Unusually high data usage megathread

@coles1,

We sincerely apologize for the confusion. The mega thread you are discussing is in reference to a proactive post I authored more than 3 years ago informing our customers about our Terabyte Data Usage Plans. Since the original post, many new posts were being merged there that were discussing individual concerns about data overages. While we can certainly understand customer's desire to communicate about this issue with other users, it can make it extremely difficult for our care teams to provide assistance to customers reporting needing assistance with their accounts and their individual data usage.

Since data usage is so specialized to an individual's online habits it simply does not make sense to allow speculation or the concern that one customer's data usage habits can be the same as any other customer. 

If you would like specifics with your account data usage, our CSA department can provide some additional insights into how data is being accounted for on your account. You can contact them directly at 1-877-807-6581 from 6:00 AM - 2:00 AM ET, 7 days a week. 

**UPDATE 10/1/2019**

We sincerely appreciate all the comments. As of today, October 1st, 2019, the data meter tool is working as designed. If there is an update to this or additional information to share we will be sure to update this message and the marked Best Answer on the mega thread mentioned in the original post. 

We ask that if you have individual concerns about your account's data usage and are in need of employee assistance, please author a new post here: https://forums.xfinity.com/t5/Your-Home-Network/bd-p/YHN

So our team can better assist your individual needs. 

**UPDATE 10/2/19**

Currently, there is a ticket open with our engineering teams to investigate if there is an issue with the way the data meter is measuring our customer's data usage habits. As of now, we are currently investigating this. If there are any updates or additional information to share I will be sure to add an update to this post. Thank you in advance for your patience as we work to investigate this further. 

The unfortunate thing about breaking the threads is that anyone who posted earlier will now not be notified if someone posts a solution or even a sensible way to investigate the problem.

the problem isnt individual data usage, my dude, we've established that amply. the problem is comcast metering. i have twenty printed-off pages of posts from across the internet from dozens of people having the exact same problem in the exact same frame of time. this is not an individual data usage issue. this is a comcast issue. a couple of people have even gotten comcast to admit it! twitter has some interesting things.

stop merging relevant threads into irrelevant ones so that you can shut them down, thx

There has not been a fix for the spike in data usage that many have experienced this month.  My data usage tripled in September for no apparent reason I have been able to find thus far - never have gotten close to the data cap since it was raised to 1 TB.  Always have been using about 350 GB.  I have called Comcast several times in the past few days and am not getting any closer to a resolution for this issue and I have little time left to solve it before I am forced to go to an unlimited plan or cancel service and go back to the low speed data plan I had before. 

Well, we're not getting very far on this topic other than we know people see random usage spikes.  For the "internet connection only" folks (no X1 or MoCA set top boxes) How about something more constructive?

Update for 12/04/2020 since they want two magical megathread lists and this was outdated.  Short answer is yeah.....the traffic is there.  The counter Xfinity posts daily is fairly accurate -- within 10G/month with some rounding, and generally reports 10G shorter than what you used, but it might depend on your timezone as to when the cutoff happens and the new month starts.

I've been looking at this for over a year along with @Ccalvert23 and others.  There are several possible things going on to explain "I can't possibly use 1.2T of data".  Actually, it's much easier than you think it is.  1.2T in a month is 3.65Mbps running 24/7.  Stream in 4K?  You can run 12Mbps easily on one TV.  Turning off the TV might not cut a device connection so you are still streaming.   Some apps time out sooner or later, others, not so much.  Roku behaves better -- at least the TV's and little express boxes I have.  An update from IOS 14.1 to IOS 14.2 on my phone stuck, and just burned almost 30G in just a few hours.  If I hadn't rebooted it, that would have easily been over 800G in a month worth of talking gibberish to Apple trying to redownload a failed download.  Other things to check:

1. Your gateway security settings.  By default, lots of them including Xfinity gear have extremely  poor and frightening default settings.  If there's a firewall setting, set it to the highest level.  Disable P2P.  Disable UPnP.  Disable Remote access.  Disable ICMP 'pings'.  Disable any other feature it has (Netgear ReadyShare for example).  If it's got a portscan block setting, use it.  Change the default password -- that's what script kids are looking for.   Disable any kind of remote desktop application on your Gateway -- a cable gateway is not a VPN appliance and shouldn't try to be, there are other ways to do that.  1st rule of firewalls is to disable all traffic, then allow only what you need, and know WHY you switched it on.  Got a Nest device/camera/Assistant device (wow man....not really concerned about security, are you?)  Welp.....maybe cut down the bitrate or frame/s on cameras if you really need one and it's eating your bandwidth.  Other ways to do that too without 24/7 UPnP links to a China/Cloud server punching holes in your firewall.

2. ComcastTeds actually has a few good points with the default cut and paste answers.  Misbehaving devices on your network, stuck backups blasting traffic in a loop, windows failed update retries/windows P2P 'update sharing'....etc.....it all adds up.  Don't "share" updates (in settings).  Gamers might be surprised at how much data a new game wants you to pull down.  100's of Gb.

3. Hijacked Gateways/old gear with known exploits.  Gear with exploits that are now 'end of life' (5 years on consumer gear) -- no more security fixes even if the company bothered to do it in the first place.  Try to update the firmware on your Gateway if it's 3rd party.  If it says "updates are managed from your cable provider", you can force an update.  1st just power cycle.  If that doesn't do it, try the 'reboot modem' on the Xfinity site -- if it's 3rd party, call them and have them reset the link from their end.  It should do a reprovision, and update then.  You can also remove, then re-add the device if you have alternate internet (phone.....hotspot etc).  They all have exploits.  us-cert.cisa.gov publishes the known ones.

4. Streaming devices:  In settings, cut the stream to 720p.  Should look "good enough".  Try it.  You might have to do it on a Per App basis.  Netflix/Amazon/Sling/Hulu....etc, all have settings.  By the way, when the device "updates"?  It probably reset all your preferences if it was a major update.

5. Xfinity -- running a separate box independent of your Gateway looks like a major problem as @Ccalvert23 says.  If it's got the same frightening default settings as the Xfinity gateways, or no security at all, I'd pitch it in the trash.  There's a beta app for Roku, and perhaps other streaming devices if you can't live without it.  In any case, I wouldn't allow any traffic that doesn't pass through your Gateway so at least you have a counter of sorts -- even if it isn't all that accurate (my Netgear one isn't -- my separate firewall appliance is, and does match their numbers pretty well).

6. Unsolicited network traffic?  Yeah, it's there.  Dozen hits on my firewall in the last 24 hours.  Sometimes much more if it's a distributed attack (hundreds).  If you've got a decent firewall, it doesn't matter.  That's only a Kb of data since it was blocked, they found nothing interesting and moved on from my house to your house.  The script kids are either walking a subnet looking for gear to exploit, or when you visit a web site with milicious cross scripted ads (exist on totally legit sites too), they glean your IP address and now you're a target.  Ad blockers/script blockers help, but not entirely.  Not a big deal if you use #1. 

Bad traffic.  Mailformed packets.  DNS hijack attempts.  Virus spam propagation.  Botnets.  Otherwise hostile traffic That's just the internet. 

Consumer gear is junk too.   Don't use the wifi on your gateway.  Instead, use the gateway just for the coax or better yet, buy a cheap one without WiFi at all ($60).  After disabling the features mentioned earlier, run everything including WiFi through a firewall appliance.  Yeah, get a cheap WiFi router for your internal network.  Buy a bunch of them.  It's cheaper than overage charges or paying $340/year for unlimited.  Then you will see everything on your network, and the data it sent/received, and who it went to yourself.  Tracking down data is simple then.

I'm posting here so I can see if anyone posts a solution.

Since lastnight they are now accusing us of having used 1700GB (which is insanity).

They can look at our account history and see that we have always used under 500GB a month (usually around 350GB - 450GB).

I agree with what another person wrote in the now locked thread.  That all this seems to have started a few days after I received an email saying that comcast upped our download speed for no extra charge.  We received that email on Sept. 19th, and then on Sept 21st is when we got our first ever warning that we'd used 90% of our monthly data.  Then within another 24 hrs we'd used all 100%.

I had never changed the allert from the default 90% warning because we have never come close to using the full TB.

Well OK.  Now that I'm logging every single packet, and every packet size and type dropped by the firewall, how did I end up for the month of Sept?

Now I'm XXG off what is claimed on the usage page.  I'll keep the actual number a mystery for now.  More than 10G and less than 99G.  I'm assuming the usage for Sept won't change now that it's logging Oct, but no matter.  I've got the logs and databases.

Up until Sept 6th, I was getting a mysterious data spike 30% over actual use and on the way to blow the 1TB limit.  Since then, the counter has been "corrected", but it appears they over achieved on the correction factor a bit.  It is actually SHORT of data I know I actually used.

So what's the reported usage?  Is this an "estimate"?  A dynamic rolling average based on......what  and when exactly?  It doesn't appear to be actual data.

I am having the same issue. I was shocked to see that I’d gone over the cap (highest usage historically has been 295) but am much more concerned at how to stop the hemorrhaging of data!

I received notice that I’d exceeded the cap at 9:30 on Sunday. I then changed my wi-fi password immediately and then also unplugged my modem because I’d seen on other threads that users experienced data usage even with an unplugged modem. I was curious if this would happen to me, and I wanted as much information as possible when I called customer service.

Data usage continued to creep up, at this point showing I’d used approximately 34 GB of data while having an unplugged modem.

I called customer service and they acknowledged that this was unusual and clearly not accurate, based on my history (more than I was expecting to get out of them!). After being transferred a couple of times, they gave me back a courtesy month and are opening an investigation. They said they will  call me back with a resolution (I know, wishful thinking!). I think I really got their attention when I mentioned that my modem has been unplugged and their system is still showing that I’m using data.

During my conversation, I also learned that the spike in usage started on 9/10. Since then their records show an average usage of >50 GB per day. As others have said, this is clearly a monitoring issue since it’s impossible to use data without a modem.

I’ll update if I hear back.

I also, just got off the phone with customer support.

The lady acknowledged that there is an issue happening on Comcast's end.

She said that the "system" automatically refunded my courtesy month, and that I would be receiving a phone call explaining what happened.

I looked on my account, and my courtesy month counter had returned to 2.

I have the data spike issue in September also.  Never used over 500gb in my 5 years using comcast internet service.  We usually hover around 350 gb a month.

Then 15 days into September I get the warning that we have gone over 1 TB which is insane.  Multiple chats online and calls to comcast about the issue has been no help.  Seems like data use goes up 50-100 gb a day regardless of how much we use the internet if at all daily.

Make sure you are getting a call logged with customer service or their security team to document this in case you go over the cap and need a credit.  Some other cases might be  backup software, a virus, or wifi highjacking.  When your modem is down, it can't be.

---

@flatlander3 wrote:

 How about something more constructive?

---

Unfortunately it's been my experience that typically:

1. People will post about data overages
2. We ask them to detail issues or do some basic troubleshooting 
3. People ignore us, or
4. People don't report back as to whether or not their issue has been solved.

Fortunately a few people DID respond and we were able to isolate a few issues that were causing overages (the Backblaze backups being an obvious culprit) but it's hardly enough, given that all sorts of issues can lead to data overages without having it be on Comcast's end.

It would behoove all of us to remember that this is a peer to peer support forum and we can't solve problems on our own.