@Sweetpea3829 I noticed that some fellow users made suggestions and you never commented on them ... installing Glasswire for example. This makes me a little reluctant to enter the fray but ........... I understand your issue to be accelerated data usage, primarily during the latter part of your usage cycle. So lets look at how data usage is recorded and reported: Data "Traffic" takes a couple of different forms: > Command & Control < > User data including upload and download from both the wired and wireless portions of the Modem < Command & Control is NOT charged against your data allowance Download, Upload and re-transmission of data IS charged against your allowance. So we have TWO different levels of communication between the modem and the Gateway going on. When the Modem is powered on and there are no issues such as weather at either the user end or the Gateway end the Modem will tally the amount of data used and periodically, as part of the Command & Control, send information to the Gateway regarding the amount of data you have used since the last "sync cycle". That data is used to update the MyAccount usage meter, which then in turn updates the SCC usage meter, the download status meter and both usage "History" display meters. For this to happen the Modem MUST remain powered on and in communication with the Gateway. If the Modem is powered off then the "sync cycle" is delayed, the usage and history meters are not updated in a timely manner and everything data related is delayed until the next sync cycle. ********* For the greatest accuracy, the modem must remain powered up and in communication with the Gateway *********** You have to maintain the "Hughes Loop": If you can't get past this one you will never have the best accuracy displayed by the usage and history meters .... period. Powering off the Modem will cause data that had be used but not yet tallied to be deducted on the next sync cycle. Lets look at a block diagram of a HT2000w modem and the "conneection paths" that data can travel: There are four parts to the Modem: 1: Ethernet 2: Wireless 3: Router 4: Mod/Demod 1: Ethernet Any and all devices plugged into an Ethernet port will have access to your data allowance. Disconnecting ALL wired device WILL prevent communication along this "connection path". It is NOT enough to have the device "turned off". I can think of at least three different "types" of "Off". Only disconnection of ALL Ethernet cables will insure that this connection path is totally disabled. 2: Wireless It is NOT enough to turn off the wireless function with a given device to insure the wireless connection paths are disabled. You MUST turn off ALL FOUR wireless paths within the wireless portion of the Modem to be effective. This includes regular 2.4 ghz and 5.0 ghz paths plus the 2.4 and 5.0 "guest accounts". Even this can leave vulnerablilites such has have WPS enabled. 4: Mod/Demod we wish to have enabled and up and running because the periodic "sync cycles" that report cached usage is desired. There are two connection paths we are concerned with: Ethernet .... disconnect ALL the Etherent cables Wireless .... All "radios" turned off within the Modem. To gain control you HAVE to cut the "connection paths", both wired and wireless, at the central point .... at the Modem while leaving the "Command & Control" active. That brings us to ... how to determine what is using data across the network. The best method is to disable the "radios" in the modem and add your own Router ... one that can track data on all possable connection paths and display that usage per day or defined period per device, per device application. That is the surest and fastest method. I suggest you buy something like and Asus RT AC68u Router. I have an Asus RT-AC3100, a little pricey ... A AC68u running the asuswrt-merlin firmware will give you the Traffic Analyzer at a lower cost: https://www.newegg.com/Product/Product.aspx?Item=N82E16833320174&cm_re=Asus_RT_aC68u-_-33-320-174-_-Product That will take the mystery out of the problem directly and allow you to take steps to control whatever is running, likely something in the background. So, what is running? A single computer has 65,536 "ports", each of which can connect to your interent connection. Some you can see .... an open browser .... port 80, a email client program uses two more. These are PROGRAMS ... but then we have something else .... PROCESSES. These run unseen in the background. Lets look at my Win7 laptop: A peek at Windows Task Manager shows just a few "applicaions" running. These I can "see": Processes however are another matter, Task Manager shows 99 background PROCESSES running. Each of these can and will use data, running unseen in the background. They will turn on, they will turn off, some are on a schedule, others are "triggered" by some condition or event. Without being able to monitor all connections paths or running software such as Glasswire on a single machine, you simply have no idea what is using data unseen. My advice: Buy the Asus router and get your answers in the quickest way possible. It can be done by other methods but with the sporatic nature of your "late in cycle: usage .... it will be a lot harder.
... View more