Does ISP "download usage" data include spurious packets?

chrisj.doran%(E-Mail Removed) wrote

>On Oct 28, 7:56*am, Peter <occassionally-confu...@nospam.co.uk> wrote:
>> I am seeing ~ 500MB as the baseline daily download usage, which seems
>> very high.
>>
>> I have now turned off all three wifi APs (they were WPA/PSK anyway) to
>> see if this changes, and all that leaves is two PCs, of which one is
>> on 24/7 (but has M$ updates disabled).
>>
>> However, during some brief experiments which a Sonicwall TZ100 router,
>> which had a function for logging all packets on a given physical
>> interface, I was seeing quite a lot of incoming packets of random
>> nature, which the router would obviously drop.
>>
>> Presumably I am paying for these too
>
>500MB is certainly a lot. Apart from one mystery event a couple of
>months back when I got charged 1GB in one day for no obvious reason, I
>currently only clock up a few kilobytes an hour when not actually
>surfing (network of 3 computers running 24/7).
>
>But I had what you describe a year ago -- started using several
>hundred MB a day, rapidly using up my quota. I tracked it down to a
>laptop on which I'd just installed Google Chrome, but that's probably
>just a coincidence. The machine died before I located the problem.
>Meantime I just had to disconnect from the internet when not actually
>using it outside my ISP's overnight free time. I always disable
>automatic updates from M$ and others which don't allow you to specify
>when they can do it.
>
>What does the Task Manager's Networking window show? I was able to
>catch periods of intense activity even when I wasn't doing anything,
>but nothing complained when I pulled the plug.

I see nothing of significance there.

Looking at the router's Online Status page, I see the packet count
incrementing by say 1-3 packets per second, but at 1.5kbytes/packet
that comes to only about 1/3 of the 500MB/day+ I am seeing.

>Are e-mails arriving OK? Someone reported once that their ISP had a
>mailserver problem and Outlook clocked up a huge amount in repeated
>requests.

Yes; fine. After massive spam issues, we (that's me at home at at the
office) moved to Messagelabs who for £400/year provide an excellent
email filtering service. The filtered emails are sent directly to an
email server we have at work, and the router is configured to drop all
port 25 traffic except coming from the ML IPs.

>Do you have any file-sharers installed? I found that BBC iPlayer file-
>shares by default. ISTR someone saying that even removing some of the
>similar utilities doesn't remove the file-sharer.

Not that I know of. We have used Iplayer, but this should not set up
P2P. The router certainly does not have any open ports, other than
ones I know about and have manually configured.

>Sorry I can't offer any more concrete suggestions.

I will work on it.

Virus checks have been done, using boot-CD scanners, and nothing has
been found.

Turning off the 3 wifi APs has made no difference, which is a relief.