coles1's profile

Frequent Visitor

 • 

12 Messages

Mon, Sep 30, 2019 11:00 AM

Unusually high data usage megathread

Jessie helpfully locked the thread pertaining to this for being "off topic" after merging all relevant threads into the irrelevant terabyte thread.

I thought we should still have a place to discuss this ongoing problem. I took 20 pages of documentation into a store today and was told all they could do was charge me 70 dollars to send out a tech. Out of desperation I conceded.

Any thoughts? Anyone had any resolution yet? Some folks on Twitter seem to have made slight headway and had their accounts credited but aren't sure how to help since they seem to think they just got lucky.

This conversation is no longer open for comments or replies and is no longer visible to community members.

Responses

klutch14u

Contributor

 • 

20 Messages

1 y ago

I too have seen higher than normal usage.  I have a Asus router that shows me traffic usage by client and has always been almost exact the same as the Xfinity usage meter.  This month though I see a 200GB descrepency between them.  I was wondering, does the Xfinity Beta app on Roku TV's now count as data users and/or when I go to https://www.xfinity.com/stream/ from my PC and watch programing?  It never did before and there are numerous articles from years back specifically saying they didn't count but reading the FAQ now it seems they might.

 

I specifically bought my model of router to get a better handle on who the data sponges in the house are but suddenly, this month, it's all out of whack and have 200+GB that's completely uncounted for.

aaronsta1

Frequent Visitor

 • 

13 Messages

1 y ago

i just saw this thread.. last months and this months has been double what the standard has been.

no abnormal usage, just regular netflix and some youtube.

 

if anything the usage should have gone down.. 

the one thing i can think of is i been watching a lot of HBO now on demand since its now free with the xFI.. does this count as internet usage?

 

 

New Poster

 • 

1 Message

1 y ago

I've averaged 250Gb per month on internet service, and luckily was not one of those that was scammed by comcast's internal metering 'bug' from September. As of April-June, although I was home more often because of the shutdown, it was no more internet usage than most months, but saw the average now become 2TB, or 8 times as much. Comcast, please stop your internal fraud because you want to take advantage of a hardship on all your subscribers during these times. I entirely aware Comcast has not charged for overages during April through June but artificially inflating metering is 100% fraud.

lassi505

Frequent Visitor

 • 

18 Messages

1 y ago

So it looks like Comcast is back to their old tricks just like I suspected they would. Prior to Covid, our internet usage (according to Xfinity,) was going above the 1TB of data. We knew this was an impossibility. We got jerked around after submitting tickets, no follow-up, etc. But they had no problem trying to convince me to upgrade to unlimited since we seemed to be approaching the limit every month but couldn't seem to tell me how/why were were even approaching that limit. Knowing this is a full on scam or they're just incompetent and don't know how to fix it, we said absolutely not and we won't be paying any overages. 

 

Then Covid hits and Comcast makes a smart move by having everyone at unlimited for several months. But they also thought their internet scheme/issues prior to it would get swept under the rug and we'd forget about it. Guess again. As soon as we got the notification unlimited was over and we were all going to 1.2TB's of data/month, I started tracking again.

 

Things are right back to where they were with this scam and all the previous posts prove it as well. As I write this post, we're sitting at 927GB's with 3 days to go. We know this is an impossibility and fairly certain we'll go over in the next 3 days the way things have been going. 

 

In Xfinity's OWN MESSAGE when they notified us about upping the data limit to 1.2TB's/month: 

  • Stream about 500 hours of HD video in a month
  • Stream more than 21,000 hours of music
  • Videoconference for close to 3,500 hours in a month

There is no way on God's green earth we should even be approaching the limit, especially with their own email stating the above. 

  • Stream about 500 hours of HD video/month. To get to that, we'd have to watch HD videos 21 out o f 31 days, 24 hours each time to get to that number, i.e. no shot this happens
  • Stream 21,000 hours of music. There aren't even 800 hours in a full 31 day month, i.e. no shot this happens
  • Videoconference for close to 3500 hours in a month. Again there aren't even 800 hours in a full 31 day month so again no shot this happens. 

 

Now we know Comcast will try and say those are just a few of the things that can take up data and things like regular internet surfing, playing games, blah blah blah can lead to it. We all know that's a bunch of bull so I'll say this. Comcast, you were exposed once before for this very same issue and had to pay out. The issue isn't fixed so I'd advice you guys to fix it this time or be prepared to pay out again in refunds OR worse, just settle for a class action that will easily come your way the longer this continues. 

New Poster

 • 

1 Message

1 y ago

New to this Forum but trying to get help. Prior to Covid our home internet data usage was around 200GB per month. Since we started working from home the usage increased and we are averaging 600GB/month until June. Suddenly in July, withing only 20 days into the month we reached almost 1.3TB. No new devices have been added to the router. My router shows a usage very similar to our previous usage. We haven't changed anything in terms of how we use internet.

 

Ou usage according to Comcast:

January/2020: 229 GB

February/2020: 320 GB

March/2020: 449 GB

April/2020: 512 GB

May/2020: 610 GB

June/2020: 606 GB

July/2020: 1,229 GB (through July 28)

 

Spent numerous hours with Comcast on the phone and they claim their numbers are correct. However, they cannot explain where I am using the data since they say I own my modem. Went to the Comcast store today and got one of their modems so apparently they can monitor what devices are using the data.

 

Any thoughts? I have no doubt there is somthing wrong on their end since there is no way we doubled our usage this month.

 

strega7

Regular Contributor

 • 

393 Messages

1 y ago

@Santastico,

 

Now that you have their modem, try downloading the xFi app.  As far as I know, that's the way you get device specific info for their modem.  Some routers you can buy can also provide this kind of info (And I think in more detail than the xFi app.)  Asus routers are typically mentioned in this regard.  (Although I do see some complaints about Comcast DHCP and Asus routers so you might want to check them before you buy.)  You can also get open source router firmware for certain commercial routers or build-it-yourself routers that can provide even more details.  (For tech-friendly people.)

Frequent Visitor

 • 

5 Messages

1 y ago

Is there any oversight to how these are metered like gas, electric, and water?

Frequent Visitor

 • 

5 Messages

1 y ago

Secondly I am curious as to why the caps where reinstated since we are still in the midst of COVID and many states still have stay at home orders and restrictions? Especially with more people resorting to work at home through zoom and the impending fact many kids are being given the choice to school during the upcoming school year period virtually coming up the data usage is going to continue to climb.  A child using zoom for 7 hours and a parent using 8-10 hours working will rack up a lot of data essentially pigeon holding them into these charges. I think you could safely reinstate your previous practices once we are free of the current world wide situation. This looks like a means to take advantage of people being forced to use more data for work and school. 

Regular Visitor

 • 

1 Message

1 y ago

Can't understand How Only 2 Adults in a Household , Only Myself during the Day are Using all this Data , NOWAY POSSIABLE , I Never even came close to my limit when I had a 8 people living here ?? And this Started Shortly after Corvid-19 and as Soon as Comcast Started Giving Out Xfinty Wifi Essentials to People who had No Access to Internet , Which didn't apply to Exsiting Customers , Never Ever Have I Even Come Close To My Limit EVER !!
SO SOMETHING SHADY IS GOING ON

New Poster

 • 

2 Messages

1 y ago

From 01/2020 to now, there has been an extremely large and random increase spike in household data usage for me (family of 4). It is up the point now that since May, it shows that we have been hovering around 1.1 - 1.3 TB of data usage up from the lowest it was (250+ GB) in feb. What is going on? Xfinity live chat agents refuse to cooperate and give me more details, they just tell me to continue to monitor data usage. There is no possible way 4 people can use this much data if they are not download / streaming extremely large files / 4k video 24/7.

klutch14u

Contributor

 • 

20 Messages

1 y ago

Dare you post any sort of personalized message about excessive usage reporting in the forums your post will be buried in here within minutes (but not addressed).

 

I was about to tear my hair out 8 months or so ago, edging up to the 1TiB cap.  Finally I bought a Asus router that will give me usage stats, per device.  Loved it, finally let me see exactly what was using all the data in my house.  On total usage it was always within +/- 5% or so of what the xfinity meter showed.  This was good enough for me.  When COVID his they removed the cap (temporarily), now that it's back but higher xfinity now reports 30% more than my router shows me.  My router reports as of 7/31 @ 10pm I've used 770GB, xfinity reports I've used 998GB.  This is completely our of whack. 

 

It's easy for Comcast to claim people just aren't realizing what they're using because they have no tools of their own to contest it but EVERYTHING in my house funels through my router.  Every wired and wireless device is labeled on my network and I know exactly what's using data.  THERE IS A PROBLEM

 

Insult to injury, at 10pm CST 7/31 it appears my July meter is already closed out for the month and everything is already being added to August.  That isn't necessarily when it started but just when I happened to check.

 

This seems like a money grab to me.  Just saw an article today about the massive amount of cord cutters that Comcast has lost during COVID.  Seems to me they're trying to force people into "unlimited" internet to help make up for it.

flatlander3

Regular Contributor

 • 

176 Messages

10 m ago

Sure.  There's traffic spikes.  Checkout one of my log tables below.

 

What are port 8080 and 81?  Tripwires.  Hit one of those ports, your traffic is ended with a dynamic firewall (snort.org and pfsense.org).  Pick a random high one, and a random low port number.  Redirect to a firewall.  Tends to stall the script kids and botnets and they move on to the next IP address, or their script just hangs costing them time. 

 

They're hit all the time with sync/ack attacks.  This is unsolicited traffic you will see too.  Mostly portscans, but there's a few others and some UDP DNS attacks.  Sometimes more clever ones too.  When does it happen?  It's random.  Who is it?  Compromised machines, jerks, governments.......the internet.......

 

Couple suggestions:

Check for a firmware update on your gateway.

Looks for known exploits for your modem/firmware on us-cert.gov (like cve-2018-8878).  It could be what they're fishing for.

Turn off ICMP.  Disable UPnP. 

Disable any kind of remote access.  There are other ways to do that if you want to remotely manage your gateway from somewhere else.

Forwarding ports?  Hope they're protected by other means.

If your gateway has a firewall, make sure it's at the highest setting.  Does it work or respond properly and record that traffic when it does?  That's entirely a different question.

 

Try some penetration attempts with nmap from a remote location.  Make sure you've got zero open ports, or any port that will disclose its state open or closed.

 

I solved it by throwing hardware at it.  Isolate your gateway:

Internet <-> Gateway <-> Firewall Ex interface <->Firewall In interface <-> wifi (router) <-> Internal clients

 

Traffic was cut in half.  Yeah, I'm not using the gateway wifi, I have another wifi router for that and the internal LAN network.  As a bonus, you can throttle traffic per device if you want to.  Streaming can be as many as 12 streams up to 12-15Mbps.  You can fix them at a lower point, smooth out the stream, and still have decent quality.

 

Now below, if any of these actors hit an open port, they'd be hammering my gateway, and probably from multiple locations:

 

2020-08-03
09:06:41
2TCPMisc Attack46.174.191.28
    
28471192.168.0.16
  
80801:2403358
  
ET CINS Active Threat Intelligence Poor Reputation IP TCP group 30
2020-08-03
09:00:26
2TCPMisc Attack78.108.177.54
    
26525192.168.0.16
  
80801:2403446
  
ET CINS Active Threat Intelligence Poor Reputation IP TCP group 74
2020-08-03
08:30:25
2TCPMisc Attack71.6.158.166
    
23999192.168.0.16
  
811:2403440
  
ET CINS Active Threat Intelligence Poor Reputation IP TCP group 71
2020-08-03
07:43:51
2TCPMisc Attack51.83.171.14
  
57204192.168.0.16
  
80801:2403376
  
ET CINS Active Threat Intelligence Poor Reputation IP TCP group 39
2020-08-03
05:09:18
2TCPMisc Attack185.39.11.105
  
45973192.168.0.16
  
811:2400017
  
ET DROP Spamhaus DROP Listed Traffic Inbound group 18
2020-08-03
05:09:18
2TCPMisc Attack185.39.11.105
  
45973192.168.0.16
  
811:2402000
  
ET DROP Dshield Block Listed Source group 1
2020-08-03
04:58:24
2TCPMisc Attack93.174.93.139
  
53068192.168.0.16
  
80801:2402000
  
ET DROP Dshield Block Listed Source group 1
2020-08-03
04:58:24
2TCPMisc Attack93.174.93.139
  
53068192.168.0.16
  
80801:2403478
  
ET CINS Active Threat Intelligence Poor Reputation IP TCP group 90
2020-08-03
04:49:51
2TCPMisc Attack83.97.20.130
  
60145192.168.0.16
  
811:2402000
  
ET DROP Dshield Block Listed Source group 1
2020-08-03
03:55:52
2TCPMisc Attack78.108.177.52
  
26525192.168.0.16
  
80801:2403444
  
ET CINS Active Threat Intelligence Poor Reputation IP TCP group 73
2020-08-03
00:09:14
2TCPMisc Attack46.174.191.30
  
28471192.168.0.16
  
80801:2403358
  
ET CINS Active Threat Intelligence Poor Reputation IP TCP group 30
2020-08-03
00:07:10
2TCPMisc Attack78.108.177.52
  
26525192.168.0.16
  
80801:2403444
  
ET CINS Active Threat Intelligence Poor Reputation IP TCP group 73
2020-08-02
22:42:22
2TCPMisc Attack61.219.11.153
  
62182192.168.0.16
  
80801:2403424
  
ET CINS Active Threat Intelligence Poor Reputation IP TCP group 63
2020-08-02
21:51:13
2TCPMisc Attack78.108.177.52
  
26525192.168.0.16
  
80801:2403444
  
ET CINS Active Threat Intelligence Poor Reputation IP TCP group 73
2020-08-02
21:14:36
2TCPMisc Attack185.39.11.105
  
33253192.168.0.16
  
80801:2400017
  
ET DROP Spamhaus DROP Listed Traffic Inbound group 18
2020-08-02
21:14:36
2TCPMisc Attack185.39.11.105
  
33253192.168.0.16
  
80801:2402000
  
ET DROP Dshield Block Listed Source group 1
2020-08-02
20:16:03
2TCPMisc Attack46.174.191.32
  
28471192.168.0.16
  
80801:2403358
  
ET CINS Active Threat Intelligence Poor Reputation IP TCP group 30
2020-08-02
19:19:42
2TCPMisc Attack46.174.191.29
  
28471192.168.0.16
  
80801:2403358
  
ET CINS Active Threat Intelligence Poor Reputation IP TCP group 30
2020-08-02
18:16:04
2TCPMisc Attack156.96.117.151
  
48635192.168.0.16
  
811:2400011
  
ET DROP Spamhaus DROP Listed Traffic Inbound group 12
2020-08-02
17:44:13
2TCPMisc Attack78.108.177.52
  
26525192.168.0.16
  
80801:2403444
  
ET CINS Active Threat Intelligence Poor Reputation IP TCP group 73
2020-08-02
17:31:36
2TCPMisc Attack58.8.141.64
  
58129192.168.0.16
  
811:2403384
  
ET CINS Active Threat Intelligence Poor Reputation IP TCP group 43
2020-08-02
15:32:30
2TCPMisc Attack156.96.156.138
  
54632192.168.0.16
  
80801:2400011
  
ET DROP Spamhaus DROP Listed Traffic Inbound group 12
2020-08-02
14:18:40
2TCPMisc Attack46.174.191.32
  
28471192.168.0.16
  
80801:2403358
  
ET CINS Active Threat Intelligence Poor Reputation IP TCP group 30
2020-08-02
14:08:01
2TCPMisc Attack58.53.187.6
  
35756192.168.0.16
  
80801:2403384
  
ET CINS Active Threat Intelligence Poor Reputation IP TCP group 43
2020-08-02
13:47:37
2TCPMisc Attack37.49.230.150
  
51964192.168.0.16
  
811:2402000
  
ET DROP Dshield Block Listed Source group 1
2020-08-02
12:41:12
2TCPMisc Attack78.108.177.53
  
26525192.168.0.16
  
80801:2403444
  
ET CINS Active Threat Intelligence Poor Reputation IP TCP group 73
2020-08-02
12:05:29
2TCPMisc Attack1.34.10.11
  
64328192.168.0.16
  
811:2403302
  
ET CINS Active Threat Intelligence Poor Reputation IP TCP group 2
2020-08-02
11:50:18
1UDPPotential Corporate Privacy Violation192.168.0.16
  
63517185.246.210.145
  
531:2014703
  
ET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Reserved Bit Set
2020-08-02
11:50:18
1UDPPotential Corporate Privacy Violation192.168.0.16
  
55843209.126.117.208
  
531:2014702
  
ET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Opcode 8 through 15 set
2020-08-02
11:50:18
1UDPPotential Corporate Privacy Violation192.168.0.16
  
55843209.126.117.208
  
531:2014703
  
ET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Reserved Bit Set
2020-08-02
11:50:18
1UDPPotential Corporate Privacy Violation192.168.0.16
  
25668181.41.213.54
  
531:2014703
  
ET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Reserved Bit Set
2020-08-02
11:50:18
1UDPPotential Corporate Privacy

 

joechang

Frequent Visitor

 • 

9 Messages

10 m ago

@BobWang Thanks for your confirmation on the usage meter correction.  I refrained from comment to ensure that my numbers matched, but the meter DOES seem to be corrected, and my numbers now match what xfinity is reporting.  I don't think that was the case earlier in July, but at least for August, I'm seeing numbers that line up on the Data Meter and my own vnstat output on Cable Modem interface.

BobWang

Frequent Visitor

 • 

18 Messages

10 m ago

Joe:
Thanks for the heads up, 

now my Usage meter shows ZERO usage in August 😜

Bob

Frequent Visitor

 • 

8 Messages

10 m ago

@ComcastTeds from the looks of this thread, you have a common, and very real problem.  Just look at the dates of the messages.....relatively active through April then quiet....suddenly in July the thread picked up in a big way, indicating that something has happened that is making your customers very, very unhappy.  Please elevate this issue and get to the bottom of why people's data usage meters are going off the charts....and give us better tools to monitor our traffic and troubleshoot data vampires. 

New to the Community?

Start Here