In my continuing investigation of my data usage problems. I'm now using wireshark. Fascinating, but an overwhelming amount of information.
It seems that turning off my wifi causes Linux to send out "standard query" messages looking for the printer every few seconds. Can't believe this would effect my data usage though.
Then there's this:
49 2018-06-28 10:31:21.818922197 HughesNe_b2:81:cf Compulab_18:af:9a ARP 60 Who has 192.168.42.103? Tell 192.168.42.1
Frame 49: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0Ethernet II, Src: HughesNe_b2:81:cf (00:80:ae:b2:81:cf), Dst: Compulab_18:af:9a (00:01:c0:18:af:9a)Address Resolution Protocol (request)
50 2018-06-28 10:31:21.818967862 Compulab_18:af:9a HughesNe_b2:81:cf ARP 42 192.168.42.103 is at 00:01:c0:18:af:9a
192.168.42.103 is my computer.
Looks to me like that could be coming over the satellite link from HughesNet, or is it just coming from the modem? Not many bytes, but there a lot of these messages.