Unusually high data usage megathread

I am already at 327 GB for this month. I am on a gigabit speed plan. This time around, I will not be granted courtsey overage..

@AndyTex 

Well.  How about an experiment?  After the previous post, I started looking at the manuals for Xfinity gear.  You can find yours here if you are using one of their gateways.

https://www.xfinity.com/support/articles/broadband-gateways-userguides?

So let's look at one.  How about a TC8305C user guide?  That's technicolor.  They got ARIS and others too.  Flip your gateway over, see what model it is.  Probably has a bar code with a default username and password on it too.

Here's the manual:

https://secure.xfinity.com/anon.comcastonline2/support/help/faqs/wireless_gateway/HOW5220_TC8305C_User_Guide.pdf

I'd say this goes for ALL gear, not just Xfinity.  If you want different, then I hope you know what you're doing.

Login to your gateway.  A web browser to http://10.0.0.1 with a default username=Admin, password=password (facepalm.......gahd!!!!) on this model.

Section 3.2 page 28 change that password.  Seriously.......

Now let's look at the firewall configuration section 5.2 and page 41.  Although the firewall on a gateway is truly junk and shouldn't really be trusted for security, notice the default setting.  It's set to a predefined default of "low".   That is of zero help to anyone.  I was surprised to see it.  You want this changed to "High".

Maximum Security (High): Blocks all the applications including voice applications (such as Gtalk, Skype) and P2P applications. Allows Internet browsing, email, VPN, DNS and iTunes services.

So now you've disabled:

1. ICMP pings

2. UPnP -- it was a bad idea when it came out, it's still a bad idea

3. You may have closed port 443 if they're talking about skype and possibly some higher UDP ranges, but that is really untested.  In any case, you want to set this to "high".  This one doesn't have a "block portscan" or "Block DoS" attack or other options.  If yours does, turn all those on too.

Make sure you hit SAVE.

Check section 6.1.1 UPnP.  Make sure that setting is really disabled.  (SAVE again).

Section 6.1.2 Port Forwarding.  Make sure that setting is disabled (SAVE again)

Section 6.1.3 Port Triggering.  Make sure that setting is disabled (SAVE again)

Section 6.1.4 DMZ host.  Make sure that setting is disabled (SAVE again)

This model has no "Remote Access" feature -- configuration from a remote location.  Good!!!  If yours does, Disable that too.

Look at your usage now on the Xfinity site -- they claim a 24 lag, so yesterday hasn't shown up yet (perhaps).  Look at it two days from now.

Did the difference in your usage reported look lower than 300+G in 7 days?  I'm horrified at the default settings.  Perhaps they are all that way.......you know.....to make stuff Easy for an end user and avoid support calls.........dunno.

Looks complicated, but I will try it before running out to Xfinity store. Thanks.

Sorry to say that I give up. Yesterday I went to Xfinity store and signed up for additional $11/month unlimited plan. I was already at 527 Gig. This time around, when I go over the limit, they would have been happy to charge me $10/50 gb.

Hi everyone. Since this continues to be an ongoing issue for everyone, I just wanted to post a follow-up now that we're half-way through October and I'm very happy to say our data usage is still as it should be, close to 400GB's and right on track to be around 800GB's for the month.

Again the ONLY thing that has changed (back at the very end of August,) was our Firewall settings from Low to Mid and it took getting connected to Comcast's Security team to provide credentials. Our Media and Internet usage have not changed in the slightest.

I don't know if that's what officially fixed things and can't imagine what it's doing to keep the numbers in check but since it's been working so far, do anything and everything you can to get directed to this group. For me personally, it took filing a complaint with the BBB to get to that team and the Security rep even read the complaint word for word to make sure he knew what my problem was. 

I recieved the data usage warning last week. I checked the usage data and it shows I used almost 1TB 20 days into the billing cycle. this cannot be possible.  The spike started in Sept but I hit the 80% threshold and got the email warning this month. We don't stream movies other than occational watching youtube clips which we have been doing for years. I have been checking my everyday data usage since I got the first notification, and it shows I was using anywhere ffrom 30-50GB per day(that's a lot of HD movies! to watch) . Our usage pattern hasn't changed and I don't see unrecognized devices connected to my router(although I changed my wifi password out of precaution). I called xfinity Security Assurance team but they just repeated what I already know. I asked for a breakdown of the website and IP addresses which consumes most of the data and they don't have those information.  I am an IT professional and I know it will require a lot of HD streaming to use even 30GB of data per day(we don't have 4K TV). Now it's all what xfinity says against what I say and I see this is as a losing battle. I am waiting for their level 2 support to call me back. But if I don't get a satisfied answer, I will jump ship and switch to AT&T.

@charlie_y for "typical" people, I recommend a process of elimination to see where the data is going.  However, since you are an IT professional, you'll probably want to look at the posts from @flatlander3 as it sounds like you could have fun tracking this down.  Please let us know what you find!

thanks. I changed the firewall setting to typical(medium) as I have Ooma VOIP as a backup home phone and cannot set it to maximum(high). Will see if this makes any differnece. I will report back in a few days.

I'd love to see the meter broken down into days and even hours so we can better understand what might be causing the problem. 

It would also be useful to enable short-term logging (say for an hour) of traffic by port and address, but that can be expensive if done on the head-end router in Comcast's data center. I've used that on my personal router running OpenWRT to try to figure out which device and port is using my connection. I wish the Comcast router offered similar abilities. 

Their meter says it may not include data used with the last 24 hours.  So, you can't count on it for hour by hour tracking like that.  (I don't mean to suggest that it's impossible to use the data on the phones, just that you don't really know that that's what happened.)

I would start with malware scans and then move to a process of elimination.

The data usage on my internet account has been normal till April 2020. Its usage was under 1TB per month, but since you starts capping the usage, it mysteriously increased to more than 1.2 TB per month. There are my 2 kids my 90 yrs old mom at home. There should be more usage before 4/2020 than now since my kids are back to school. They only use their data phones to chat with their friends. They don't even watch movie or play video games. My mom does not use internet.

There are 3 days power outage in October but I see my data usage still climbing. I received  your mess age yesterday 10/27/2020 at 3:48 PM saying my data usage is at 90% and at 6:43PM, within 3 hours, my data usage is exceeding 100%. That means my kids used 120GB data within 3 hours on their phones?

All my internet traffic goes through a Synology router. Traffic through the router for October was 789.9GB.

Comcast says I used 1400GB. 

I'm forced to add unlimited data. What is going on here?