@Sam456 - I agree with you. If you call, they'll likely say that the issue is on your end, and that their meters are accurate and verified by a "third party." Then they'll likely get to what many believe is the main driver of the inaccurate data usage numbers - suggesting that you could always rent their equipment and/or pay extra fees for unlimited data. Rinse, repeat. It's the same scenario reported countless times on these and other forums.
Since they have no incentive (aka serious competition), and also permission from the government to maintain regional monopolies, we as consumers in the US are left with internet service that pales in comparison to many other countries while paying much more. We can do better as a country than what the cable companies are allowed to get away with. In the mean time, sadly we pay.
@Sam456, their meter says it may not include data used within the last 24 hours, so data showing up the following day is actually routine. I'm not sure how anyone could be connecting to your wi-fi, unless there are any issues like: your passwords are too predictable, you're giving your password to someone who is giving it to someone else. (ie: put it in a teenager's phone, teenager can see it, teenager has friends…) I assume when you say password, you mean the WPA2 password.
I'll repeat my earlier advice for all who have fallen victim to Comcast's recent data scam. File a complaint with the FCC. The only way you'll get their attention is to have their corporate office flooded with soo many complaints that they'll have to address this problem seriously.. In dealing with previous problems with Comcast, as well as AT&T, this was the only way I was able to achieve a resolution.
Comcast is required under FCC regulations to address any and all complaints submitted to them through the FCC complaint process. After you file the complaint, FCC fowards your complaint to Comcast corporate. They'll then have 10 days to contact you (yes someone from Comcast corporate offices will contact you, not some agent from their sales force trying to persuade to upgrade your service.) Sometime after, FCC will contact you by email to see if your problem was resolved. i don't know what happens after that because that was as far as I ever had to go . It's really a fairly simple process that can be completed over the internet. If your unsure of how to proceed, just "google" How to file an FCC complaint. Before you can finish typing this in it will probably suggest a link "How to file an FCC complaint against Comcast" Funny, huh? Seems to be a real popular search. Good luck!
Every since I noticed this unusual spike in data useage, I have taken every possible action I can to curtail excessive use of data. I recently began shutting down my gateway at night, being vigilant in stopping "pop up" video streams and advertisement while surfing the web, cutting back on tv streaming as well as internet time in general, disconnecting Xfinity Flex box when not in use, all to see my data useage continuing to climb. These are all extraordinary measures which I have never had to employ, still I am bumping right up against my data cap!
If anyone should recieve any type of reasonable explanation from any Comcast agent why this is occurring to soo many users please post it to this forum so the rest of us "victims" might benefit from your efforts.
There are a couple things you can try that perhaps you haven't considered. 1st one is a DSL line, then the problem goes away on it's own. No more xfinity. The second one is a hardware and heavy handed solution that I found works. Swapping providers will cost money for install plus hardware, and you may not be impressed with DSL speeds. I've been there, done that. Think Xfinity is bad? Try Centurylink.
Xfinity gear? Get rid of it. Gateway for sure. Your Xfinity flex box you end up paying $15/month for? Right in the trashcan. Could be, your DOCSIS gateway is flaky and generating traffic on it's own. You need a protocol analyzer to see how bad that link to your house really is. You can get an idea from looking at the errors, both correctable and uncorrectable on your gateway's admin page. Also look at the bonded channels (are they working?), power and SNR if you can see it on your gear. Might be it, but probably not. Could also be Xfinity has a firmware exploit and you're getting hammered with unsolicited internet traffic or it has an insure setting you can't change. Doesn't matter.
$30 buys a cheap netgear DOCSIS 3.0 non-wifi modem. Do you need a DOCSIS 3.1 modem? Probably not. 100Mbps is going to exceed anything you can pull from the net anyway, and it doesn't sound like you're running an office building with a half dozen 4k streaming devices. Another $35 will get you a cheap wifi router. Junk PC or laptop laying around? Retask it. You need two ethernet connections on it. Even a USB dongle will work for a 2nd connection (it limits bandwidth, but you won't care). That's your new firewall, and that's all it does. It will run a dedicated BSD (unix) variant OS. $30-50? Get a Roku. An Express. A stick. An Amazon fire stick. Whatever. Doesn't matter. That's everything your flex box is doing for a one time fee.
Firewall: pfsense.org It's free. Default settings will keep you out of trouble. Free add in packages will show you everything every device does on your network, and what protocol it uses. Goes like this:
Internet <-> modem/gateway <-> firewall <-> wifi router <-> wired/wireless devices
disable remote access
disable any filesharing (ReadyShare)
disable port forwarding
turn on the firewall. It's not a trusted firewall, but that's OK. You'll have another one too.
The only thing your modem/gateway connects to is the coax and your firewall via one hardwired ethernet port. Simple/Stupid means less to exploit. The 2nd firewall port is the internal protected network. You put your wifi router on that. You don't want to use the wifi on your gateway/modem. There are reasons for that I won't go into now.
As a bonus, you will now have precise logging capability, packet tracing, bandwidth throttling, real time network displays, and much more if you want the advanced class.
Sounds like you have some pretty good tech savvy. Way beyond my comprehension. I still find it hard to believe that soo many people are having the same issue with excess data usage because of hardware or software issues on the user end. You might be able to set up a bullet proof firewall, and have excellant monitoring capability but that wouldn't solve the issue if Comcast suddenly decided to call 1GB 2GB's. I don't think it's anything more than a change in the way they are accounting for data use. It seems to be too much of a coincidence that eveyone is getting hacked all the sudden or their equipment just suddenly went flakey.
Agreed. Exceeding 1.2TB, with some users saying over 2TB of data in 30 days and in some cases less that a week is insane without trying to do it. Even then, it would be difficult given the gear used. In a case like that, your gateway/modem should even feel hot to the point of fire concern if it's blasting 24/7.
I believe them when they say their overall traffic counters are fairly accurate given a gig or two of rounding. The problem comes from what that traffic really consists of.
Is it originating from the connection from their gear to yours? Gateway/modem link that constantly retrains, rebroadcasts and/or amplifies traffic? If that's true there is a hardware issue. That's why you want to look at the admin page on your router and look for voltage levels, signal to noise ratio, the bonded channel connection and the errors. If there are a lot of errors, your coax is bad (inside or outside of your house), your hardware is bad (bad gateway/modem), or there's something in the street between you and their gear that is bad.
If that isn't it, then the next thing is the modem/gateway itself. Firmware updates for these things are pretty rare even when there is a security exploit identified. A "patch" would take at least a quarter of QA testing before trying to deploy such a thing to millions of Xfinity devices in some kind of rolling regional deploy scheme. Some customer owned gear from other companies are not user upgradeable. If there is a firmware patch, it's delivered to Xfinity for verification and then they "Push" the update to your gateway from their network when you power cycle, IF an update is available. How long would that take? Dunno. Ask comcastTed.
Power Cycle -- yeah do that. If there is a firmware bug, I have seen gear go insane and spam incohearent traffic on networks. It won't fix the bug, but it puts it back in a known state. Do I trust consumer gateways or even high end cisco commercial gear? No. They're buggy. Patches/updates come out all the time on commercial gear, infrequently on consumer gear. They can forget settings on a power drop even and reset to insecure default settings in some cases.
An easy cheap $30 test is a hardware swap to see if your problems vanish. That, plus the previous post will identify a case where devices you own are misbehaving on your network and causing problems. You can see graphically what they are doing.
In any case, you are stuck with the bill, so if you're going to have sucess in getting a refund, it would be most helpful to have extremely detailed logs of everything that happened on your network that month, every device that connected, and graphical usage data.
It doesn't sound like people are having much luck with "Xfinity says I used data, I have no proof of my own, but it must be broken on their end". Unfortunately, more is required.
First of all, thanks for all the information you have given. Definately somethig to think about. However, with my limited technical expertise I'm probably better served not digging too deep in to administrative functions concerning my gateway operations. The last time I tried to fix internet problems I wound up without internet for two days untill I figured out what I messed up.
My gateway is fairly new (Netgear CV3700v2) and I frequently check for firmware updates manually. It always says it is up to date. Granted just because it's the latest firmware doesn't mean it's necessarily without flaws. As far as checking voltage, noise, ect,ect...I wouldn't know what I was looking at.
My only option would be to enlist the services of one of our local experts (what a joke), who probably would tell me the problem was on Comcast's end after charging me $75 to $100 for basically checking nothing of what you have suggested.
I have honestly thought of imploying the "nuclear" option and disconnecting the cable from the street to the service box but my wife would kill me. That would mean no Facebook, no Candy Crush, no tv for 48 hours, then checking to see what my data usage was for that time period. Too bad Comcast doesn't have "real time" data acounting avaiable. I would check data usage, disconnect for a few hours, reconnect and see what it revealed, but alas. I digress.
Prior to this thread, there was the terabyte usage thread which ran for 3 years. At any given point, someone was saying something to the effect of: Why did it happen to so many people right now? I think the answer (most of the time) is: They have > 30 million customers and I've seen estimates that as many as 4% use more than a terabyte a month, meaning more than 1.2 million customers. With that many, there must be a large number of people who realize they're going over for the first time at any given time.
I said "most of the time", above, because you could tell back in September that something was going on. The complaints ramped up a LOT. Apparently, Comcast could tell too because they responded and found and fixed a problem.
This time, I can't really tell. They stopped the overage reporting and charges for a couple of months for COVID and this thread basically died. Then they resumed notifying and charging and complaints resumed (as you would expect) but at possibly more than the previous rate. But I can't tell if that's just because we're catching up for several months when they weren't charging for overages (so we have several months' worth of people being notified of going over for the first time all at once), and/or if people are using more due to being home more, or if "something is going on" again. Comcast seems to believe it's not the latter.
I agree with flatlander3 that complaints along the lines of "our habits haven't changed" don't seem to go anywhere. Some years ago, the water company and I agreed that I probably had a leak. But that's as far as they wanted to get involved. There are nontechy ways of tracking data too.
I got the impression from your 9/9 message that you had gotten a result from the FCC – no?
By the way, my Netgear has its own traffic meter. The good news is that it is real- time. The bad news is that it is buggy. Still, it can be helpful if you workaround the limitations.
Since March my Xfinity data jumps like crazy --- like many other threads mentioned. Yes more people stay home during Covid19, but the jump is so dramatic that I suspect that Comcast/XFinity is conducting some nasty behavior on data usage statistics.
To debug the situation, I connected my Xfinity modem to a router, and disabled all other connections to the modem. All home devices connects through my router, that way I can have my own meter.
My observation: Xfinity is reporting 2x of my meter's data usage.
Readers of this thread, if you see similar situation, we should compare notes. I am
not 100% sure if my measurement is right, but I want to raise my suspecion. If this is true, I think Xfinity is disappoiting - I have been a loyal customer for years, and I still have some hope that they are doing the right things.
@acutsing Apologies for the issue and experience that you described above.
For August, I can see zero usage August 2 through 7 then minimal usage most of the month (under 100 gb per day most days), Much higher than normal usage on/about 8/12 (over 400 gb that day) and around 200 gb on 8/11 and 8/18 if that helps you to track this down.
*Actual data usage is not real-time and may be delayed up to 24 hours.
I've asked one of our data team supervisors to review and reach out to you to go over the experience that you described. Thanks for your patience.
We offer tools to help you track and manage your usage so there are never any surprises about how much data you use:
For all - the link below has some general information on how to avoid overage charges and tips to conserve data usage:
Providing some additional information, background and tips below from our team that does the data overage reviews.
Customer owned devices
- One example are devices like Ubiquiti uNiFi, which our team most commonly sees as an issue with data usage. The device has an internal metering system along with a periodic speed test built into it. The speed test can accrue massive amounts of data usage without reporting to its own internal metering system because it is part of its system functions, not a device using data even though it is using data. We report its usage because we monitor for all data traffic going to and from the modem/network, not per device connected to their network.
- The number and kinds of devices connected to your network matters. Suggestion is to log into your router to see and verify all the devices connected to your network" (very applicable with customer owned devices).
- Comcast does not have direct access into the metering system to the extent to be able to artificially input or output data usage results or information. Our metering system is regularly audited as well where information on it can be gathered from https://www.netforecast.com/.
It includes everything from the yearly audits to how the metering system works on a technical level. This is done third party outside of Comcast.
Comcast data metering accuracy reports at the link below:
- The metering system is delayed by up to 24 hours. "I watched my meter and it went up by 100GB in the last 3 hours and I just booted up my computer for 15 minutes!" is not accurate - the metering timeframe is not 1:1 - its delayed because it needs to validate data and remove any data that we do not count towards the metering system. This includes things like firmware updates we push out and any other possible data we may push to the network for normal operations.
- Greatest opportunity with Windows 10 devices. Windows 10 has a built in data usage meter for its own data tracking per application/software used on the device for 30 days(Settings -> Network & Internet -> Data Usage tab).
- Similarly could be done for other devices, ex: “Go into Netflix settings and make sure that it pauses after not watching it for a while”, etc.
There is no trend or consistency indicating an issue in metering, but rather these have all been unique issues per network requiring the subscriber to troubleshoot/review their network.
The common trend topic is “there is no way I can use this much data”. While the number amount of data a customer can see on the meter is more than what they know to be using, doesn’t mean it isn’t being used.
Common data users:
- Streaming devices left on even when TVs are turned off – continuously streaming and/or misconfigured settings on streaming devices
- Data backups (including cloud backups)
- Large file downloads for entertainment (video games, updates, locally downloaded movies/videos from online services, etc.) or business purposes (files of information/data for business needs, Data backups downloaded from or uploaded to, etc.)
I realize that coming to this forum and complaining about the excess data usage problem has little to no effect except in alerting others who visit this forum that others are having the same experience. As far as arguing with some comcast agent about the matter, totally a waste of time. Yes, just my word that our internet usage habits haven't changed, as far as comcast is concerned is ,a non-starter But heres the deal. We're a retired couple (just the two in our household). We were in no way affected by the COVID crisis as far as internet use was concerned. There's no one here home schooling, no one working from home suddenly, absolutely nothing different except our data usage which is up by about 30%. We are not home anymore or less than we were before. No logical explanation. PERIOD. You can set your clock by the time we get up in the morning, go to bed at night, what time the TV comes on and what time it goes off. How much time we are on the internet, and what time I'll be taking a nap.
I also have a traffic meter through netgear which, agreed is definately "buggy". But I don't need a traffic meter to tell me that our habits haven't changed. They haven't!
As to the FCC coments, after 40 some odd years battling with everything from local cable companies to mega-corps like Comcast I finally came to my senses and decided it wasn' t woth the hassle. Let the FCC do what they get paid for! The last two issues I had (one with Comcast in 2017, and another with AT&T in 2019) were both painlessly resolved through the FCC complaint process. Granted these were only issues concerning billing practices, it was still just my word against theres.
You can spend days or even weeks arguing with, being swapped from one agent to another, being put on hold for 45 minutes, mysteriously being disconnected,being made promises to that will never be kept by Comcast customer assistance,or........ spend ten minutes on line filling out an FCC complaint! 10,000 complaints that each have to be addressed individually will go a whole lot further than one little voice on the end of a telephone line. Rant over!
Apologies for the issue and the experience that you described above.
In reviewing the account, the data usage is and has been below 1 TB since September of last year. I don't see any data overage charges on the account over the past 12 months.
The usage appears fairly consistent over the past 11 months, with an average of 735 gb/month.
September to date is mostly on par with the above average.
For signal levels, I did find this: http://www.dslreports.com/faq/16085
They're pulling these values from the DOCSIS specification from what I can tell, and can get you in the ballpark. If your values are way off, that's a good start for troubleshooting the connection for issues. Your Netgear router's main page will tell you "cable connection" and say good or bad. If you click on that box, you'll get detailed information. Downstream channels will look something like this:
|Lock Status||Modulation||Channel ID||Frequency||Power||SNR||Correctables||Uncorrectables|
|Locked||QAM256||25||615000000 Hz||1.7 dBmV||40.6 dB||31||0|
Power and SNR are in range on mine for this example channel if you compare to the link.
-7 dBmV to +7 dBmV "Recommended"
For SNR, there is no upper limit, but: 256 QAM: 30 dB minimum. 33 dB or higher recommended.
Upstream channel looks like this:
|Channel||Lock Status||US Channel Type||Channel ID||Symbol Rate||Frequency||Power|
|1||Locked||ATDMA||2||5120 Ksym/sec||24000000 Hz||46.8 dBmV|
I'm in range here too.
52 dBmV maximum for A-TDMA, TDMA & SC-QAM (DOCSIS 3.0)
If your values are way off/out of spec. That's a hardware or coax issue. If there are better numbers someone from Xfinity can post, or updated numbers from the link I found, please post a correction to this post.
As far as people being home more, I was speaking in generalities with respect to why there might be more people in this thread than "average". If the COVID wasn't bad enough, now a lot of my state is on fire and its nasty outside, so some people are definitely online more than usual.
If my data use goes up, I'd like to know why. Do I have buggy software? Malware? Are my personal files going someplace unexpectedly? Not only does mysterious data use cost money, but it also competes for bandwidth/speed so I'd rather know. That's why I like to help and encourage figuring causes out when possible. In the past people on this forum have found quite a few things consuming people's data without their knowledge. And even though many of us aren't very techy, we still probably know way more about what we have in our homes than some random guy in a call center. For example, one person here found that his data use was from a buggy cryptowallet. Probably the average guy in a call center doesn't know what a cryptowallet is or that it uses data. I didn't! 🙂
You are correct. The data usage average of 735GB over the past 11 months is quite consistent by design. I have no intention for paying a data usage overage charge. As far as September usage goes you need to check your math. As of the 10th of September your usage meter is showing 390GB . According to my calculations that 39GB per day. 39Gb per day times 30 days equals 1,170 GB. My calculator also shows that an increase from 735 to 1,170 is an increase of 59.9%.
Question....? Have you been under reporting my data for the last 15 months , or are you now over reporting it. Seems like it's got to be one or the other. Facts are facts and figures sre figures,Thanks for your time.
Agreed. A bigger wallet could help , but I seriously doubt one is going to show, but maybe thousands of smaller wallets could have the same effect. I noticed fron your previous post that you had filed a complaint with BBB. I applaud your efforts but in my past experience BBB has been no more effective at resolving issues than Cocast customer service agents.. BBB seems to have morphed into an organization that is more interested in protecting big business's image than actually helping customers who employ their services. Sad!
With that being said, dealing with Comcast customer service is a total waste of time and effort. It's like trying to teach a pig to sing; in the end you'll only frustrate yourself and it really annoys the pig! Yes I'm quite convinced they are reading from a prepared script designed to absolve themselves from any responsibity and shift all the blame onto you, the end user. I feel your pain!
I have suge=gested in the past, and will continue to suggest, using the FCC complaint process. This method using a more "top down" approach, as complaints are forwarded directly to Comcast corporate. They are directed through FCC regulations to handle each complaint individually and have dedicated staff to handle such matters. This is as close as you'll ever get to "top tier" management. My point is, dealing with customer care agents will probably never get your complaint to the first level of management, much less anywhere near the top. If your complaint never reaches the top, as far as Comcast corporate is concerned, you're just a faceless account number.
So you pop out and provide the same set of information as before.
Mainly to point out that the problem is on the customer side.
From the NetForecast link you shared, it looks like we'll get the 2020 accuracy report either in 2021 or 2022.
What's of interest is that the 2018 report is not complete and there is no 2019 report.
Way to sell its usefullness.
As for looking at the past results.
I would prefer to heed some advice given to those who invest in the stock market.
"Past performance is no guarantee of future results."
Especially given that I cannot see how the 2019 data usage issue (which supposedly affected a 'small number of customers' per Comcast report) factors in the 2019 accuracy report.
Recent changes on my end:
I swapped out the XB6 (Comcast equipment which I had to pay $14 a month for) and now it looks like the data usage I see on the account page is closer to the traffic measured by my router.
Given some work related downloads that I had to make, I'm on track for about 20GB a day, which is far cry from ~40GB that I got tracked on July and August.
Whether the modem change was the root cause is not something I was going to research on.
However, during the problem months, I had restarted the XB6 multiple times (based on the static workflow from every CSR ), so it's looking like the XB6 was culprit despite being restarted.
From the Netforecast description of how it measures data, this would not be detectable, since any data from the modem would look like 'subscriber-generated IP traffic'.
I provided a BBB complaint and recently received a callback from Comcast Security.
At least that's what shows up on my caller id.
I have yet to speak with them since they of course called me when I had a day full of meetings.
Good to know you got some positive results from a hardware swap,
albeit, I'll restate my claim to others reading this post that this is NOT an issue that's exclusive to Comcast supplied equipment since I supply my own gateway. To any who are considering dumping their personnaly owned, already paid for, rent free equipment and pay Comcast an additional $14 a month I would advise to proceed with caution. I still firmly believe this is not a hardware related issue but a data recording/reporting isssue.
As to the NetForecast report I find their "about us" secton particularly revealing:
NetForecast is an independent provider of broadband performance and internet usage accuracy solutions that empower broadband service providers to improve quality of experience, increase revenue and enhance customer satisfaction.
Whose "Quality of experience, increased revenue and customer satisfacion " are they working to empower? Certainly not ours! I would have to say it's the one who signs their "paycheck". COMCAST!!!
Upon re-reading my last post, I realized that it might appear to you, or others, that I was trying to "shoot down", contradict , or otherwise disparage your comments. I assure you that was not my intention. Again, I am happy that you were able to achieve a solution and it is my sincere wish that everyone that Comcast is attempting to extort by this "farce" could achieve similar results.
I myself , however, (as well as many others) have spent countless hours troublshooting, analyzing, head scratching, monitoring systems and networks: all to no avail! For the rest of us trying to apply a "technical " solution to a "non-technical" problem has just led to an abundance of "tail chaseing" and proven utterly fruitless!
Your comment about the stock market did, however, cause a thought I've had recently to resurface. I'd be curious to know what the CFO of Comcast's "forward looking revenue report" is projecting in gains due to people ditching their privately owned hardware (at $14 a pop), paying exceess data usage fees (at God only knows what), and being forced into unlimited data plans (at an increase of $30,$40, $60 a month.) Boy, I'd really like to be a "fly on the wall" at their next corporate board meeting.
Again, apologies for my previous poorly worded post.
I got a call from the corporate office as a result of the BBB complaint. I got nowhere. The representative was a very nice person, but I wasn't going to be conviced with tech jargon and generalizations. Something is wrong. They basically look at data transfer, packets, etc., they claim the data came from my modem but cannot prove it. They said that 1000gb of data in 3 days is not alarming... They said they see it all of the time... They said a lot of irrelevant things.
I pointed out that of course they see it all of the time, because that's what these calls respond to. I emphasized that they are not supposed to tell me whether there is an anomaly based on their experience with other customers because that is generalizing. They are supposed to perform individualized analysis, look at my history and find the anomaly or issue. I have steadily, historyically, had 20-30gb of use per day. I have never used 443gb in one day or 1000gb in three days.
He also said Comcast cannot manipulate or alter data use, everything is automated, they have no control... but then said Comcast regularly underreports data use for the benefit of customers... That makes no sense. How does an automated system where Comcast has no control over the data use totals, and sends auto warnings and auto bills us for alleged overages, underreport our use? If Comcast can program their monitoring system to underreport with a math equation, it can certainly work the other way around.
Toward the end of the call, he couldn't come up with any more excuses. Basically, Comcast can report what they want and don't feel they have to prove it to you, so they can get away with it.
Next step is filing the FCC complaint, which will likely result in a call from the corporate office again. I will also send an email to as many executives at Comcast that I can find. In the meantime, we bit the bullet, downgraded speed to lower that cost, enrolled for unlimited data to avoid charges, and we are staying month to month because AT&T fiber is not too far from us. Some of my neighbors and I are trying to get them to expand their plant to our area ASAP so we can switch.
Sorry to hear you got the usual "double speak", "stonewalling" treatment. This sounds more like the tactics employed by lower level CCSA. Hopefully the FCC complaint will net better results since this is the agency that regulates them and not just a "third party" arbitration agency.
AS to their ability to manipulate the data stream, or reporting there of, how were they able to "throttle back" usage befor they employed data caps? Their conten tion , according to @ComcastTed, is their data recording is handled by an independent third party , NetForecast. Who does NetForecast get paid by? Why Comcast, of course! Typical Comcast "bull"!
The kicker is he could not explain how I was allegedly using data when my modem was unplugged. My router and all devices were disconnected from the modem overnight for about 10 hours the first night, and completely powered off for about 9 hours the following night, yet registered over 220GB of use during that period. Impossible.
I'm surprised that someone from Comcast's corporate office didn't know that their meter says it may not include data used within the last 24 hours. Therefore, data showing up within a 9-hour window where devices were turned off may not be meaningful. Now, if you shut everything down for 24 hours, (including any Xfinity TV boxes since some of them have their own modems) then recorded the baseline number, then left everything off for another 24-48 hours and still saw the data increasing then I would call that an interesting result! If it kept running along at the same rate, I would think they must have someone else's modem on your account.
Was coming here to post a new thread about why Xfinity says my data usage is so much higher than my Unifi stats are saying but I see everyone is having the same issue.
As of this writing, it's 16 days into my billing cycle. Xfinity says I've used 525 GB but on only 418 GB have passed through the WAN port between my Unifi UDM and the cable modem.
39.2 GB UP
379 GB down
The DPI WAN traffic stats to each device add up to the total that have passed through the WAN port. There's no doubt the Unifi stats are accurate. My data usage as reported by Xfinity is inflated by 25.6%!!!!!!!!!
If Xfinity is ALSO correct, then the only way that could happen is if there's more than a 100 GB of data going throgh the modem that never passes through the UDM. ICMP is disabled so it can't be millions of pings taking bandwidth.
I guess the next thing to try is to disconnect the UDM from the modem and leave the modem on and freestanding and see if the data counter incrments on Comcasts side.
And please no replies about disabling port forwarding or anything like. Those suggestions will help reduce data usage. The issue here is that the data used is not what's actually reported by Comcast. Comcast is reporting more data used than is actually used.
Suggestions that prevent data from getting into the cable modem that DON'T get into your router like potentially pings, are useful.
1. Hardware/link issues generating traffic from reconnects/rebroadcasts
2. Missing traffic / traffic you may be blind to:
From a remote location on a windows/linux/bsd/mac box, I find nmap to be an extremely useful utility. Find out how to use it: https://nmap.org/book/man.html Attack your modem/gateway's address. There are many options, and more information on various forums with examples about how to use it with a little searching. There are many types of scans and some scripting knowledge can be really useful to automate it.
The concern is that your modem/gateway isn't responding correctly to a SYN/ACK or similar type of attack and/or not counting the traffic that hits your firewall if it was blocked. Or even perhaps it doesn't count all protocols (doesn't count UDP??). Traffic counters aren't all that accurate on these cable modems/gateways. Varies with vendor.
Traffic still might actually exist even though it wasn't counted because your firewall responded incorrectly with "something" as opposed to "nothing" (how it should work). A proper firewall shouldn't tell a remote location anything. They should just hit a timeout on their end. If you find something different, it's a problem.
Try every option. Try bad tcp/ip flags. Try mangled packets even. You might find the 26%
Maybe they've improved, but you can find quite a few complaints about the inaccuracy of the unifi traffic metering on the web. To be fair, you can find complaints about the traffic metering in a lot of routers. My netgear router will seem to track the PCs fine, but do anything on the Roku and it goes crazy. For example, it says my Roku UPloaded 175,000,000 gigabytes (175 Petabytes) while watching a 30-minute show last night. (Fortunately, Comcast's meter says otherwise. :)) The Unifi routers also have a feature that causes them to run their own speed tests and they don't include that in their metering.
My automatic speed tests are turned off. I've already gone through the various lists of things to check on Unifi gateways. Even then the speed test data counts toward the WAN port counter even though it doesn't for DPI. The WAN port is not DPI. It's strictly bytes that cross that port. The inaccuracies on traffic stats are relatd to DPI. In my case they happen to match. I know in for many they haven't.
The real issue here is that the WAN port traffic doesn't match what Xfinity says. That count IS accurate. Even if my gateway is responding with something rather than nothing from some sort of attack, it will STILL count on the WAN port on my UDM. What won't count is any kind of attack that can pass into the modem that doesn't make it to the UDM via the WAN port.
Well, here we go again. Recieved a call yesterday from a Comcast agent, Brian. Not sure what department he was in . Sounded like , an IT person, not sales. Must say up front he was extremely courteous, professional, and patient. However he started by questioning me as to what actions I had taken to resolve my sudden surge in data use. I relayed to him, as best as I could remeber, the numerous actions and countless hours I had spent checking settings, running diagnosis, monotoring processes' (both OS and network related), and analyzing data as to the best of my limited ability. The end result, however, was that he would "open a ticket", I assume to run diagnosis from their end. Fair enough!
For those of you reading this post who have more tech knowledge than me here is a list of actions I have , or currently , employed:
Did a factory reset on modem and reset password ( for the third time this week)
Made sure firewalls were up and operating.
Made sure alerts were set and operating to notify when any device connected to my wifi network, as wll as high traffic alerts.
Checked security protocols ( to the best of my ability) for intrusions, hacks or malware
Checked incoming cable specs, which I really had to educate myself on, pertaing to voltage, SNR,frequency, etc. All seem to be within accepted range
Physically checked all connections and cabeling (no splitters, just a union between street and modem, all secure, home run to modem!
Hardware, software, OS related:
Disabled or uninsatalled all unused programs that can access the internet in the background without notification: youcam, one drive, skype, even deleted an old email server that I no longer use!
Checked windows update history for failed attemps, only two over the last three months and they eventually were succesfull.
Checked background processes' for any program downloading or uploading data out of the ordinary. None found.
Checked that all hardware "firmware" is up to date, ( modem, roku, playstation, printer, ect.)
Have kept all devices using wifi when not in use unplugged.
Completely shut down modem at night (no power, no data transfer)
Ran every security scan available ( norton, windows defender,ect)
I'm sure there could be lots of things I overlooked, lke I said, limited knowledge.
If anyone has any ideas, please, please, post tem, I will be forever gratefull. I'm about at my wits end!
I don’t know exactly what kind of stuff you have but a few "generic" things I would try: See if the devices themselves have any metering (Win 10 does) and, if so, see if anything looks odd. (BTW In Win 10, where you check the data, you can also set a limit.) I just noticed something "tricky". When I checked the usage of this Windows 10 machine (wired/desktop), it says 4.5GB in the last 30 days. Then I grabbed the laptop that I do most of my Skype and Zooming on and it said a ridiculously low 1.15GB. But I noticed that it was only showing wi-fi use and I always plug in for reliable conferencing. Once the ethernet was plugged in, it showed the vastly higher amount that had been used on that connection. Just something to watch out for. I think I've seen similar confusion on Android about getting wi-fi vs cellular data.
Make sure no foreign devices are connected – especially via MoCA – that one seems to have bitten quite a few people lately. (MoCA is LAN over cable and if that's enabled and there is no MoCA filter on your drop or your neighbors, your MoCA LAN may automagically merge with a neighbor's.) I see you checked Windows Update history – that's great. I assume you also checked your update settings – one Win 10 update setting that has bitten some people is update sharing. If you share with everyone, it can use Terabytes!
After that I would try some elimination. You've mentioned turning stuff off at night, but since the Xfinity meter may not include data used in the last 24 hours, that may not provide meaningful results. (Not that it's totally useless – for example if you have a streaming gizmo that just keeps streaming – it would at least take streaming at night out of your total.)
If I had a device (or two) that I suspected, I would start with that/them, otherwise I might just go to a binary search, meaning I would choose half the devices. In either case, the plan would be: shut down the device(s), wait at LEAST 24 hours, record a baseline data usage, then wait at LEAST 24 more hours (if I was serious – maybe more like a week) and then check the data again and see how it compares to "normal" (ie all devices on.)
If you shutdown one suspect device, then you use the data to confirm your suspicion (or not.) If it's a binary search, then you should get an idea of whether the "offending device(s)" are in the half that were shutdown or not. Then, whichever half is now suspect, you do the same test with half of those shut down, until you get down to one device.
Alternatively, flatlander3's way would get results faster, if you happen to understand the stuff he's talking about and have some spare equipment. If not, it may take longer to learn.
I would be suspicious of the playstation only because I have heard of 100GB game updates.
Unfortunately, in addition to the above, there are still certain mysterious (to me at least) cases where someone said they got a different modem/gateway and their extreme data use went away. I don’t know how that happens or how to detect it other than replacing the device!
Hey, thanks for the speedy reply.
My network is pretty extensive consisiting of: Desktop (Windows 10), Laptop: (Windows 8.1),
Android tablet, 2 Roku devices, Xfinity Flex box, Smart Blu Ray, network printer, PS4, and 2 Android phones. I know that sounds like a lot of junk but about half of it is hardly being used and stays mostly shut down.
I have checked data use through Windows 10 and it reads as follows: Ethernet 63MB over the last thirty days(not a typo,MB not GB) Wireless <1MB last thirty days. The majority of use would be through the wireless connection which implies that this function does not record wireless data since this computer running Windows ten is on an ethernet connection. Don't know, kinda confusing. Incidently sharing is turned off so no chance of torrent bit sharing of updates.
I have already done, basically, what you described as binary. When I noticed data suddenly spiking this month I systematically began shutting down devices for well over a week now. I monitor the netwok map multiple times a day to check for devices connecting to the network and have alerts set to notify me when they do, so i definately know what is connected when. The playstaion in question has internet connection turned off since majority of gaming is done off-line, plus it is blocked from connecting to the internet for downloads without permission. No background downloads! So recently, Flex box , smart blu ray, network printer, and playstaion have no access to wifi and no changes in data use have been revealed which tells me if there is a problem on my end it's not on any of these devices. Next step will be the android phones which is not a big issue since we can use the data off our plan, although we "cheaped out" on our data plan since we are home most of the time and can use wifi. After that it's on to the roku's. If that don't work I guess we'll have to drop back and "punt".
Thnaks again for all your help.
"What won't count is any kind of attack that can pass into the modem that doesn't make it to the UDM via the WAN port. "
Yeah. That's exactly one of the situtations that I'm trying to trip up with a gateway/modem that connects directly to a firewall port. I have a seperate box with 2 ethernet ports. External firewall network interface goes directly to the gateway/modem (the hive of scum and villainy that is the comcast network). The firewall box -- which is just a BSD OS running the ole BSD version of pf(4). And an internal network interface on that box connects to everything else. Put your wan port on your Unifi gear on that.
So pretty much, I figure the firewall on the gateway/modem is junk. It's going to get a remote exploit at some point. It may not handle traffic correctly to a port I can't do anything with. Maybe it doesn't deal with a portscan well and they can exhaust its resources remotely and "tip it over" by some means. Dunno. The little counter page on the gateway/modem - I know that's not accurate. Transfer some known size traffic at it on yours and see if yours counts it correctly, you may be surprised.
Theory goes like this: So say the gateway/modem may be actually masking traffic for whatever reason. It's not counting right. And I'm 26% off. The traffic is real, it's not friendly, I can't see it. How do you get the remote script to dump, stop banging on my gateway/modem and move on to someone else?
Welp. Most of the scum and villiany I see are script kids running megasploit or some script they found on the web. How do you mess em up.....erm.....legally? Open a couple of ports from the gateway and forward them to the firewall. Pick a low one, and a high one. Doesn't matter what you pick.
Now install Snort. You can make dynamic rule sets yourself with pf(4) or ipchains...etc, but it's a lot of work. Snort creates them for you, and can automatically remove rules after a set time period (if you want), and you pick what kind of traffic is allowed or not.
Great. Let's say you got port 83 and 8050 open on your gateway. On a portscan -- which is the most common, they hit the port, it goes to the firewall and immediately sticks since you have no running service. The remote script hangs when that happens. Sometimes for a really long time if they don't have error handling. That's fine. Eventually their script times out and you're done with min traffic exchanged -- they were looking for a port, didn't find the droids they were looking for. It's done.
As a bonus, Snort clobbered the IP address the attack came from, so if anything on your network did take traffic from the remote location, it's cut off -- forever if you want. An hour. Days. Whatever. You don't want to talk to them if they hit your honeypot ports.
Say for example, there is a known exploit on your gateway/modem and they tipped it over. They did on an old DSL Zytel I had on CenturyLink. What do they do next? Open up all the ports looking for stuff. You don't care though, all other ports just hit your firewall and get dynamically blocked by Snort. Neat.
Does it work? Yeah. My traffic went down by 1/4 immediately. With some traffic shaping, I can cut that to 1/3 of what I was using before. I also found some oddities on my gear too. Foscam cameras like to spew UDP looking for myfoscam.com for example. Other things I don't like -- now I can block. No, Microsoft doesn't need to know if I have a printer every 2 minutes.....gahd.....
Dunno. Works for me. Advice is cheap.
16.75 days into billing cycle. 562 GB reported by Xfinity.
WAN port going straight to modem 44.2 GB up / 411.2 GB down = 455.4 GB = 23.4 % inflated so it's narrowed a little bit.
If you're looking at the data usage through the Network & Internet Setings box, then you may have to change the connection when looking at the data usage settings.
My desktop can handle both wires and wireless.
I started to use wireless via Hotspot when I was close to 1.2TB and noticed that I had to manually select the wireless interface to get its data usage.
Windows 10 was definitely recording wireless data usage for me and it was different than what was recorded for the wired ethernet jack.
Does anyone know of a way to limit bandwidth to individual wifi devices other than Qos. I checked my router and it doesn't offer that function. Preferably a cheap, or better yet free, program that works with Windows 10 connected via ethernet. Since talking to Comcast agent the other day it's sent me into "full blown" seek and destroy mode. I'm freaking determined they're gonna prove me wrong or I'm gonna prove them wrong. This "hangin' in limbo junk is for the birds.
I am having the same issue, it is recent for me and has to do with large upload streams being detected (falsely I am pretty sure) than for whatever reason Comcast locks the connection aka you go offline. I am just about to graduate with my second Computer Science degree so it takes a lot for me to give in and call Comcast, knowing they are going to read from a script and not listen to a word I say. I was on the phone for 2 hours the other day, I had been transferred from department to department, Comcast stall method, every time having to explain all over again what was going on even though the person that transferred me assured they had fully explained the situation to the person is was being transferred to. I ran a tracert, which is a command you can enter in your CMD, similar to ping, but this traces the route of a packet. I received an error code, which I have never senn before and was going trying to telling the agent but they just brushed me off and transfered me again. I was originally told that the issue was that I was marked for copyright infringement, which is 100% BS. If I wanted to download 'illegal' torrents aka Movies I know how to use a VPN, but that's not what caused it because I had not downloaded anything except the program Bitorrent which I needed it to download an ISO image for a Virtual Machine for one of my classes. They marked the program 'Copyright Infringment' or so they say that's what the issue was (after having us get a new router) and still this morning just trying to update the apps on my phone causes it to drop out. It seems to be tied to large upstreams of data which may or may not be inflated. I just looked at my data after reading your comment and went from ~1000Gb a month for June/July to 1600 in August and already 800 for September. I honestly can not say if the August and September numbers are inflated, I will pay attention from now on, but like I said I am studying/working in Computer Information Systems, which all happens from home nowadays so those numbers could be right, regardless the problem persists. I have noticed that if you hard reset the router it works, until about 6am. I saw someone mention @EG and that you were able to help them with a similar issue. Any advice?
You're welcome @Bugg2! It looks like you're doing a lot of great debugging. If you don't happen to find an issue on your end, you will have a lot of data for the FCC/Comcast investigation. It has been my experience that the more data you have when you call for help, the better things tend to go.
Yep my internet data usage shot way up over the past couple of months. Not much change in our actual usage either. Rigth now I am trying to find out how to add the unlimited data because I don't want to get a whopping bill should I go over the data cap. There is something wrong when I see others saying the same thing.
There has not been a fix for the spike in data usage that many have experienced this month. My data usage tripled in September for no apparent reason I have been able to find thus far - never have gotten close to the data cap since it was raised to 1 TB. Always have been using about 350 GB. I have called Comcast several times in the past few days and am not getting any closer to a resolution for this issue and I have little time left to solve it before I am forced to go to an unlimited plan or cancel service and go back to the low speed data plan I had before.
My September data usage has gone over the limit of 1.2TB today. Normally it has been around 700 gb or less. I do have streaming services like Netflix, Amazon Prime Video and YouTube TV amongst others. How do I know if the usage this month is legit? We have two TVs. The watching habits since the start of the pandemic have not changed.
Sounds like you're describing our situation. We too are steaming on two tv"s for about the last 15 months. Our average data use has been in the low to mid 700"s. This month , with nine days left in the month, we're showing 743 Gigs and that's with having cut back on daily tv watching a couple of hours a day after noticing the increased data use earlier in the month.
One thing I have noticed, while doing real-time monitoring, is that Xfinity Flex box streaming Peacock network uses almost twice as much data as it does when streaming Peacock on a Roku device (set it up and checked it last night), that's with resolution set at 720 on both devices! With that being said, for about the last two weeks I keep the Flex box UNPLUGGED!
I realize that my self-imposed "throttling back" is not a reasonable solution, nor does it explain the excess data usage, but I'm employing every method I can to keep from exceeding my data cap before I recieve some kind of explanation from Comcast!
I started exiting out of any app (Netflix, Amazon, YouTube TV etc.) that we are watching before turning off the TV. Both the TVs we have are smart TVs. Would it make any diffrence if we started watching apps going through XBox or Roku? Someone suggested that. I have not adjusted to 720 from 1020 yet.