I've noticed that I've been literally burning through data lately again, similar to what I noticed about a year ago, where data usage seems to be twice as much as what you think you're using, or more.
Either it's a change in the compression scheme, something causing packet resends between here and the gateway, or a couple of other paranoid theories I've had for a while that might explain some external phantom usage:
Basically it has to do with bittorrent like protocols, where someone from the network might be excessively pinging your public IP, forcing data usage. If someone else using the IP 'shared' files it's very possible that other(s) have that IP stored from a recent session and are trying to reconnect. Might be your bad luck that you were assigned that IP. Forcing a new dynamic IP assignment from a reboot should alleviate something like that, but hasn't really for the most part.
Similarly, it could also be people probing known HN IP ranges with unblocked ports. Noticed this happens when spam levels tend to rise - basically unscrupulous people looking for ways to hack into unprotected servers to implant spam bots. Spam levels have been up and down erratic for a while now.
I prefer to blame one of the sketchy iOS games my wife plays on her phone (Cascade?), although I think that's not really it.
Whatever caused it, I hope it doesn't happen again, but I'm going to keep my eye on it, that's for sure.
What does Glasswire indicate the traffic locally is for? Have you tried Wireshark? I think maybe comparing hour-by-hour might lead to some clues also.
~Amanda
Amandawrote:What does Glasswire indicate the traffic locally is for? Have you tried Wireshark? I think maybe comparing hour-by-hour might lead to some clues also.
~Amanda
On that particular day (and set to the same time I took the original pic), Glasswire only shows 2.1MB of local data, with the majority of it (1.6MB) being used when signing in to the router via Chrome. Since 12:00AM on the 5th, my local traffic has totalled 14.1MB. If I misinterpreted your question, I apologize.
Right now, my totals are as follows:
HughesNet (Usage page on MyAccount site): 2775MB (1581MB Anytime and 1194MB Bonus)
Netgear Router: 2549MB
Glasswire: 2.1GB. Glasswire can't be relied on at this point due to it not including my cell phone used through WiFi.
So, the difference between HughesNet and the Netgear Router is 226MB, which is close to the norm, at this point, when subtracting most of that 40MB+ difference at the beginning. The discrepancy has been generally been around 7%, so I'm okay with that, as that much difference could just be chalked up to differences in the way the data is tabulated, or even within the margin of error on both accounts. What happened at the beginning, though, didn't make sense, but it's hasn't happened since those first hours. I wonder if what Mark suggested could have been the cause.
Ah, sort of what I meant. I figure if you have a 4 hour window of where this occurs, you can compare side-by-side the hourly usage displayed on the HughesNet side vs the Glasswire side.
Mark's suggestion would make sense only if the "handed over" traffic was UDP. Maybe. In any case your IP address changes very often so if it was the case it wouldn't be much. I have a tinfoil theory of my own, however. I searched but didn't find a solid answer - Netgear and Glasswire are reading/displaying the MB out using binary (base2) or decimal (base10)? Not a huge difference in totals but worth a look..
My even bigger tinfoil theory is that it's possible that Netgear/Glasswire are misreporting external as internal or something even crazier like not including IPv6 traffic.
~Amanda
