Unusually high data usage megathread

I too have seen higher than normal usage.  I have a Asus router that shows me traffic usage by client and has always been almost exact the same as the Xfinity usage meter.  This month though I see a 200GB descrepency between them.  I was wondering, does the Xfinity Beta app on Roku TV's now count as data users and/or when I go to https://www.xfinity.com/stream/ from my PC and watch programing?  It never did before and there are numerous articles from years back specifically saying they didn't count but reading the FAQ now it seems they might.

I specifically bought my model of router to get a better handle on who the data sponges in the house are but suddenly, this month, it's all out of whack and have 200+GB that's completely uncounted for.

i just saw this thread.. last months and this months has been double what the standard has been.

no abnormal usage, just regular netflix and some youtube.

if anything the usage should have gone down.. 

the one thing i can think of is i been watching a lot of HBO now on demand since its now free with the xFI.. does this count as internet usage?

I've averaged 250Gb per month on internet service, and luckily was not one of those that was scammed by comcast's internal metering 'bug' from September. As of April-June, although I was home more often because of the shutdown, it was no more internet usage than most months, but saw the average now become 2TB, or 8 times as much. Comcast, please stop your internal fraud because you want to take advantage of a hardship on all your subscribers during these times. I entirely aware Comcast has not charged for overages during April through June but artificially inflating metering is 100% fraud.

So it looks like Comcast is back to their old tricks just like I suspected they would. Prior to Covid, our internet usage (according to Xfinity,) was going above the 1TB of data. We knew this was an impossibility. We got jerked around after submitting tickets, no follow-up, etc. But they had no problem trying to convince me to upgrade to unlimited since we seemed to be approaching the limit every month but couldn't seem to tell me how/why were were even approaching that limit. Knowing this is a full on scam or they're just incompetent and don't know how to fix it, we said absolutely not and we won't be paying any overages. 

Then Covid hits and Comcast makes a smart move by having everyone at unlimited for several months. But they also thought their internet scheme/issues prior to it would get swept under the rug and we'd forget about it. Guess again. As soon as we got the notification unlimited was over and we were all going to 1.2TB's of data/month, I started tracking again.

Things are right back to where they were with this scam and all the previous posts prove it as well. As I write this post, we're sitting at 927GB's with 3 days to go. We know this is an impossibility and fairly certain we'll go over in the next 3 days the way things have been going. 

In Xfinity's OWN MESSAGE when they notified us about upping the data limit to 1.2TB's/month: 

• Stream about 500 hours of HD video in a month
• Stream more than 21,000 hours of music
• Videoconference for close to 3,500 hours in a month

There is no way on God's green earth we should even be approaching the limit, especially with their own email stating the above. 

• Stream about 500 hours of HD video/month. To get to that, we'd have to watch HD videos 21 out o f 31 days, 24 hours each time to get to that number, i.e. no shot this happens
• Stream 21,000 hours of music. There aren't even 800 hours in a full 31 day month, i.e. no shot this happens
• Videoconference for close to 3500 hours in a month. Again there aren't even 800 hours in a full 31 day month so again no shot this happens. 

Now we know Comcast will try and say those are just a few of the things that can take up data and things like regular internet surfing, playing games, blah blah blah can lead to it. We all know that's a bunch of bull so I'll say this. Comcast, you were exposed once before for this very same issue and had to pay out. The issue isn't fixed so I'd advice you guys to fix it this time or be prepared to pay out again in refunds OR worse, just settle for a class action that will easily come your way the longer this continues. 

New to this Forum but trying to get help. Prior to Covid our home internet data usage was around 200GB per month. Since we started working from home the usage increased and we are averaging 600GB/month until June. Suddenly in July, withing only 20 days into the month we reached almost 1.3TB. No new devices have been added to the router. My router shows a usage very similar to our previous usage. We haven't changed anything in terms of how we use internet.

Ou usage according to Comcast:

January/2020: 229 GB

February/2020: 320 GB

March/2020: 449 GB

April/2020: 512 GB

May/2020: 610 GB

June/2020: 606 GB

July/2020: 1,229 GB (through July 28)

Spent numerous hours with Comcast on the phone and they claim their numbers are correct. However, they cannot explain where I am using the data since they say I own my modem. Went to the Comcast store today and got one of their modems so apparently they can monitor what devices are using the data.

Any thoughts? I have no doubt there is somthing wrong on their end since there is no way we doubled our usage this month.

@Santastico,

Now that you have their modem, try downloading the xFi app.  As far as I know, that's the way you get device specific info for their modem.  Some routers you can buy can also provide this kind of info (And I think in more detail than the xFi app.)  Asus routers are typically mentioned in this regard.  (Although I do see some complaints about Comcast DHCP and Asus routers so you might want to check them before you buy.)  You can also get open source router firmware for certain commercial routers or build-it-yourself routers that can provide even more details.  (For tech-friendly people.)

Is there any oversight to how these are metered like gas, electric, and water?

Secondly I am curious as to why the caps where reinstated since we are still in the midst of COVID and many states still have stay at home orders and restrictions? Especially with more people resorting to work at home through zoom and the impending fact many kids are being given the choice to school during the upcoming school year period virtually coming up the data usage is going to continue to climb.  A child using zoom for 7 hours and a parent using 8-10 hours working will rack up a lot of data essentially pigeon holding them into these charges. I think you could safely reinstate your previous practices once we are free of the current world wide situation. This looks like a means to take advantage of people being forced to use more data for work and school. 

From 01/2020 to now, there has been an extremely large and random increase spike in household data usage for me (family of 4). It is up the point now that since May, it shows that we have been hovering around 1.1 - 1.3 TB of data usage up from the lowest it was (250+ GB) in feb. What is going on? Xfinity live chat agents refuse to cooperate and give me more details, they just tell me to continue to monitor data usage. There is no possible way 4 people can use this much data if they are not download / streaming extremely large files / 4k video 24/7.

Dare you post any sort of personalized message about excessive usage reporting in the forums your post will be buried in here within minutes (but not addressed).

I was about to tear my hair out 8 months or so ago, edging up to the 1TiB cap.  Finally I bought a Asus router that will give me usage stats, per device.  Loved it, finally let me see exactly what was using all the data in my house.  On total usage it was always within +/- 5% or so of what the xfinity meter showed.  This was good enough for me.  When COVID his they removed the cap (temporarily), now that it's back but higher xfinity now reports 30% more than my router shows me.  My router reports as of 7/31 @ 10pm I've used 770GB, xfinity reports I've used 998GB.  This is completely our of whack. 

It's easy for Comcast to claim people just aren't realizing what they're using because they have no tools of their own to contest it but EVERYTHING in my house funels through my router.  Every wired and wireless device is labeled on my network and I know exactly what's using data.  THERE IS A PROBLEM

Insult to injury, at 10pm CST 7/31 it appears my July meter is already closed out for the month and everything is already being added to August.  That isn't necessarily when it started but just when I happened to check.

This seems like a money grab to me.  Just saw an article today about the massive amount of cord cutters that Comcast has lost during COVID.  Seems to me they're trying to force people into "unlimited" internet to help make up for it.

Sure.  There's traffic spikes.  Checkout one of my log tables below.

What are port 8080 and 81?  Tripwires.  Hit one of those ports, your traffic is ended with a dynamic firewall (snort.org and pfsense.org).  Pick a random high one, and a random low port number.  Redirect to a firewall.  Tends to stall the script kids and botnets and they move on to the next IP address, or their script just hangs costing them time. 

They're hit all the time with sync/ack attacks.  This is unsolicited traffic you will see too.  Mostly portscans, but there's a few others and some UDP DNS attacks.  Sometimes more clever ones too.  When does it happen?  It's random.  Who is it?  Compromised machines, jerks, governments.......the internet.......

Couple suggestions:

Check for a firmware update on your gateway.

Looks for known exploits for your modem/firmware on us-cert.gov (like cve-2018-8878).  It could be what they're fishing for.

Turn off ICMP.  Disable UPnP. 

Disable any kind of remote access.  There are other ways to do that if you want to remotely manage your gateway from somewhere else.

Forwarding ports?  Hope they're protected by other means.

If your gateway has a firewall, make sure it's at the highest setting.  Does it work or respond properly and record that traffic when it does?  That's entirely a different question.

Try some penetration attempts with nmap from a remote location.  Make sure you've got zero open ports, or any port that will disclose its state open or closed.

I solved it by throwing hardware at it.  Isolate your gateway:

Internet <-> Gateway <-> Firewall Ex interface <->Firewall In interface <-> wifi (router) <-> Internal clients

Traffic was cut in half.  Yeah, I'm not using the gateway wifi, I have another wifi router for that and the internal LAN network.  As a bonus, you can throttle traffic per device if you want to.  Streaming can be as many as 12 streams up to 12-15Mbps.  You can fix them at a lower point, smooth out the stream, and still have decent quality.

Now below, if any of these actors hit an open port, they'd be hammering my gateway, and probably from multiple locations:

@BobWang Thanks for your confirmation on the usage meter correction.  I refrained from comment to ensure that my numbers matched, but the meter DOES seem to be corrected, and my numbers now match what xfinity is reporting.  I don't think that was the case earlier in July, but at least for August, I'm seeing numbers that line up on the Data Meter and my own vnstat output on Cable Modem interface.

Joe:
Thanks for the heads up, 

now my Usage meter shows ZERO usage in August 😜

Bob