Penny, As Gabe stated "pulling the plug" isolates ALL of your equipment from the Hughes Modem. The Modem can still connect to the Gateway but if no data is being used then the evidence indicates that the usage is occurring somewhere within your net work. Lets look at a "Networked System" that consists of: #1: A Hughes Modem #2: A Router with both wired and wireless capability plus its "internals" #3: Up to four wired devices ... be they Computers, wired printers, range extenders and so on. #4: Wireless devices Here is a graphic depicting that "Network System", and it is a system in the respect that it contains multiple devices and multiple connection paths. When you disconnect the LAN cable from the rear of the Modem you are isolating ALL of your connected equipment. We need now to look a little closer at a Router, what it is and what it does. Here is a functional diagram of a typical home Router. They really are wonderful devices ..... but ..... they complicate things because the are .... multipliers. They multiply the number of WIRED devices that can share your connection They add and multiply the number of Wireless devices that can share your connection. They also add their own "internal connectivity" in the form of the "firmware" chip that is the real brains of the Router and it also does connect in various ways that also share your connection. . So there are three areas of concern: The "guts" (firmware), the "Wired" and the "wireless" A router consists of three potential traffic areas: #1: Its firmware/hardware: This would include automatic update checks, Remote Access accounts/vulnerabilities, WPS settings/vulnerabilities and "front end" username/password setup to name a few. #2: Wired LAN connections and the types of devices connected as well as their settings. Specifically end users not understanding the differences between "hard off", "sleep" and "hibernate" as well as other system settings such as Wake On LAN, Wake On Ring and even extending to "scheduled tasks". We need not even go into the details of forced updates and data "sharing" inherent to Win10 and being back ported to Win7/8/8.1 #3: We come to the most difficult to control ... Wireless activity We can start with what encryption level, if any, has been set up. We also need to consider the username and password that limits access to the routers front end so that unauthorized users can add themselves to the wireless users list. It needs to be changed from the default values. We also have the multitude of settings of the many types of devices that can connect wirelessly be they computers, notebooks, tablets, cell phones or even thermostats. It is often not apparent when all apps on all devices have had their update ability turned off. Very frequently an update will cause other settings to change to their default values. Considering the number of "connection avenues" provided by a router it is mandatory that it be included in any troubleshooting steps ... THERE SIMPLY IS NO WAY THAT A DATA LOSS ISSUE CAN BE ADDRESSED WITHOUT REMOVING THE ROUTER FROM THE NETWORK as a first step in deterring where the data is going. There simply is too much complexity, too many possible avenues of connection with the Router connected at the start of the troubleshooting process. You have to simplify the Network by connecting a singe computer directly to the Modem .... so that your network looks like (for troubleshooting purposes) this: Even the above is more complex than what it appears. Each computer will have 65,536 "comm ports". Each of those is capable of establishing a connection and using data ... data from your allowance. The activity on some of those "comm ports" you can see as the result of having a PROGRAM open such as a web browser .... that uses Port 80. You may also open a web client email program such as Outlook or Thunderbird among many, that you can also see as the PROGRAM is open on your desktop ... and it uses two more "ports", one for incoming mail and another for outgoing. That is THREE out of 65,536 and that brings us to PROCESSES. Processes run unseen in the background. They will run and use data and you WILL NOT SEE THEM but you will see there effect on your monthly allotment. Each computer needs to be connected directly to the Modem and have its data usage monitored for a period of time to see if it is "clean" for lack of a better term because after all, the Data Has To Be Going Somewhere so now it becomes a WHO DONE IT. This is the time that Glasswire needs to installed on the SINGLE COMPUTER, the ONLY machine that CAN connect .... and see not only what PROGRAMS are running and how much data they are using but also the unseen BACKGROUND PROCESSES. One computer at a time, rebuild the "network". one device at a time: The number of variables has been brought down to a manageable level. It now is time to download and install some software to track usage and identify what program and what process is or has been running and using data. For this we need Glasswire: https://www.glasswire.com/ help/ An important point here ..... GlassWire will only monitor the single computer upon which it is installed. Later as the router is reintroduced, GlassWire will have to be installed on every Windows computer that is connected to the router Another point to be made here is that if Windows IS the root of the issue ... it uploads/downloads sporadically .. it may take time to "catch it in the act". So as to not "torque" the amount of usage displayed by GlassWire we need to change a couple of settings ... we don't need to count (later on when more devices are connected) "local" traffic. Here are my suggested settings: (click on picture for larger image) Understanding the results: Each computer, one by one needs to go through this process. Once all wired computers have been "cleared" we can add the router back in to the mix with one major exception .... we have to disable the "radio" ... We then want to test the "network" consisting of all "cleared" wired devices and the router "guts" to ensure they work well together as a whole. Now comes the stickey part the re-introduction of the routers wireless function. Its tough because I know of no software that will load on the variety of devices that CAN connect ... cell phone, tablet and so forth. On laptop computers you can od course load GlassWire but that still leaves many potential avenues open. The "Poor Mans" method requires great discipline. ALL devices other than a single one have to be and remain in a "hard off" state and that is not easy to do. Run that single device over time and monitor usage carefully while still running Glasswire and the "difference" is ... the amount used by THAT device. Of the devices ... Apple stuff is probably the worst ... VERY large updates on a random basis and the updates are very prone to "break" during download causing them to restart from the beginning ... massive data loss there. It is essential that the router be properly set up ! Guest access MUST be disabled in the routers internal GUI No "open network" : WPA-PSK [TKIP] encryption at the very minimu m ! Clear all devices one by one with the understanding that the usage may be sporadic. There are higher end routers that WILL track usage by individual device but these may be out of reach (about $200) for the casual user. That is the only way to be SURE of what is going through a network.
... View more