Can I get a breakdown of BB Usage for a particular date?

[#1]

According to the VMBU we usually do about 2-5GB of peak usage per day.  Last week we did a whopping 27GB on Friday 23rd!  This is highly unusual as there was only one person in that day, and he was only there until 1pm.  Is there any way of finding out what ports the majority of the download was, and between what times?  I'll confess I was using VUZE to download a (legitimate) torrent, but that was only 1.16GB and VUZE tells me I only uploaded 78Mb (though I guess it could have been wrong).
-Dave

[#2]

SKY+HD On Demand ?
You set it up, and off it goes..........
It's like the Energizer Bunny, it keeps on going.... until it stops !

[#3]

I'm assuming that's a suggestion that Sky was the culprit?  No, we don't have HD on demand.

[#4]

Plusnet can usually give you an hour-by-hour breakdown of total usage on a particular date. Raise a ticket (or call the CSC) to request that.

[#5]

Thanks Spraxyt.  Will do.

[#6]

I presume you've checked your wireless is secure as well!

[#7]

The router's wireless is turned off.  I use a Homeplug Wireless extender which is not only restricted to a MAC list, but has no DHCP server, so the router supplies all IP addresses.  The router emails it's logs to me every day and only reserved addresses are being given out.  So no-one's been in that way. 
A detailed list from PN will probably tell me the culprit. Especially if the port is 5525, which the savvy among us may recognise as a port used by VUZE. 

[#8]

The hour by hour breakdown we can give is just the amount of usage in that hour, we don't have a way to give the ports/usage type per hour.

[#9]

Hi Chris
So how do you know what type of traffic it is? I assumed it was by particular ports.  Or is it by packet inspection?

[#10]

Traffic typing is done on the fly using a combination of methods including ports used, packet inspection (signatures), etc. That is used for prioritisation and to populate the usage breakdown in VMBU, but not for accounting.
I think accounting is based on the total usage figures supplied by BT. I imagine it is that latter (total usage) data that Plusnet record in hourly slots and can provide for a particular day. Only the total is available, no breakdown by type.

[#11]

Spookier and spookier.  27GB was downloaded between 4pm and 9pm that night, plus some uploading. Thing is,  hardly anyone was in that night.  My 14-yr old son (who does do a lot of online streaming) was out from 1:30 in the afternoon until 9pm at night.  My wife and I were out from 7pm until midnight.
As previously mentioned we don't use the router's built-in wifi, and the wireless extender is tied down to Mac address, but even then I'd see IP addresses being assigned in the router's logs.
Can anyone think of a possible explanation for this?

[#12]

Is it anything to do with the incorrect circuit reference that was applied to your account and mentioned in your other thread here?

[#13]

Per my reply to the other thread, these are no related. The usage collection method is based on your login.
We have checked and can verify that the only connections that have been online, gone from your single line (one example of this occurring, is the sale of a router but not deleting your credentials from it).
We collect usage information using two mechanisms. One is recorded through information supplied to us at the network edge (as we attach to the BT network) and the other is collected by our traffic management. There is always a difference in the figures for two reasons, 1 the way they are measured is slightly different, 2 the traffic management switches record dropped packets (because the traffic management sees the data and it gets dropped in another portion of the network).
However, the difference between the two values should differ only by a small margin.
I have attached the raw data collected for the 23rd to your ticket. Some explanation of which is which is in the ticket.
Given the two unique measurement points and methods, the data is well within the tolerances expected and would suggest it is correct.
I have highlighted a couple of things about the data, which would suggest the source of it (or will have when I hit send)

[#14]

Well I've tracked down the source of some Streaming usage between Midnight and 8am!  I grabbed hold of the laptop that my son uses and found the following in the System Event Log between 4:25 and 10:30:
Source:  amdkmdag
Event ID:  62464
Task Category: DVD_OV
It appears this event occurs whenever "windowed video media" is being viewed.  My son is on a bit of an Anime kick at the moment, and it turns out he was watching it from 4:25am on Friday when he had an Inset Day.  He has had a stern talking to about a) spending so much time on the laptop when he's supposed to be asleep and b) lying about it!  Unfortunately he's currently taking steroids as part of his chemo so his sleep patterns are all screwed up, but still...
Just goes to show that no matter how much you trust your kids, they will still lie.
Now I just need to track down the 27Gb that occurred later in the day...when no-one was in!