Hughesnet Community

data drain....cannot find the cause

cancel
Showing results for 
Search instead for 
Did you mean: 
yorkytime1
New Poster

data drain....cannot find the cause

I know this is a common problem.  Suddenly I am having daily data drain.....just today over 200mb in less than two hours.  I am a legacy customer and cannot sustain this type of data loss.  I have the free versions of glasswire and networx installed but just cannot find the reason for data drain.  Please somebody help me figure this out.  I know that certain routers have been suggested in the past....but I just do not have the data available to do constant search to find the correct messages.  Can anyone help me solve this issue.  PLEASE!
52 REPLIES 52
Gwalk900
Honorary Alumnus

Repost but applies I think:


There can be many reasons for losing data. In the end though it can only be either on the Hughes end or on the users end,

You should run a modem isolation test to see if it is on the Hughes end,

Here is the official graphic:

Follow the steps above and post screenshots of the before/after usage meter and the disconnect/connect times.

If you find that no usage occurs with all of your networked equipment disconnected we have to conclude that the usage is caused by something within your network.


While the following is a repost I think the steps apply to your situation as well:


In the event that no data was used during that period we can only conclude that "something" "somewhere" within your network is using data. It then becomes a "whodunit" and there are methods to determine that.

Divide and Conquer is the name of the game ... and it is essential.

A typical "home network" looks like this:


It is much too complicated to determine the "leak"

The Modem has access ... but we already performed an isolation test

The Router "guts" have access

Anything and everything with wireless range .. both authorize AND unauthorized devices COULD have access

Finally all wired computers have access.


During the troubleshooting phase the "network" MUST be reduced to the minimum number of variables.

It needs to have the router removed from the equation so as to look like this:

The number of variables has been brought down to a manageable level.


It now is time to download and install some software to track usage and identify what program and what process is or has been running and using data.

For this we need Glasswire:

https://www.glasswire.com/ help/

An important point here .....

GlassWire will only monitor the single computer upon which it is installed.

Later as the router is reintroduced, GlassWire will have to be installed on every Windows computer that is connected to the router


Another point to be made here is that if Windows IS the root of the issue ... it uploads/downloads sporadically .. it may take time to "catch it in the act".

So as to not "torque" the amount of usage displayed by GlassWire we need to change a couple of settings ... we don't need to count (later on when more devices are connected) "local" traffic.

Here are my suggested settings:

(click on picture for larger image)


Understanding the results:


Each computer, one by one needs to go through this process.

Once all wired computers have been "cleared" we can add the router back in to the mix with one major exception .... we have to disable the "radio" ...

We then want to test the "network" consisting of all "cleared" wired devices and the router "guts" to ensure they work well together as a whole.

Now comes the stickey part the re-introduction of the routers wireless function.

Its tough because I know of no software that will load on the variety of devices that CAN connect ... cell phone, tablet and so forth.

On laptop computers you can od course load GlassWire but that still leaves many potential avenues open.

The "Poor Mans" method requires great discipline. ALL devices other than a single one have to be and remain in a "hard off" state and that is not easy to do.

Run that single device over time and monitor usage carefully while still running Glasswire and the "difference" is ... the amount used by THAT device.

Of the devices ... Apple stuff is probably the worst ... VERY large updates on a random basis and the updates are very prone to "break" during download causing them to restart from the beginning ... massive data loss there.

It is essential that the router be properly set up !

Guest access MUST be disabled in the routers internal GUI

No "open network" :  

WPA-PSK [TKIP] encryption at the very minimu m !

Clear all devices one by one with the understanding that the usage may be sporadic.

There are higher end routers that WILL track usage by individual device but these may be out of reach (about $200) for the casual user. That is the only way to be SURE of what is going through a network.


There are a number of Routers available that with the inclusion of third party firmware will allow a user to track usage by device within the Routers interface.

That would include these Asus Routers:






                   

yorkytime1
New Poster

First I am NOT trying to blame hughesnet for the drainage.  Second I have performed nearly every test named above!  Many of the tests above cannot be performed with the legacy system....as the hughes meter does not work well with legacy customers.  So i simply refuse to go through that process yet one more time.  We have a fairly SIMPLE setup here.....NO WIRED COMPUTERS....only a wireless router and hughesnet modem.  As I speak....type data is just disappearing from my meter...has been doing this for about a week.  This laptop is the ONLY device connected to the router at this time...actually all morning.  Just so damn frustrating to not be able to find what is the program or file that is downloading data!!!!!!!!!!
yorkytime1
New Poster

What would be the brand name of some of these routers?  I know the ASUS will track....but my understanding is with third party firmware.  Are there any OFF THE SHELF routers that will track all traffic through the router?  

<There are higher end routers that WILL track usage by individual device but these may be out of reach (about $200) for the casual user. That is the only way to be SURE of what is going through a network.>
Gwalk900
Honorary Alumnus

You can skip the modem isolation test then but you can still log into your dashboard and see a data meter.

You can still follow the steps as to router settings such as encryption levels.

You can still install GlassWire on that laptop.
yorkytime1
New Poster

Trying to examine all options below.......

We then want to test the "network" consisting of all "cleared" wired devices and the router "guts" to ensure they work well together as a whole.
all wired devices cleared....there are none!

Now comes the stickey part the re-introduction of the routers wireless function.

Its tough because I know of no software that will load on the variety of devices that CAN connect ... cell phone, tablet and so forth.

This is the greatest part of my frustration.....I am constantly checking phones, tablet (1) and that damn kindle hubby uses.  All are kept in off connect unless being used at that moment.

On laptop computers you can od course load GlassWire but that still leaves many potential avenues open.

for the most part GlassWire is a strange animal to me.  I cannot decipher exactly what it is telling me.  Free Glasswire installed on this laptop....not sure I want to spend the $99 for the pro version since it can only monitor at the computer or device level.

The "Poor Mans" method requires great discipline. ALL devices other than a single one have to be and remain in a "hard off" state and that is not easy to do.

yes tell me about it.....poor mans method not working well for us.....THERE ARE ONLY TWO LIVING IN THIS HOME.  Check for "hard off" state becomes tiring. 

Run that single device over time and monitor usage carefully while still running Glasswire and the "difference" is ... the amount used by THAT device.

I have been running this laptop as single device for almost a week....problem might be here but just cannot find it.

Of the devices ... Apple stuff is probably the worst ... VERY large updates on a random basis and the updates are very prone to "break" during download causing them to restart from the beginning ... massive data loss there.

no apple stuff in this house.

It is essential that the router be properly set up !

Guest access MUST be disabled in the routers internal GUI

no guest accounts allowed

No "open network" :  

NO Open network

WPA-PSK [TKIP] encryption at the very minimu m !

not sure about this.....network config says "AES".  TKIP is an option but not enabled.  ????

Clear all devices one by one with the understanding that the usage may be sporadic.

yorkytime1
New Poster

ok will try to log into dashboard.  Now I'm thinking encryption might be incorrect.  I do have glasswire install....but just do not know how to read what it is telling me.....color me a dumby....i tried to use glasswire before and still don't know.
yorkytime1
New Poster

I could not get a photo copy.....this is text copy of my usage meter this morning.  


Internet Usage
Your Internet usage at a glance:Plan Allowance
Remaining

Anytime500 MBAnytime328 MBBonus100%Bonus100% Token ManagementDownload Allowance

65%
328.0 MB Remaining

Bonus Bytes
100%
100% Remaining

Token Bytes Available : 652 MB
There are 1 days left in your Data Allowance cycle. 
Your Data Allowance will be refilled on August 11, 2016. 
Your token bytes will automatically be utilized when your Download Allowance bucket is depleted.
Gwalk900
Honorary Alumnus

I'm on my tablet at the moment so I don't have access to my normal stock of "stuff " but I do have a How-To write up on using Glasswire and I'll post that for you in the am.
yorkytime1
New Poster

ok thanks
Gwalk900
Honorary Alumnus

In the meantime you may wish to read my topic here that has some Glasswire info:
https://community.myhughesnet.com/hug...
Gwalk900
Honorary Alumnus

Hi Yorkytime,

"This is the greatest part of my frustration.....I am constantly checking phones, tablet (1) and that damn kindle hubby uses.  All are kept in off connect unless being used at that moment."

It is those wireless devices that are the hardest to tame.

When I bring my Samsung Galaxy Tab4 home from work to charge it up it always manages to use some data despite having gone through its settings.

One thought: Do you have a networked wireless printer connected ? Those are easily overlooked and can use a ton of data if not completely "tamed" ?


"I have been running this laptop as single device for almost a week....problem might be here but just cannot find it."

What operating system are you using ?

Microsoft is releasing the Win10 Anniversary update and it is huge at around 3-4 GB. That would occur as a background process.

Personally I would give some thought to changing the routers WPS-PSK passkey/passphrase and installing it in only the laptop at this time. That way ALL other devices are excluded until added in one by one.

The only issue to that is you may wish to have an Ethernet cable around (or use the one between the Modem and the Router) because the laptop will lose access to the wireless Network which would include the Router's interface when you change passkeys.

On to GlassWire:

I suggest the following base settings:

(click on picture for larger image)


Looking at results:


Defining a usage period and getting into details of a program or process:

(note highlighted buttons and tabs that control "view")


Continued view settings:

The 23rd:

Note that I have reset the "sliders" to define the period to the 23rd.

This shows a total of 342.9 MB used by this machine, out of a total claimed by Hughes of 597 on that day. We know that overall our numbers have been account for so the difference was used by the "other" devices.


A look at the column on the left show what programs and processes used data:

Note that the "ALL TRAFFIC" at the time is "active" to that the result of "ALL TRAFFIC" is displayed in the larger window to the right:



Going back here for a moment:

Be aware that if you click on one of the listed items, grater detail of that item will appear in the right hand window.

In this case HTTP (browser usage) is the BIG USER of that day.


Try to get some screenshots,

If you have trouble or don't know how just post back and wee will work through it.


Chris11
Alum

Hi Yorkytime,

Thanks for posting. I hope our community members were able to help you get a handle of your data usage. If you have anymore questions or concerns feel free to let us know.

Thank you,
Chris
yorkytime1
New Poster

I don't know Chris.  I've done just about everything I can think of to find the data leak.  And still losing data.  Turned on the computer this morning......opened this page and I'm down almost 50 MB.  I haven't had time to play with Glasswire yet.  I just don't get it.  I'm so tired of fighting with my Hughes modem.  I've been with Hughes a long time.....but it might be time for me to look for other means of connecting to the Internet.  Just so frustrating.  This all started about a week or little more ago.  It is just a constant drain.  Nothing that I can find has changed on my end.
Gwalk900
Honorary Alumnus

 I haven't had time to play with Glasswire yet.  I just don't get it.

Let me see if I can help step you through this.

I am going to post 4 pictures of the same view.

In those pictures I am going to label the steps needed to get useful information.


Open GlassWire:


Next I want your to follow through with the four steps that are labeled in the view below:

(CLICK ON PICTUE FOR LARGER IMAGE)

#1: Select the "usage" tab

#2: Select the "Apps" button

#3: Select the "Week" display range

#4: Move the "sliders" to select a time period from within that week.

If you wish to examine a time period further back than the current week select "Month" in step #3 and then use the sliders to define a period of time within that month.


Once the period has been defined the programs and processes that used data will be listed in the box on the left hand side of the display:

The largest user will be at the top of the list.


The details of the connections are listed in the larger area on the right of the screen


Once you find an area of usage that you believe is eating your data, post a screenshot here in Community and I'll help you determine what is.

Just follow the steps as outlined.

GabeU
Distinguished Professor IV

yorkytime,

There's one thing you've got to take into account, and if you already have, disregard this.  The Status Meter, the meter at the SCC, and the meter when you log in to the dashboard can't be counted on to be in real time, up to the minute, especially the Status Meter.  It can take several minutes for it to catch up.  With that being said, it's not at all unusual for the data reading at shutdown to NOT match the data reading at startup.  This is why it's a good idea to wait until a few minutes after cessation of your internet activities to take a reading.  Of course, if something is still operating without your knowledge, waiting wouldn't make a bit of difference.   

I don't know what OS you have, but I remember when I had my Windows 7 and then Windows 8.1 computer connected to my legacy plan, just with them connecting at startup used about 15MB to 25MB.  I don't know exactly what they were doing, as I had my updates set to manual, but they were checking something. 

And, as Gwalk stated, the wireless devices can be REAL tricky to figure out and tame.  Time and time again on here you see people, after just about pulling their hair out with trying to figure out what's going on, finally finding that it was their iPhone or iPad or something of that nature downloading or uploading to the cloud or something.

I feel for you, as I know from these boards that trying to find what's using the data can be a really frustrating thing to do.   

Gwalk900
Honorary Alumnus

Gabe, as I recall she has Win7.

She also has a 9000 system on a daily legacy plan that is going to complicate remaining usage due to "roll-over".

What data remains at 2am when her un-metered "free zone" starts is then saved and added to here next days allowance that is applied around 6am even though free zone is in effect until 7am for this plan type.

Frankly I suspect Win7 being at the root of this. There are a list of KB's to be avoided as long as your arm. Some of those cause Win7/8/8.1 to emulate the "telemetry" behavior of Win10.



GabeU
Distinguished Professor IV

Gwalk,

I didn't even think about the telemetry.  That would probably explain at least some of that initial usage every morning when I would start the computer. 

When I had my HNS7000 it was daily.  None of the "two day meter" thing.  Did the 9000 systems have the rollover for a long time, or is it something that was recently implemented?  I've seen people talking about it being a two day thing on here, receiving your full days amount every day, but it only adding 50% to the "meter". 

Gwalk900
Honorary Alumnus

9000 legacy had the roll-over since inception

I had roll-over on my 7000 but it was only implemented on just a few transponders on just two satellites.

Try to imagine staying on top of "remaining data" with a hourly drip refill, free zone and roll-over.


Here is a list of updates to avoid:


List of questionable or 'do not install' updates:
============================

KB2952664 ? Compatibility update for upgrading Windows 7
»support.microsoft.com/en ··· /2952664

KB2966583 ? Improvements for the System Update Readiness Tool in Windows 7 and Windows Server 2008 R2
»support.microsoft.com/en ··· /2966583

KB3021917 o Update to Windows 7 SP1 for performance improvements (telemetry!)
»support.microsoft.com/en ··· /3021917

KB3035583 - Hell no - Update installs Get Windows 10 app in Windows 8.1 and Windows 7 SP1
»support.microsoft.com/en ··· /3035583

KB3068708 - Update for customer experience and diagnostic telemetry
»support.microsoft.com/en ··· /3068708

KB3075249 - Update that adds telemetry points to consent.exe in Windows 8.1 and Windows 7
»support.microsoft.com/en ··· /3075249

KB3080149 - Update for customer experience and diagnostic telemetry
»support.microsoft.com/en ··· /3080149

KB3123862 - Updated capabilities to upgrade Windows 8.1 and Windows 7
»support.microsoft.com/en ··· /3123862

KB3135445 ? Windows Update Client for Windows 7 and Windows Server 2008 R2: February 2016
»support.microsoft.com/en ··· /3135445

KB3138612 ? Windows Update Client for Windows 7 and Windows Server 2008 R2: March 2016
»support.microsoft.com/en ··· /3138612

KB3173040 - Hell no - Windows 8.1 and Windows 7 SP1 end of free upgrade offer notification
»support.microsoft.com/en ··· /3173040

KB971033 o Update for Windows Activation Technologies
»support.microsoft.com/en ··· b/971033


The thing of it is, they keep coming back.



Chris11
Alum

Hello Yorkytime,

There's a great step by step guide that our community members are providing to help in understanding glasswire. That is going to be the best way to clearly see what is using data on your computer. 

- Chris
yorkytime1
New Poster

Well I'm back!  gwalk I have been trying to work with glasswire.  Yes I agree seems to be a great way to trace usage.  I am still using the free version so cannot set the usage alerts yet nor the network devices. 

Anyway back to glasswire.  I do understand just about the whole program.  But still have one issue.  I understand setting the dates with photo you provided and the sliders for setting the time period.  My problem is this.....my legacy period is from 7:00am to 2:00am.  At 2am I am in the free zone.  The rollover occurs just before 7am.  I cannot set the sliders to cross over the date into the next morning at 2am.  I guess I could just not count the 2 hours after midnight. 

Is there anyway to permanently set the periods or is this always manual?

My husband gets up at 4:00am and does most of his updates and downloads during the free period so I do not want to count those hours in my data usage.  I am trying to solve this issues before purchase of the glasswire program as I will need the $99 one for three computers.

OH MOST IMPORTANT.  My data drain has mysteriously just disappeared.  I did not do anything,  did not change anything,  it just stopped the major data drain.  ???