 06 Jul 805.56 GB 937.97 GB 1743.53 GB

Now I know that I have 2x sons using Xbox but one of them moved out in September.

I have a Mikrotik router and that doesn't seem to be showing any device uploading mad amounts of data.

Any ideas?

Panrich

I should also add that we have Sky Q TV but only in the living room. No Minis etc.

advertsfox

That's torrents being uploaded / seeding, all day. The only other thing to affect so much upload usage is HD/4K cameras like Nest or Echos - have you those? I have one Nest Outdoor (not 4K) and on average, it uploads near 100GB a month.

Panrich

advertsfox wrote: »

That's torrents being uploaded / seeding, all day. The only other thing to affect so much upload usage is HD/4K cameras like Nest or Echos - have you those?

I don't use any torrents.

TheWonderLlama

Porn. The answer is porn.
2 sons = lots of porn.

Panrich

TheWonderLlama wrote: »

Porn. The answer is porn.
2 sons = lots of porn.

I'd expect downloads to be high but it's the uploads that get me. I'm going to start switching off things like the echos and see what the culprit could be.

advertsfox

Panrich wrote: »

I don't use any torrents.

The sons was my guess, it sits idle and can upload all day every day on a computer without you noticing. Have you go Echo cameras as well? The speakers won't cause massive uploads, I have over 20 things on my network (speakers, streaming devices etc) and my 1 Nest camera is 95% of my upload usage.

GBX

Game streaming on the xbox ?

Panrich

GBX wrote: »

Game streaming on the xbox ?

I'm sure that a lot of that goes on.

Panrich

Neither of the two are tech savvy in any way and the lad that's left doesn't have a laptop/tablet. There's definitely no torrenting going on, whatever else might be.

My wife does work from home and dials in to customers a fair bit so that might be part of the answer.

pjdarcy

Could someone else be connecting to your router? Have you logged into your router to see what devices are connected to it?

Panrich

pjdarcy wrote: »

Could someone else be connecting to your router? Have you logged into your router to see what devices are connected to it?

That is something I have thought of. I am going to have a deep dive on this tonight and try to find some sort of network sniffing tool to help see what is going on

advertsfox

And you don't have cameras? Your upload amount is nearly identical some months which is an interesting pattern...

Bluefoam

Firstly, I'd change the password on your wifi router. I'd monitor usage... after 5 days I'd give the password to the son living in the house... after another 5 I'd give the password to the second son... That'll soon point to the source, or at least let you know that one of your neighbours has hijacked your wifi and is running a porn empire on your connection...

Panrich

advertsfox wrote: »

And you don't have cameras? Your upload amount is nearly identical some months which is an interesting pattern...

Good idea there. I have a Hikvision cctv but that uses analogue cameras. maybe leaving the app open on a phone would contribute to this.

Gazzmonkey

There is an attack going around at the moment which targets that particular brand of router

Mikrotik RouterOS Information Disclosure Activity

Probably not related to your issue though

oscarBravo

Panrich wrote: »

I have a Mikrotik router...

Panrich wrote: »

...try to find some sort of network sniffing tool to help see what is going on

The Mikrotik should have all the tools you need, including torch and a pcap-compatible packet sniffer.

Panrich

Thank you everyone for your advice. Well the main thing that I found was huge amounts of DNS traffic to/from the public IP and so I disabled all that. I'll keep an eye on usage from here and see whats happening.

Marlow

Panrich wrote: »

Thank you everyone for your advice. Well the main thing that I found was huge amounts of DNS traffic to/from the public IP and so I disabled all that. I'll keep an eye on usage from here and see whats happening.

If DNS caching/proxy on the Mikrotik box was turned on, then that would have caused it. It's a known vulnerability and your Mikrotik router would have been exploited as proxy that way.

/M

advertsfox

Panrich wrote: »

Thank you everyone for your advice. Well the main thing that I found was huge amounts of DNS traffic to/from the public IP and so I disabled all that. I'll keep an eye on usage from here and see whats happening.

Marlow wrote: »

If DNS caching/proxy on the Mikrotik box was turned on, then that would have caused it. It's a known vulnerability and your Mikrotik router would have been exploited as proxy that way.

/M

Congratulations your router was possible involved in a DDOS or Botnet attack did you make note of any IPs it was connecting to and track it?

Panrich

advertsfox wrote: »

Congratulations your router was possible involved in a DDOS or Botnet attack did you make note of any IPs it was connecting to and track it?

I did do an nslookup on a few of the IP addresses. Nothing remarkable. The one with the most traffic was for amazonaws.com

Panrich

My new billing period started on 7th November and I put in rules to block outside requests for port 53 on that evening. I checked usage the next morning and uploads were already at 44GB for one day.

Since then there has been virtually no further uploads and my usage for the current period as of midnight was:

Downloaded:
32.41 GB
Uploaded:
45.47 GB
Total usage in current billing period:
77.87 GB

It goes to show that it is important to keep an eye on usage and I'll certainly not neglect to check regularly from now on.