In the last year or so things have changed dramatically mainly due to Win10 and more recently the way that Microsoft delivers updates to not only Win10 but also Win7, 8, and 8.1
The following is a repost of a previous reply but I think it will give you a sense of direction:
The first question is: "Is the leak on the Hughes side of things or on my side of things?"
The Hughes modem is in constant contact with the Hughes Gateway facility. That traffic between them is known as "chatter" and is classified as "overhead" and is not charged against a users data allowance.
The Modem Isolation Test that Liz linked to is designed to 100% positively exclude every piece of the subscribers equipment from being able to connect AT ALL.
The procedure looks like this:
It is pretty straight forward:
1: Take a screenshot of the status meter
2: Disconnect the LAN cable from the rear of the modem
3: Note the time of disconnect
4: Wait a period of time ... overnight perhaps
5: Reconnect the LAN cable
6: Take another screenshot of the status meter
7: Note the time of the reconnection
8: Review the results:
Look at the before/after screenshots of the status meter. Was any meaningful amount of data used ?
If yes, post the two status meter screenshots as well as the disconnect/reconnect times and the forum Mods will take the issue from there.
If no data was used during the disconnect period then we can only conclude that something on your network, seen or unseen, is using the data.
In that event post back to this topic and we will proceed to assist you in finding the cause of the leak.
The above is the first step. It answers: "Is it Hughes or is it me?"
When the Ethernet cable at the rear of the modem is disconnected all that is left is the "Hughes Loop":
All of the data used, if any, other than minor amounts that hadn't caught up with the usage meter yet has to be on the Hughes end.
If no meaningful usage was recorded then we have to conclude that the usage is being used on the user's end of the Network. We just don't know Who, What, When & Where yet.
To that end we have to have some insight as to what a "Network" is and the "shape" of it .. the number of connection paths that exist.
In the Way Back When ..... a residential subscriber's "Network" would look like this:
Even the above is more complex than at first meets the eye. A single computer has 65,536 comm ports that can potentially connect to the internet.
Some of those are going to be very visible. Port 80 is used by browsers. You can "see" that the browser is open, that the browser "program" is up and running. If we open an email client program such as Thunderbird we can "see" the program running and we know that two more ports are connected, one each for incoming and outgoing mail server connections.
That leaves thousands upon thousands of ports that can connect unseen in the background and not only consume data but cause programs that we know are running to appear to run slowly because of the concurrent connections.
Now the above is on a single directly connected computer. Any data usage is going to be confined to this single machine .. but this single computer has a much larger "territorial surface" than many users are aware of.
In addition to the above from the Way Back When the internet has undergone some drastic changes. Webpages are no longer static text based web pages but are instead very complex sites made up of many "modules" that contain auto-start videos, auto-refresh graphics often in high resolution, numerous scripts and a host of other little details that use data like mad.
The only real way to tell what is running ... forefront and background is with a program like Glasswire.
Glasswire will ID every program and process running ON THE SINGLE WINDOWS BASED COMPUTER upon which it is installed.
This is going to work very well for the above shaped "Network", that being a single computer connected directly to the modem.
In the past "Networks" were simple, the internet was less "intensive" and the majority of Hughes users were somewhat "Geeky".
It used to be that anything more complex than that shown in the above example was related to businesses. Those businesses knew their personal limits and contracted for Network setup and administration. They had their own "IT Departments".
Residential routers came on the scene and they allowed users to add more and more devices. Each of those devices multiplied the number of potential leaks. All of the above .. per device ....
The complexity really multiplied but the knowledge of the average user did not keep pace.
Lets look at what a typical user "Network" looks like today:
The number of "connection paths" has skyrocketed and along with it the potential for "leaks"
Lets look closer at a router:
A router consists of three potential traffic areas:
#1: Its firmware/hardware:
This would include automatic update checks, Remote Access accounts/vulnerabilities, WPS settings/vulnerabilities and "front end" username/password setup to name a few.
#2: Wired LAN connections and the types of devices connected as well as their settings. Specifically end users not understanding the differences between "hard off", "sleep" and "hibernate" as well as other system settings such as Wake On LAN, Wake On Ring and even extending to "scheduled tasks".
We need not even go into the details of forced updates and data "sharing" inherent to Win10 and being back ported to Win7/8/8.1
#3: We come to the most difficult to control ... Wireless activity
We can start with what encryption level, if any, has been set up. We also need to consider the username and password that limits access to the routers front end so that unauthorized users can add themselves to the wireless users list. It needs to be changed from the default values.
We also have the multitude of settings of the many types of devices that can connect wirelessly be they computers, notebooks, tablets, cell phones or even thermostats.
It is often not apparent when all apps on all devices have had their update ability turned off. Very frequently an update will cause other settings to change to their default values.
Considering the number of "connection avenues" provided by a router it is mandatory that it be included in any troubleshooting steps ...
If you are missing data:
First run a modem isolation test to see if the fault is with the modem
If not, then simplify you "Network" by removing the router during the troubleshooting phase and install Glasswire.
If you insist on not removing the router then replace the router with one that will track data usage per device.
Here are some screenshots of my Asus RT-AC3100:
Finding leaks is not easy.
Divide and Conquer is the name of the game.
The brand of my router is an Asus. The model I have is a RT-AC3100.
Not all models have that feature so look for one that has the Traffic Analyzer function.
Windows7 has a built it program to take screenshots. It called Snipping Tool.
You can learn how to use the Snipping Tool here: