Does ISP "download usage" data include spurious packets?

Discussion in 'Broadband' started by Peter, Oct 28, 2011.

  1. Peter

    Peter Guest

    I am seeing ~ 500MB as the baseline daily download usage, which seems
    very high.

    I have now turned off all three wifi APs (they were WPA/PSK anyway) to
    see if this changes, and all that leaves is two PCs, of which one is
    on 24/7 (but has M$ updates disabled).

    However, during some brief experiments which a Sonicwall TZ100 router,
    which had a function for logging all packets on a given physical
    interface, I was seeing quite a lot of incoming packets of random
    nature, which the router would obviously drop.

    Presumably I am paying for these too :)
    Peter, Oct 28, 2011
    1. Advertisements

  2. Yes you are and most ISPs don't care.

    So if you are a small business running some serviceis which you might be
    perfectly entitled to do and someone decides to run some hacking software
    to try to break in, then, even if you have a firewall and drop all their
    packets, you still get billed for them because they've come through the
    ISPs network and over the wires into your own router/firewall.

    I've had several clients go over their monthly limits like this when
    their VoIP PBX gets attacked by sipvicious. They've then had to pay more
    to top-up their line or simply been cut-off for the rest of the month.

    My experience with dealing with the ISPs when this happens has been poor
    - I have been able to get them to put in a block at theit end on a few
    occasions, but not all.

    So if you want to piss someone off, then get an account on a hosted
    server/cloud vpsm etc. and just keep sending data to an IP address and
    you'll eventually get them cut-off if they have a capped account.

    Gordon Henderson, Oct 28, 2011
    1. Advertisements

  3. Peter

    Mark Guest

    Yes. But 500MB is a lot for this kind of usage. I only see about
    100-200KB per day of this type of traffic.
    (\__/) M.
    (='.'=) Due to the amount of spam posted via googlegroups and
    (")_(") their inaction to the problem. I am blocking some articles
    posted from there. If you wish your postings to be seen by
    everyone you will need use a different method of posting.
    Mark, Oct 28, 2011
  4. Peter

    Peter Guest

    I have no obvious way to log the amount of data in kbytes. The router
    shows a packet count, and I suppose one could assume a packet is up to
    1500 bytes, but it be much smaller.
    Peter, Oct 28, 2011
  5. Does your router do SNMP ? My Netgear router's statistics page only
    shows packet counts, but the built-in SNMP server shows the byte counts.
    Andrew Benham, Oct 28, 2011
  6. Does your router do SNMP ? My Netgear router's statistics page only
    shows packet counts, but the built-in SNMP server shows the byte counts.
    Andrew Benham, Oct 28, 2011
  7. Peter

    Peter Guest

    Probably, but I don't know how to set it up :)

    I am changing from a Draytek 2900 to a Draytek 2955 and that might do
    Peter, Oct 28, 2011
  8. Oh yes. I had people ping flooding me and building up my traffic..until
    I turned off ping responses..

    Any hack attack, any DOS attack, costs you money.

    as do regular email checks, NNTP updates, and various other software
    packages phoning home reverse charge..
    The Natural Philosopher, Oct 28, 2011
  9. 500MB is certainly a lot. Apart from one mystery event a couple of
    months back when I got charged 1GB in one day for no obvious reason, I
    currently only clock up a few kilobytes an hour when not actually
    surfing (network of 3 computers running 24/7).

    But I had what you describe a year ago -- started using several
    hundred MB a day, rapidly using up my quota. I tracked it down to a
    laptop on which I'd just installed Google Chrome, but that's probably
    just a coincidence. The machine died before I located the problem.
    Meantime I just had to disconnect from the internet when not actually
    using it outside my ISP's overnight free time. I always disable
    automatic updates from M$ and others which don't allow you to specify
    when they can do it.

    What does the Task Manager's Networking window show? I was able to
    catch periods of intense activity even when I wasn't doing anything,
    but nothing complained when I pulled the plug.

    Are e-mails arriving OK? Someone reported once that their ISP had a
    mailserver problem and Outlook clocked up a huge amount in repeated

    Do you have any file-sharers installed? I found that BBC iPlayer file-
    shares by default. ISTR someone saying that even removing some of the
    similar utilities doesn't remove the file-sharer.

    Sorry I can't offer any more concrete suggestions.

, Oct 28, 2011
  10. classic virus/malware......
    The Natural Philosopher, Oct 28, 2011
  11. Peter

    Peter Guest

    chrisj.doran% wrote
    I see nothing of significance there.

    Looking at the router's Online Status page, I see the packet count
    incrementing by say 1-3 packets per second, but at 1.5kbytes/packet
    that comes to only about 1/3 of the 500MB/day+ I am seeing.
    Yes; fine. After massive spam issues, we (that's me at home at at the
    office) moved to Messagelabs who for £400/year provide an excellent
    email filtering service. The filtered emails are sent directly to an
    email server we have at work, and the router is configured to drop all
    port 25 traffic except coming from the ML IPs.
    Not that I know of. We have used Iplayer, but this should not set up
    P2P. The router certainly does not have any open ports, other than
    ones I know about and have manually configured.
    I will work on it.

    Virus checks have been done, using boot-CD scanners, and nothing has
    been found.

    Turning off the 3 wifi APs has made no difference, which is a relief.
    Peter, Oct 29, 2011
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.