Does ISP "download usage" data include spurious packets?

I am seeing ~ 500MB as the baseline daily download usage, which seems
very high.

I have now turned off all three wifi APs (they were WPA/PSK anyway) to
see if this changes, and all that leaves is two PCs, of which one is
on 24/7 (but has M$ updates disabled).

However, during some brief experiments which a Sonicwall TZ100 router,
which had a function for logging all packets on a given physical
interface, I was seeing quite a lot of incoming packets of random
nature, which the router would obviously drop.

Presumably I am paying for these too

In article <(E-Mail Removed)>,
Peter <occassionally-(E-Mail Removed)> wrote:
>I am seeing ~ 500MB as the baseline daily download usage, which seems
>very high.
>
>I have now turned off all three wifi APs (they were WPA/PSK anyway) to
>see if this changes, and all that leaves is two PCs, of which one is
>on 24/7 (but has M$ updates disabled).
>
>However, during some brief experiments which a Sonicwall TZ100 router,
>which had a function for logging all packets on a given physical
>interface, I was seeing quite a lot of incoming packets of random
>nature, which the router would obviously drop.
>
>Presumably I am paying for these too

Yes you are and most ISPs don't care.

So if you are a small business running some serviceis which you might be
perfectly entitled to do and someone decides to run some hacking software
to try to break in, then, even if you have a firewall and drop all their
packets, you still get billed for them because they've come through the
ISPs network and over the wires into your own router/firewall.

I've had several clients go over their monthly limits like this when
their VoIP PBX gets attacked by sipvicious. They've then had to pay more
to top-up their line or simply been cut-off for the rest of the month.

My experience with dealing with the ISPs when this happens has been poor
- I have been able to get them to put in a block at theit end on a few
occasions, but not all.

So if you want to **** someone off, then get an account on a hosted
server/cloud vpsm etc. and just keep sending data to an IP address and
you'll eventually get them cut-off if they have a capped account.

Gordon

On Fri, 28 Oct 2011 07:56:33 +0100, Peter
<occassionally-(E-Mail Removed)> wrote:

>I am seeing ~ 500MB as the baseline daily download usage, which seems
>very high.
>
>I have now turned off all three wifi APs (they were WPA/PSK anyway) to
>see if this changes, and all that leaves is two PCs, of which one is
>on 24/7 (but has M$ updates disabled).
>
>However, during some brief experiments which a Sonicwall TZ100 router,
>which had a function for logging all packets on a given physical
>interface, I was seeing quite a lot of incoming packets of random
>nature, which the router would obviously drop.
>
>Presumably I am paying for these too

Yes. But 500MB is a lot for this kind of usage. I only see about
100-200KB per day of this type of traffic.
--
(\__/) M.
(='.'=) Due to the amount of spam posted via googlegroups and
(")_(") their inaction to the problem. I am blocking some articles
posted from there. If you wish your postings to be seen by
everyone you will need use a different method of posting.

Mark <(E-Mail Removed)> wrote:

>On Fri, 28 Oct 2011 07:56:33 +0100, Peter
><occassionally-(E-Mail Removed)> wrote:
>
>>I am seeing ~ 500MB as the baseline daily download usage, which seems
>>very high.
>>
>>I have now turned off all three wifi APs (they were WPA/PSK anyway) to
>>see if this changes, and all that leaves is two PCs, of which one is
>>on 24/7 (but has M$ updates disabled).
>>
>>However, during some brief experiments which a Sonicwall TZ100 router,
>>which had a function for logging all packets on a given physical
>>interface, I was seeing quite a lot of incoming packets of random
>>nature, which the router would obviously drop.
>>
>>Presumably I am paying for these too
>
>Yes. But 500MB is a lot for this kind of usage. I only see about
>100-200KB per day of this type of traffic.

I have no obvious way to log the amount of data in kbytes. The router
shows a packet count, and I suppose one could assume a packet is up to
1500 bytes, but it be much smaller.

On Fri, 28 Oct 2011 16:03:11 +0100, Peter wrote:

> Mark <(E-Mail Removed)> wrote:
>
>>On Fri, 28 Oct 2011 07:56:33 +0100, Peter
>><occassionally-(E-Mail Removed)> wrote:
>>
>>>I am seeing ~ 500MB as the baseline daily download usage, which seems
>>>very high.
>>>
>>>I have now turned off all three wifi APs (they were WPA/PSK anyway) to
>>>see if this changes, and all that leaves is two PCs, of which one is on
>>>24/7 (but has M$ updates disabled).
>>>
>>>However, during some brief experiments which a Sonicwall TZ100 router,
>>>which had a function for logging all packets on a given physical
>>>interface, I was seeing quite a lot of incoming packets of random
>>>nature, which the router would obviously drop.
>>>
>>>Presumably I am paying for these too
>>
>>Yes. But 500MB is a lot for this kind of usage. I only see about
>>100-200KB per day of this type of traffic.
>
> I have no obvious way to log the amount of data in kbytes. The router
> shows a packet count, and I suppose one could assume a packet is up to
> 1500 bytes, but it be much smaller.

Does your router do SNMP ? My Netgear router's statistics page only
shows packet counts, but the built-in SNMP server shows the byte counts.

On Fri, 28 Oct 2011 16:03:11 +0100, Peter wrote:

> Mark <(E-Mail Removed)> wrote:
>
>>On Fri, 28 Oct 2011 07:56:33 +0100, Peter
>><occassionally-(E-Mail Removed)> wrote:
>>
>>>I am seeing ~ 500MB as the baseline daily download usage, which seems
>>>very high.
>>>
>>>I have now turned off all three wifi APs (they were WPA/PSK anyway) to
>>>see if this changes, and all that leaves is two PCs, of which one is on
>>>24/7 (but has M$ updates disabled).
>>>
>>>However, during some brief experiments which a Sonicwall TZ100 router,
>>>which had a function for logging all packets on a given physical
>>>interface, I was seeing quite a lot of incoming packets of random
>>>nature, which the router would obviously drop.
>>>
>>>Presumably I am paying for these too
>>
>>Yes. But 500MB is a lot for this kind of usage. I only see about
>>100-200KB per day of this type of traffic.
>
> I have no obvious way to log the amount of data in kbytes. The router
> shows a packet count, and I suppose one could assume a packet is up to
> 1500 bytes, but it be much smaller.

Does your router do SNMP ? My Netgear router's statistics page only
shows packet counts, but the built-in SNMP server shows the byte counts.

Andrew Benham <(E-Mail Removed)> wrote:

>Does your router do SNMP ? My Netgear router's statistics page only
>shows packet counts, but the built-in SNMP server shows the byte counts.

Probably, but I don't know how to set it up

I am changing from a Draytek 2900 to a Draytek 2955 and that might do
it.

Peter wrote:
> I am seeing ~ 500MB as the baseline daily download usage, which seems
> very high.
>
> I have now turned off all three wifi APs (they were WPA/PSK anyway) to
> see if this changes, and all that leaves is two PCs, of which one is
> on 24/7 (but has M$ updates disabled).
>
> However, during some brief experiments which a Sonicwall TZ100 router,
> which had a function for logging all packets on a given physical
> interface, I was seeing quite a lot of incoming packets of random
> nature, which the router would obviously drop.
>
> Presumably I am paying for these too

Oh yes. I had people ping flooding me and building up my traffic..until
I turned off ping responses..

Any hack attack, any DOS attack, costs you money.

as do regular email checks, NNTP updates, and various other software
packages phoning home reverse charge..

On Oct 28, 7:56*am, Peter <occassionally-confu...@nospam.co.uk> wrote:
> I am seeing ~ 500MB as the baseline daily download usage, which seems
> very high.
>
> I have now turned off all three wifi APs (they were WPA/PSK anyway) to
> see if this changes, and all that leaves is two PCs, of which one is
> on 24/7 (but has M$ updates disabled).
>
> However, during some brief experiments which a Sonicwall TZ100 router,
> which had a function for logging all packets on a given physical
> interface, I was seeing quite a lot of incoming packets of random
> nature, which the router would obviously drop.
>
> Presumably I am paying for these too

500MB is certainly a lot. Apart from one mystery event a couple of
months back when I got charged 1GB in one day for no obvious reason, I
currently only clock up a few kilobytes an hour when not actually
surfing (network of 3 computers running 24/7).

But I had what you describe a year ago -- started using several
hundred MB a day, rapidly using up my quota. I tracked it down to a
laptop on which I'd just installed Google Chrome, but that's probably
just a coincidence. The machine died before I located the problem.
Meantime I just had to disconnect from the internet when not actually
using it outside my ISP's overnight free time. I always disable
automatic updates from M$ and others which don't allow you to specify
when they can do it.

What does the Task Manager's Networking window show? I was able to
catch periods of intense activity even when I wasn't doing anything,
but nothing complained when I pulled the plug.

Are e-mails arriving OK? Someone reported once that their ISP had a
mailserver problem and Outlook clocked up a huge amount in repeated
requests.

Do you have any file-sharers installed? I found that BBC iPlayer file-
shares by default. ISTR someone saying that even removing some of the
similar utilities doesn't remove the file-sharer.

Sorry I can't offer any more concrete suggestions.

Chris

chrisj.doran%(E-Mail Removed) wrote:
> On Oct 28, 7:56 am, Peter <occassionally-confu...@nospam.co.uk> wrote:
>> I am seeing ~ 500MB as the baseline daily download usage, which seems
>> very high.
>>
>> I have now turned off all three wifi APs (they were WPA/PSK anyway) to
>> see if this changes, and all that leaves is two PCs, of which one is
>> on 24/7 (but has M$ updates disabled).
>>
>> However, during some brief experiments which a Sonicwall TZ100 router,
>> which had a function for logging all packets on a given physical
>> interface, I was seeing quite a lot of incoming packets of random
>> nature, which the router would obviously drop.
>>
>> Presumably I am paying for these too
>
> 500MB is certainly a lot. Apart from one mystery event a couple of
> months back when I got charged 1GB in one day for no obvious reason, I
> currently only clock up a few kilobytes an hour when not actually
> surfing (network of 3 computers running 24/7).
>
> But I had what you describe a year ago -- started using several
> hundred MB a day, rapidly using up my quota. I tracked it down to a
> laptop on which I'd just installed Google Chrome, but that's probably
> just a coincidence. The machine died before I located the problem.
> Meantime I just had to disconnect from the internet when not actually
> using it outside my ISP's overnight free time. I always disable
> automatic updates from M$ and others which don't allow you to specify
> when they can do it.

classic virus/malware......