Massive Internet data usage and my tuner

[swest6602]

I am hoping someone here might have an answer for me. I discovered a couple of weeks ago that beginning sometime in August my Comcast data usage tripled then quadrupled. I used 1.3TB in Sept and have already used 216GB in October (normal usage for me is around 150GB - 200GB / month). I have spent hours trying to determine and fix this issue.

Using Network tracking software I managed to confirm that the data "leak" is on my HTPC with the Ceton tuner installed.

I have restored my HTPC with a clean copy of Windows 7.
- Reinstalled only a handful of applications
- Installed Netlimiter 3 which tracks data usage by application (and by the hour)
- I have run tests using NetLimiter and the Comcast data meter (hidden but accessible if you look hard enough) that confirm the data usage being somehow
related to Media Center and/or the Ceton tuner (Data meter goes up with LiveTV or Recording on and stops when it is off)
- I have taken down the network and hooked the HTPC directly to the Modem. With LiveTV or Recording on the data meter still goes up.
- Confirmed that the data usage is 'downloaded' vs 'uploaded' data. This was confirmed with 2 different tools- Networx (measures gross data use by
machine/network) and Netlimiter 3 (measures system data use by application / time ).

I do not believe the tuner is necessarily bad, just that something is grabbing hold of the QAM data and trying to (succeeding in?) process it as IP data.
I know that Media Center / EXHRCRV / 192.168.200.1 to port 5002 is somehow causing the issue. I do not know why/how, so I don't know how to stop it. Has anyone seen anything like this? Can you point me in the right direction to stop it? I have been working with Ceton but so far while being friendly they have denied that the tuner could possibly be involved (That was before I reinstalled Windows and could show the new Netlimiter data meter pointing by the hour to the tuner. Waiting to hear back from them after providing this additional info collected over the last few days).

While I wait to hear from Ceton I am hoping others might have some ideas for me to shut down this massive data suck. Comcast may not have their cap in place at the moment, but my usage is so massive they will not allow it to continue much longer. At present they know I am trying to find and solve the problem. Before I pull the tuner out completely I am hoping for some other ideas to try.

[richard1980]

The InfiniTV is a network tuner, and as such, all of its traffic is network traffic. My guess is you are measuring all network traffic on the whole computer and/or your entire network, when you really need to be measuring the network traffic that goes through the modem. Even then, it won't be 100% accurate because Comcast's policy is any traffic that doesn't leave the Comcast network doesn't count against your data cap.

[foxwood]

You do know that the Ceton Tuners are presented to Windows Media Center as network tuners, and all TV that makes it into Media Center is handled by the OS as network traffic, even though it never goes anywhere near your actual ethernet port (unplug the ethernet port, and you'll still see lots of network traffic on your HTPC).

If you bring up Task Manager, and look at the Networking tab, you'll see that you have seperate network interfaces for your LAN connection, and the Ceton devices, and that the Ceton network devices will be busy when you're recording TV, but that traffic shouldn't be going out on your ethernet connection, unless you've done something really weird.

[erkotz]

There is absolutely, 100% positively no way that, Windows/Windows Media Center with the InfiniTV, on its own, could cause this. The InfiniTV *DOES* send the video via IP to the PC, however that is over the InfiniTV's private network interface, and does not leave the PC, access your router, or otherwise count as internet traffic to your provider.

The data you are measuring is data for the InfiniTV's interface, and unrelated to internet traffic.

[swest6602]

The InfiniTV is a network tuner, and as such, all of its traffic is network traffic. My guess is you are measuring all network traffic on the whole computer and/or your entire network, when you really need to be measuring the network traffic that goes through the modem. Even then, it won't be 100% accurate because Comcast's policy is any traffic that doesn't leave the Comcast network doesn't count against your data cap.

Thanks for the reply. I have been at this for over a week now and have used three different tools (Netgear router measuring all network traffic, Networx measuring just the HTPC and Netlimiter 3 Pro measuring data on the HTPC by application). I put monitors on all my machines, tablets, phones last week which is how I narrowed the issue down to the HTPC. I added the Netlimiter tool after restoring the HTPC with a clean Win 7 install (from disc). Netlimiter breaks data down by application. In addition I am using Comcast.net's data meter (this matters, the others are just to help me narrow down the culprit). Trying to attach a couple screenshots.
TV Off / Apps using data


TV On / Apps using data


I know that the QAM signal the Ceton network uses does not count/is not measured as part of Comcast's data meter. Still with just the HTPC hooked up to my internet, everything else completely unplugged, and LiveTV on, the Comcast data meter goes up. What I think is happening is that something somehow is grabbing that QAM data and doing something else with it that is going over the internet. A friend on Google + mentioned the possibility of multicasting and the router (when it was hooked up) grabbing the signal and trying to process it even though it was not really going anywhere. I have tried two different routers (Cisco and Netgear) and using the modem direct to HTPC. The Netgear definitely had multicasting disabled by default. I believe that something similar is what is causing the data usage, but that is just a guess. I can watch the data increase just by turning on LiveTV. Not just my monitors, but the Comcast data meter on Comcast.net. That happens with nothing but the HTPC on the network and Netlimiter 3 shows which apps used data. See screenshots below.

I love my Ceton tuner. I don't want to remove it, but have to stop this and I have already pulled everything else off the network.

Attached are two more screenshots with the Comcast meter at 12:30pm and 4:30pm. Also a screenshot showing which apps used data yesterday
Comcast Data meter at 12:30pm today


Comcast Data meter at 4:01pm today


Apps that used data by hour 10/8/2012 4:06pm


This is my first time posting images this way. Hope they work.

Apps that used data from 11am - 12pm 10/8/12

[richard1980]

I can't do anything with those screenshots. You should be able to upload attachments to your post. Please upload full-size screenshots as attachments so they can be viewed. You'll need to be in the full editor mode (if you are replying using the quick reply feature, at the bottom of this page, click the button that says "full editor". Then below the box where you type you'll see the options and a link that says upload attachment.

[swest6602]

I can't do anything with those screenshots. You should be able to upload attachments to your post. Please upload full-size screenshots as attachments so they can be viewed. You'll need to be in the full editor mode (if you are replying using the quick reply feature, at the bottom of this page, click the button that says "full editor". Then below the box where you type you'll see the options and a link that says upload attachment.

Will do. I am going to try and make sure they are in order and make sense so give me a little time. I want to be clear that I do not believe that the tuner or the QAM signal are being measured as internet data. I know something is being measured with nothing on the network but that PC and only a handful of applications. I will post again in a bit and hopefully will be a bit clearer. I appreciate the help. Something is clearly going on and I don't understand enough about how packets move through a network to know how this could possibly occur. I can handle getting beat up a bit for being a newb. Anyway, let me pull together the screenshots and a chronology that will make some sense and repost.

[adam1991]

Your HTPC works fine when it's isolated from a network. It will record and play back shows.

So pull the network cable from the HTPC. You may plug in anything else, but leave the HTPC unplugged. What happens? What does Comcast's meter say?

[STC]

I can't do anything with those screenshots. You should be able to upload attachments to your post.

Will do. I am going to try and make sure they are in order and make sense so give me a little time.

You can upload them to your post then place them in your text. You will get the same sort of results.

[newfiend]

Have you checked the PC for Malicious Software? Your PC could be infected and be a Botnet or have a Rootkit.. I know you said you installed Win7 fresh from the disk but did you scan all your drives etc. attached to the PC for Malicious Software? I would definately check all the drives attached with a good Virus scanner. Webroot Spysweeper works well as well as many others.. This could be causing the excess internet usage.
newfiend~

[swest6602]

Adam1991 -- I will try a reverse test in the AM (Pull the HTPC of the network completely) and see how that goes. Should have thought of it. I am getting overloaded with this "project".

Newfiend: I only ran a Security Essentials scan but I did a whole new install of Windows 7 (Twice actually. The 1st time I did a new install of Windows 7 from the restore partition and then restored my system image from March. Friday I did completely clean install of Windows 7 with a Windows disk, this time not restoring the image.

Richard1980
Here is a chronology of yesterday and today showing different views of app usage and data usage by Comcast and Netlimiter. I am limited to 3 uploads so have indicated where I can add screenshots. If anyone thinks they'd be useful let me know and I will do another post with 3 more uploads. I don't want to overload you all with multiple posts unless you think they'd be useful. Again, let me add that I do not think the QAM signal is being measured, but that something is grabbing that signal somehow (multicasting maybe?)... I have been running Media Center for years and never seen anything like this. The Ceton tuner has been in for about a year and before that I had 3 tuners (2 WinTV with antennas and 1 Pinacle connected to Comcast for Clear QAM channels). I have not had any problems at all. I love my Media PC and Ceton tuner. I was planning on getting a USB version soon so I can add an Echo downstairs for my Mom (82 and lives with me) when available.

Thanks again for any and all ideas.

Two previous days data
Clean install of Windows 10/4 (Comcast meter at 59G)
Comcast Data Meter ~ 8:30AM 10/5 72G
Comcast Data Meter ~10:30AM 10/6 140G (Installed Netlimiter 3 Pro.)
Comcast Data Meter ~8:30AM 10/7 150GB

Overview of Data Usage 10/7/2012 by Application (measured by Netlimiter 3)

38.14GB Total
~35GB EXHRCVR
~1.5GB XBMC (this is a library meta data update)

Data Use by time 10/7/2012 (measured by Netlimiter)

Patriots game turned on at 4:30. Recorded (run NFL for 2 extra hours. Also recorded Prime Time)

Comcast data meter from 10/8/2012 4:00pm - 5:23pm HTPC hooked direct to modem. Router off and unplugged
4:02pm Router disconnected. HTPC hooked directly to modem
Comcast data meter at 211GB

4:15PM Comcast Data Meter: 215GB no screenshot as this may include data from before the modem disconnect
5:23PM Comcast data meter: 223GB (have screenshot but there is a 3 screenshot limit).

View by App (measured by Netlimiter 3)
Have a screenshot of apps using data from 10AM - 11AM
10AM to 11AM : Comcast Data Meter 10:57AM 195GB (Have screenshot)
Have a screenshot of apps using data from 11AM - 12Noon
11AM to 12Noon: Comcast Data Meter 12:30pm 203GB (Have screenshot)

Apps Using Data with TV On (Have screenshot)
Apps Using Data with TV Off (Have screenshot)

[erkotz]

The data from Networx and Netlimiter 3 Pro is almost certainly meaningless - I can nearly guarantee you that it is totaling traffic from all interfaces (which includes the InfiniTV) so that data is not valid. You would have to restrict it to just the NIC's interface for it to be valid.
Is your wireless open, or secured? Have you tried disabling wireless. I strongly suspect this is either:
1. Malware on your PC
2. Torrent software on your PC
3. Open WiFi

[glorp]

Block outbound WAN access at your router for the HTPCs and/or Cetons MAC or IP address.

[Motz]

I think what eric is trying to say is that basically networx and netlimiter are going to record the infiniTV as bandwidth because it is all traffic on all interfaces on the PC. So for instance I opened up task manager on my HTPC while I was recording 2 shows. Selected Networking in Task Manager and I see 2 Local Area Connections (one is gigbit and other is 100). The 100mbps is the infinitv, however like eric said earlier "The InfiniTV *DOES* send the video via IP to the PC, however that is over the InfiniTV's private network interface, and does not leave the PC, access your router, or otherwise count as internet traffic to your provider."

So that is why our assumption is that simply the issue is somewhere else on the network, or else I would be seeing this same issue as well and my Netgear is show currently 10GB of data used in the last 30 days and I recorded about 6 hours of programming tonight alone.

As for the open network as I know this is a new router is one of the Guest networks being broadcast?

[swest6602]

Thank you all for the replies.

I going to completely rebuild that PC and the network (again). This time the PC is coming apart and I am starting from scratch (Obviously a clean Windows install did not help). I expect based on everything I have done over the past couple of weeks that the data suck will stop with the HTPC off, but if not I will restore everything else as well.

As an FYI on the Netlimiter and Networx measurements. I was not trying to show them registering the Ceton network so much as I was trying to show that nothing else was shown using the data (with or without anything else on the network). This is what has me so perplexed and why I thought others might have some ideas. I am clearly not explaining myself well as I truly don't believe the Ceton network is being measured as is. I am just trying to determine what else (app, service, setting) could get access to that signal or what network setting might be messed up that would create the scenario I am dealing with. Although I have apparently not shown it very well I am positive that the data increases (per Comcast.net) only occur when I use Live TV or Record, but I cannot explain why (which means I cannot stop it).

I will continue to monitor this thread so if anyone thinks of something, please post.

Motz or anyone from Ceton -- Disregard my email. I sent it yesterday before posting here and it more or less covers what is already here. Unless you have other network settings or something I can check no point in taking up more of your time.

Thanks again all.

[foxwood]

I don't know about NetLimiter, but you should be able to set Networx to only monitor your ethernet interface, so that the ceton traffic is excluded. (There's a Monitored Interfaces option in Settings).

Can you also post a screenshot of the Networking tab in Task Manager when you're recording or watching live TV?

[swest6602]

Foxwood,
Below are two screenshots: Networking Tab in Task Manager and Networking Tab in Resource Monitor (The Network tab in Resource Monitor is actually what lead me to where I am now. Sadly I have gotten no further).

I don't have Networx installed on the HTPC at present. I installed Netlimiter in its place when I did the clean Windows install. I thought the totals by app/service would be more helpful than just gross totals. Netlimiter does not offer the option to view by network/user but has an "Unrelated" line item in which almost all the services listed under that tab are the Ceton network. (Opposite side of that is when the TV is on 192.168,200.1 to port 5002 is the service running the most data and not under "Unrelated"). I don't know that this means anything but I do have those screenshots if you think it might be useful.

Thanks

P.S. I am still planning to rebuild the HTPC and network but am doing a fresh library backup before starting.

[Venom51]

Install wireshark on the HTPC and capture the traffic on the network interface headed to your router. Zip up the capture file and link it here so I can have a look. Someone can help with a little info but I doubt the Ceton is generating multicast traffic. The packet capture will give us a better idea of what's happening.

http://www.wireshark.org/

[foxwood]

Foxwood,
...Networking Tab in Task Manager

NetworkingTabLiveTVOn.PNG

That shows that the HTPC has received 183GB of data on the Ceton network interface, and only received 130K on the actual Ethernet port - and only sent 46K! The data on the Ceton network interface never left your PC - it certainly didn't trigger gigabytes of traffic on your Comcast connection.

I don't have Networx installed on the HTPC at present. I installed Netlimiter in its place when I did the clean Windows install. I thought the totals by app/service would be more helpful than just gross totals.

The gross totals for the Media Center/Ceton apps are always going to be huge, because the tuners are actually network devices - but the traffic doesn't touch the LAN (unless you have enabled Bridging mode to allow another Media center machine on your LAN to share a Tuner).

[swest6602]

Install wireshark on the HTPC and capture the traffic on the network interface headed to your router. Zip up the capture file and link it here so I can have a look. Someone can help with a little info but I doubt the Ceton is generating multicast traffic. The packet capture will give us a better idea of what's happening.

http://www.wireshark.org/

No problem installing Wireshark. How long would I run it before linking the capture file to give you a reasonable sample?