Massive Internet data usage and my tuner

[Venom51]

if the interface is seeing video traffic from the Ceton not long. I suspect from your previous postings it's going to be pretty quiet on that interface.

[swest6602]

Install wireshark on the HTPC and capture the traffic on the network interface headed to your router. Zip up the capture file and link it here so I can have a look. Someone can help with a little info but I doubt the Ceton is generating multicast traffic. The packet capture will give us a better idea of what's happening.

http://www.wireshark.org/

Here you go. I hope I did it correctly. I have to run out for a bit so will be offline for a while. Thank you for looking at the report.
https://docs.google.com/open?id=0B54Qp0 ... TFjOVhvVnc

[Venom51]

I can confirm there is no video traffic on that interface. You've got something else going on.

[swest6602]

Hey all,

I still have not found a solution to my issue, but thanks to you guys I am now using the right tools and watching the correct source. Thank you all for your help getting me to the right place. I appreciate it very much.

My regular network had 6.2GB of data since about 5pm ET yesterday (normal for my usage). For about 5 minutes I thought I was on track to find the offending service/device, but I was tired and looking at the info wrong. Oops (I wish Gmail's unsend button was available about 10 seconds longer!).

I will now be watching the correct network as I add devices back into the mix. One of them may have a weird leak. If not I go back to Comcast to try and figure out what they are measuring, which is exactly where I started 10 days ago. I will document my network for a few more days before touching base with them again. I asked Comcast the obvious (to me) questions a couple weeks ago:
Is the data you are posting while the cap is off a true representation of my data? - Answer: Yes
Is there a chance you measuring the QAM signal you are sending as well is the regular network? Answer: No.

I am still all ears if anyone has further thoughts on this. I will post if I find one of my devices is leaky once as I add them back. I can usually find a "how to" posted somewhere when trying to fix a PC or device, but this issue had no how to's that I could find, so thank you all very much for the help.

[STC]

^ Higher levels of their support should by all rights be able to tell you the source of these stray packets to your Comcast equipment.

[adam1991]

Have you taken the HTPC offline and watched the Comcast meter?

[foxwood]

If not I go back to Comcast to try and figure out what they are measuring, which is exactly where I started 10 days ago.

You mentioned in an earlier post that your Netgear router can track the overall traffic going through it. Have you compared it's numbers to the Comcast numbers? They should be broadly in agreement, but if not then I think you'd have to start pointingthe finger at Comcast.

I'm assuming the Netgear is plugged into a Comcast cable modem - can you access it and see if it has any information indicating throughput?

[swest6602]

If not I go back to Comcast to try and figure out what they are measuring, which is exactly where I started 10 days ago.

You mentioned in an earlier post that your Netgear router can track the overall traffic going through it. Have you compared it's numbers to the Comcast numbers? They should be broadly in agreement, but if not then I think you'd have to start pointingthe finger at Comcast.

I'm assuming the Netgear is plugged into a Comcast cable modem - can you access it and see if it has any information indicating throughput?

To add to the great week I am having the Netgear router broke the other day. Suddenly wouldn't let me log in and started flashing green. I put it aside as it broke just before I was planning to replace it with the Cisco router anyway (seems fairly common from reviews, but ppl love them & most reviews are very good). I actually tried to reflash the firmware today, but it won't take (I can ping it and even tftp the firmware over to the router, but it doesn't seem to like it). I have a 60 return policy at Best Buy so will swap it tomorrow. I'd point at that router as the problem, but per Comcast.net my data goes up too much with the Cisco router as well.

Anyway, tomorrow I will put the a new new Netgear back on the network and start tracking with it. When it was working I believe it was recording both the regular network and the Ceton tuner network, the numbers on my notes all appear that way and it was one of the reasons I went so far down the wrong path. I assume I can pick and choose what to track so will just track the regular network when I hook it back up. If cannot pick and choose networks I will use a combination of tools. I am likely going to need the information for conversations with Comcast.

Have you taken the HTPC offline and watched the Comcast meter?

Not since I started looking at just the regular network. The data per every meter I have for 192.168.1.1 is low. With the exception of still having to put random devices back on the network while checking their data use, the problem I am trying to solve seems to have changed. I am no longer asking 'what on my network is creating huge amounts of data' but "why is the data I monitor going through the network so different from what Comcast monitors going through the network.

^ Higher levels of their support should by all rights be able to tell you the source of these stray packets to your Comcast equipment.

I have someone to work with in the "Customer Security" department (or something like that). He seems like a decent guy and if he cannot help will likely get me to the right person.

I accomplished nothing on this issue today as I had a few other things to do and then wasted time on the router. Tomorrow morning I'll swap the router and post the throughput info for foxwood. Then will add the devices back one by one. Assuming none spike the network monitor I plan to touch base with Comcast. I have not decided whether to record a few days of 192.168.1.1 first (all my other data is from both networks) but will probably call and ask them what they want me to do.

At the risk of repeating myself-- thank you all so much. Your help has been invaluable.

[adam1991]

I don't understand. Unplug the HTPC for a few hours while it's doing its thing and while you're watching TV, and watch the Comcast meter.

Simple, straightforward, and eliminates or confirms the very thing you came here with at the beginning.

[Venom51]

I still don't think it has anything to do with the HTPC but we'll see.

[gpatlanta]

Seems a bit unlikely, but If your netgear went bad could it have had such bad packet loss that it kept retrying to get data causing this?

[swest6602]

I don't understand. Unplug the HTPC for a few hours while it's doing its thing and while you're watching TV, and watch the Comcast meter.

Simple, straightforward, and eliminates or confirms the very thing you came here with at the beginning.

You are correct that it is a simple & straightforward test, but I no longer think it will prove or disprove anything. Motz (think it was Motz, it was an email) pointed out that while I can check the Comcast meter every hour or two I don't know if it is "realtime" (i.e. the last hour or two) or from 24 hours ago as the Comcast page says it could be. In addition since I am now looking at the two networks separately (thanks to all of you) I know that my regular internet, the only thing Comcast should be measuring, is not increasing at a ridiculous rate, from the HTPC or anything else.

Seems a bit unlikely, but If your netgear went bad could it have had such bad packet loss that it kept retrying to get data causing this?

The Netgear has been off the network for several days now. If it was related the problem would have stopped and it hasn't. Even if Comcast's data has a 24 hour lag I have gone past that point. I am still going to swap the router out today (despite being annoyed that it broke in the 1st place) as the traffic meter reports will likely be useful working with Comcast (assuming I can separate the networks, but I have to assume that I can.)

I am contacting Comcast now and see what they say about where to go from here. I assume they'll send someone out and I will get charged if they find it is my fault somehow and not if they find it is their fault. I will still post the throughput data when I hook the Netgear back up and I will also let you know where this ends.

[gpatlanta]

Do you have a wifi hookup? Have you checked the machines accessing it to see if you have someone stealing bandwidth? Good luck with Comcast..

[swest6602]

Hey all,

Sorry for disappearing. I was catching up on stuff I was ignoring while working on this for the last week and also got a two calls Friday afternoon about a job (Phone interview Monday!). I have not stopped working on this and have not had my internet shut down (thankfully).

I got the Netgear router replaced Thursday and got it hooked up about 10:30 last night. Here's the kicker. It says it is measuring just 192.168.1.1 but it has measured 27944MB since it was hooked up and 25946MB since midnight (downloaded. only 525.11MB was uploaded). The network meter on the HTPC is not reading anything like those numbers. I grabbed a new Wireshark capture and have scanned it, but not sure what I am looking at. If someone can take a look, I'd appreciate it https://docs.google.com/open?id=0B54Qp0 ... XJvbGpIN0E.

- As far as I know that only thing running on the network now is Handbrake CLI converting some TV show via a .bat script
- The only thing going on last night that I was aware of was the Handbrake CLI and streaming podcasts
- I changed all the passwords last night and I recognize all devices on the network.

I'd like to know if there is anything showing up on that capture report before I start pulling everything off the network (including the HTCP!) again. This time I will be comparing to the router vs. Comcast.net so know that the numbers are accurate.

Is there any recommendation on what tool to use to measure throughput? I found something called QCheck but it looks like it is an Enterprise tool. I don't really care about filling out their form but if someone has a recommendation for a tool aimed at personal use that might be better.

I emailed the Comcast rep I am working with Thursday, but did not hear back. He is off Friday and Saturday so I should hear for him tomorrow.

Sue

[Venom51]

That's a lot of ARP'ing going on.

[swest6602]

Thanks Venom51. Could the ARPing just be from a lot of devices on the network or is it more likely to signal a problem?

Just pulled everything offline and added it back one by one (Mostly. Haven't bothered with my printer and a couple other things that haven't been online this week anyway). Over the course of 2hrs 45min I have everything but the HTPC back on the network and used a fairly normal 246MB of data. I thought I'd leave things as is for the night and see what the router records for data overnight. HTPC is running, just offline. There is no obvious data leak in any of the devices I use regularly as far as I can tell so far, but the overnight data without the HTPC will be interesting.

I knew the Netgear router was more or less matching Comcast's numbers before it died but I truly thought when I replaced it I'd find it was recording both networks. It may be doing so, but it is says 192.168.1.1, so I just don't know. With no bridge on the network and nothing else you guys have had me look at matching those numbers I am truly baffled. Making matters more confusing the router says the data is being downloaded, not uploaded. I have a brand new 30-digit password and the guest network is disabled (with a 17-digit password).

I need a few drinks, but am going to settle for a latte. I will be offline for a bit but will check in later. I will post again tomorrow AM with the overnight data without the HTPC and again tomorrow night (going to hook up the HTPC again in the AM to see how the data changes with it back online).

[Venom51]

Thanks Venom51. Could the ARPing just be from a lot of devices on the network or is it more likely to signal a problem?

Just pulled everything offline and added it back one by one (Mostly. Haven't bothered with my printer and a couple other things that haven't been online this week anyway). Over the course of 2hrs 45min I have everything but the HTPC back on the network and used a fairly normal 246MB of data. I thought I'd leave things as is for the night and see what the router records for data overnight. HTPC is running, just offline. There is no obvious data leak in any of the devices I use regularly as far as I can tell so far, but the overnight data without the HTPC will be interesting.

I knew the Netgear router was more or less matching Comcast's numbers before it died but I truly thought when I replaced it I'd find it was recording both networks. It may be doing so, but it is says 192.168.1.1, so I just don't know. With no bridge on the network and nothing else you guys have had me look at matching those numbers I am truly baffled. Making matters more confusing the router says the data is being downloaded, not uploaded. I have a brand new 30-digit password and the guest network is disabled (with a 17-digit password).

I need a few drinks, but am going to settle for a latte. I will be offline for a bit but will check in later. I will post again tomorrow AM with the overnight data without the HTPC and again tomorrow night (going to hook up the HTPC again in the AM to see how the data changes with it back online).

Arp is a normal function of the network. It's just more than I expect to see and from a device that isn't your router if it's at 192.168.1.1.

Arp - http://www.pcvr.nl/tcpip/arp_addr.htm

What setup are you using the grab the captures? Are you simply capturing from a workstation? That's not going to show all the traffic headed to and from the router. Ideally you'd want to wedge yourself between the router and the rest of the network via a hub or a mirrored port. If you are capturing via a workstation connected to a switch than you are only going to see the broadcast traffic and traffic to or from your workstation. You'll have no idea what's going on in the rest of the network.

[swest6602]

Thanks on ARPing. Will read up. I looked at Wikipedia quickly, but will check out this link.

Re: captures, I have been using my PC connected the the router. Modem to router w/ 4 ports (PC, switch a, switch b & Apple TV). Been using the PC on port 1 of router. I was wondering about whether I was getting everything from my PC or everything from 192.168.1.1. I will try and get something into the right place to get a better capture.

Thanks.

[Venom51]

Thanks on ARPing. Will read up. I looked at Wikipedia quickly, but will check out this link.

Re: captures, I have been using my PC connected the the router. Modem to router w/ 4 ports (PC, switch a, switch b & Apple TV). Been using the PC on port 1 of router. I was wondering about whether I was getting everything from my PC or everything from 192.168.1.1. I will try and get something into the right place to get a better capture.

Thanks.

You need a good old fashioned 100 meg hub. As you are connected now you will only see the traffic to and from your machine along with broadcast traffic like DHCP discovers, ARP requests and RIP.

[swest6602]

I am reading the Wireshark Q&A page and it looks like wifi will act the same as an old 10/100 hub with regards to the capture data. With the exception of the HTPC (The PC I have been using for captures so far) everything will run on Wifi. I can get a hub from Amazon (or see if my brother-in-law can borrow one from his work for a few days) but tonight I will get everything off of ethernet and onto wifi and see if I can grab the capture data from a laptop.

I should also note that wireless networking effectively behaves like LANs of old: every machine connected to a given Wi-Fi network can see all traffic, purely due to the nature of radio communication.
http://ask.wireshark.org/questions/1400 ... rk-traffic