Constant data transfer for days, but im not using my connection!

[#1]

To clarify
There was incoming data to your router from the internet which your router was bouncing. Nothing to do with your network

[#2]

My daughter managed to consume around 4GB in the course of a single day - despite saying she hadn't watched more than 30 mins of Youtube / iplayer streaming.
Do any of these multiple "social networking" sites consume bandwidth in a wholesale fashion?
Obviously something was sucking bytes out of my internet connection.

[#3]

From the comment of P Richardson it looks like that.....

[#4]

Quote from: wattsl01

Static IP, same one for past five years.

So if somebody takes a dislike to your IP address and bombards it with some sort of request for a response that the router denies, would that count against your usage allowance even though the traffic is "pushed" from the internet rather than "pulled" from your local network?

[#5]

Correct.
I think if it's a persistent problem there may be ways Plusnet can block it.

[#6]

If that is indeed the case, then PlusNet should be able to identify it as a single source, track and block it. Interesting input guys, but if it is malicious, they'd have to be
pretty dedicated to keep it up for that long, and throw that much bandwidth at it wouldn't you agree?
 

[#7]

Yeah, what have you been up to? 
Anyway on a serious note, a quick simple fix would be to remove that static IP (blocking it from being used by any other user) and assigning you with a new one.

[#8]

Given that IP4 addresses are running out I don't think that's an option!

[#9]

Well, to be more accurate IPv4 addresses have already been fully allocated but quite a few are not actually being used.
As this is for just one customer, I'm sure it can be 'lost' for a period until it can be investigated where the source of data transfer is originating from.

[#10]

Latest reply in my ticket:
"In regards to your usage on your account unfortunately when you had the router disconnected there was no usage. This would indicate it is a problem with your internal set up or equipment. After reviewing the connection logs today there is nothing out of the ordinary with your usage."
No Plusnet, i do not have three faulty routers. Lets stop trying to blame my equipment shall we. Lets actually take notice of what i have told you. Have asked for my MAC code im afraid. It would seem that Plusnet are absolutely not to blame for this are they? Im afraid you are. Are you actually going to do a thorough investigation into the source of the data that has been "pushed" at my routers, yes ROUTERS, not router. Time to pick your game out of the gutter i think.

[#11]

Quote from: wattsl01

Hi jelv - Static IP, same one for past five years.

My battlefield calcs make it the stream about 183Kbps.  The fact that you have nothing on your LAN means the data end point is the router itself. 
Possibilities that come to mind, in no particular order.
1. TR069 is repeatedly trying to re-configure your router.  Turn off the router auto config function in the PN portal.
2. Someone has hacked the admin password or some other functions of the router and is logged in remotely.  Change the router admin password and any other passwords it might have.
3. Someone is DOSing your IP.  Have PN change your IP (at least temporarily) and see if the problem goes away. 
Probably a good idea to have the IP changed anyway.
If you are really comfortable with this sort of stuff.  You could assign the WAN IP to the LAN interface, which should create a ZIP-Bridge, allowing the raw internet traffic to be sniffed on the LAN side - free from NAT and firewall interference.

[#12]

Some interesting comments. Did think DOS attack. Looking for the autoconfig but its evading me. Remote access to router is disabled. I just want taking seriously, instead if stock answers, just look into it properly PN!

[#13]

Hi wattsl01,
I'm sorry to hear that you don't feel you've received the support you expect from us.  I'd like to help you get to the bottom of this issue.  I have reviewed both this thread and the ticket on your account.  As far as I understand it your setup at home consists of an ADSL modem/router which some machines connect to with a wired connection and a Wireless Access Point which is connected to your modem/router via ethernet.
So far, I can see that you have powered off your Wireless AP and unplugged all ethernet cables and still seen that our systems have recorded usage levels that are above normal idle levels.  From our side we can only see when your connection is connected or not connected.  We cannot see if the connection is idle or not whilst connected which can make tracking your usage against an active connection difficult.  From your ticket and this thread is not clear the exact times when your connection was active but idle or active and under normal use which has made it difficult for our support team to say if the usage levels are normal or not.
Ideally we need to organise specific times to both:

• Power off all your equipment internally. (No active connection)  Obviously in this scenario no usage should be recorded which appears to be the case when checked previously.


• Power off your Wireless AP and unplug all ethernet cables. (Active connection but idle)  In this scenario only a low level of background usage should be recorded.

I tried to call you at home and on your mobile earlier today but could not get through.  Can you send me a PM when you will be available (preferably at home) and we'll complete some testing and get to the bottom of this issue.

[#14]

Properly best to turn off all equipment (including router). Get plusnet to configure one of there testing routers with your ADSL username and password. When they done this they'll be assigned with you static IP. Then see if they experience the same issue.
As this will require you to be disconnected from the internet properly best to agree to do it overnight. I would have thought this would be enough time to investigation too.

[#15]

Hi Alex,
The only time to catch me at home is after 7pm and at weekends. If you look at the beginning of the current ticket you will see the data transfer logged. This was logged with my entire network shut down. Just router with cable to filter. I noticed a comment from one of your staff stating that the endpoint of the data transfer appeared to be my router (not requested by it, but destined for it, or my IP), but it was not responding to it? I am quite frankly surprised that you cannot trace the origin of the data as this would help to shed some light on the issue.
As this issue has stopped, i can appreciate that it may be difficult to pin down the issue, however what i strongly object to is the unwillingness of yourselves collectively to listen to me and accept what i am saying. As an ex ISP tech, and an IT support analyst of many years I do have some insight. I can categorically state that this data transfer, or apparent attempt at data transfer, does not, and has not been initiated by a device connected to my network. The transfer recorded at the beginning of the current ticket cannot physically have been requested from my network. It was all off, to prove the point that most of your techs refused to believe, or simply do not understand. I  am also not expecting to be charged for data over my limit for this month. Also, if you look at may data usage, historically is tends to be between 12 to 13 Gb (Peak usage) I have never been anywhere my limit. I thought this may have also helped towards my point being taken, but obviously not.