Skip to main content

    Support

    Offers

MackGuyver's profile
MackGuyver
Expressive Exchange
Conversation Starter
1st Like

Contributor

 • 

33 Messages

Sunday, March 12th, 2023 7:12 PM

Closed

Usage Spike and it's not my Traffic - Can Anyone Help?

As of 3/14, Xfinity now shows that I've used 1349GB(!) vs. my router which shows 274GB.  Is there anyone who can help me get past the Level 1 Customer Service?

​​​​​I have never exceeded my bandwidth cap and have a UniFi Dream Machine Pro that all my devices sit behind that allows me to monitor traffic in real-time.  On Friday afternoon, a Xfinity bucket truck came and worked on the box in my yard for quite a while.  On Friday night, I received a 75% alert, and today the 90% alert.  This makes no sense as I'm 12 days in and according to my router (see screenshot), the activity is normal for this period.  I tried contacting support but got the usual script reader who wanted me to buy the unlimited plan and said it was probably Netflix or video games.  Any ideas on how to escalate this to someone who can actually help?​​​​​

​​​EDIT: My logs are showing Packet loss and High Latency.  ​​​

​​EDIT2: in the 8 minutes since rebooting my modem, I have 54,410,644 corrected, 2 uncorrected on channel 37 which seems excessive.​​

​EDIT3: I just received the 100% usage alert meaning that I used 300GB in less than 48 hours...this is opposed to my router which says I have used 20GB.  Not to mention that Xfinity says I used 10% (120GB) in roughly 12 hours!​

​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​​​​​ ​ ​ ​ ​ ​

Question

 • 

Updated 

2 years ago

 • Edited

390

4

0

flatlander3

Problem Solver

 • 

1.5K Messages

2 years ago

If you are looking at the OFDM PLC channel, you're going to see a massive number of correctable errors.  That's just how the protocol works.  Hardware does those on the fly in real time, and they cost you nothing.  The uncorrectables are not so great on that channel.  Start here for what you should be seeing for channel power/snr/modem log entries etc:  https://forums.xfinity.com/conversations/your-home-network/internet-troubleshooting-tips/602dae4ac5375f08cde52ea0

Is your gateway in bridge mode?  Is every device you own behind the Dream Machine, including cable boxes (MoCA connected via coax), or is any device Ethernet connected to the gateway in 'non-bridge' mode?  Just looking for a possible path for your missing ones and zeros past your counter

0

0

MackGuyver

Contributor

 • 

33 Messages

2 years ago

@flatlander3 thank you for your reply.  That's good to know about the OFDM channel and you're correct.  The other numbers all look fine.  

Also, I'm using an Arris SB8200 and the router is connected to it.  I hadn't considered my X1 boxes, but that's a great point.  I have an XG1v4 and an Xi3, but we don't do any streaming with them.  We just watch TV and recordings from the hard drive.  I have rebooted booth of them as well to make sure that's not the issue.  I have checked all the cables and splitters as well.

(edited)

0

0

flatlander3

Problem Solver

 • 

1.5K Messages

2 years ago

I mention cable boxes (any streaming box really), because they've got a high speed connection and can really be data pigs if you aren't intentionally throttling them.

When you are watching a stream, that can be broken up into as many as 12 different resolutions.  The connection is tested constantly to avoid buffering, and it will tend to upshift to largest resolution you can pull without running out of data in the buffer.  These days, there's a whole lot of FHD video that can end up coming down the pipe at anywhere from 15-25Mb/s. 

They're not supposed to be counting the cable lineup, but if you do something else, youtube/netflix/hulu etc, you're burning data.  If you shut the TV off and not the stream on the cable box too, it also might just happily stream forever and not timeout a channel.  Apps are hit and miss on this.  Sometimes they shut off eventually, other times they do not.  Max Bandwidth saving settings are also incredibly hit and miss. 

In any case, if it's not going through your other gear, you can't see it.

*I've also had devices misbehave on a software update.  Just spin in a cycle trying to re-download a failed download.  An old firestick I owned would also cycle through trailers 24/7.  How annoying.  I don't know if they still do it.  Roku doesn't.

(edited)

0

0

MackGuyver

Contributor

 • 

33 Messages

2 years ago

I think I found the solution, which I posted here (‎Sudden huge increase in internet data usage | Xfinity Community Forum) and after almost three weeks, it appears to be working:

All, I may have figured out a solution, or at least something to try.  I was burning through 100GB+ a day, according to Comcast, but it was actually around 20GB according to my router. Since doing this two days ago, it looks like I'm using ~20GB again, which is correct.  Customer service was utterly useless, but after reading through this or another thread, I saw a guy that said he turned off his modem for three days and that fixed it.  I wondered if a new IP address was all that was needed, so I set off to release and renew my IP.  You used to be able to turn off your modem for 10-30 minutes and it would release the IP, but now it seems that Xfinity locks it to your modem's MAC address, so here's how to do it:

  1. Check your IP address first by going to whatismyip.com or a similar site.
  2. If you are connected directly to your PC, you can do an ipconfig /release and ipconfig /renew from the command line, then skip to step 4.
  3. From a router, you will need to use the "Clone MAC address" tool in your router settings.  Some pull your network card's MAC address, but if not, use ipconfig /all from the command line to see your WiFi or ethernet adapter's MAC address and use that. 
  4. You'll need to unplug the modem for 60s after doing this and when you power back up, you should get provisioned with a new IP address. (Note: some routers may need to be power-cycled as well).
  5. Go back to the site from step 1 to see if you have a new IP address.

I can't promise this will work for you, or keep working for me for that matter, but it's worth a shot.

1

0

flatlander3

Problem Solver

 • 

1.5K Messages

@MackGuyver​ Might be a super temporary fix.

At any given time, I'm usually blocking around 100 hostile actors, some of which are on my subnet -- the typical hijacked unpatched windows box that is now part of a botnet.  Others are hijacked virtual machines on cloud instances.  Some are intentional actors, even State actors.  What are they all doing?  Walking the subnets, looking for open ports so they can run a canned exploit script.

If you are doing any port forwarding, and have no ability to rate limit/mitigate/stop an attack on the service or port, or control who has access to it, you can end up taking on a pretty heavy network traffic load in no time.  Similarly, if you are one of the hijacked boxes hitting me, you'll see the same data increases.

Is it a problem with the 3rd party company that reports data usage?  Nobody has proven that in a few years but that's possible.  I keep detailed logs of all of my traffic, for every device, and have since I had the issue myself.  I can account for every one and zero from my gear to the Modem.  More than likely, you are actually using the data somehow. This is the big reason why I don't trust either a gateway or a cable box.  No security on them, and the inability to patch and update firmware when there is an exploit found.  Even if there is a problem with a library they used to compile the firmware, it might not be deployed for months or years.  If ever.  It's much better to do the security with something else.

One thing you are going to want to watch for?  The sudden increase again.  Just this last hour, the background noise on my network shows 44 known hostile actors.  This is pretty typical 24/7 at my location.  One may find you too soon again, despite the IP address change.  You may have fixed the result, but not the actual problem. 

If you aren't port forwarding, try some penetration testing of your own network with a utility like nmap for both ipv4 and ipv6.  Try different types of scans -- udp/tcp/sync/xmas...etc.  See what you can find if you don't think you have any open ports.  Rate limit your scans too.  Some gateways have built in portscan detection.  Run different time delays before hitting the next port.  It's perfectly legit and within the terms of service to test your own gear and the connection that YOU pay for.  Just nobody else's.      

*Added -- that cable box?  I've never tried to hijack one.  It's MAC address should be on your account page, perhaps you can figure out if it uses a unique IP from there.  I don't know how they communicate if they are MoCA, or if they get a "super secret" IP address.  If it's wireless and on your network, you should be able sniff out what it does between the dream machine and the modem. 

(edited)

2 years ago

0

forum icon

New to the Community?

Start Here