Problem with my Plusnet account, tried everything for weeks, any ideas anyone?

[#1]

Hi,
anyone any ideas what I can do to try and help get my problem fixed?
About 6-12 months ago, I noticed excessive usage. After many test, I decided the fault was not mine and must be Plusnet's so reported it to them.
I'm an IT manager, so not totally daft, and well versed in logical problem solving,
The final test was using 3 different routers. All different models, two different brands, and one does not have wifi. Wifi disabled in the firmware of the other two.
When router is switched on, but no wifi and network cable disconnected, I get about 70% of the time, phantom usage on my account of between 200 and 750mb per hour. Totally reproducable on any of 3 routers and I reproduce it almost daily for them, and have reported daily findings several times..
I phoned them on the 19th October and described the problem. The guy agreed, reckoned he could see no real router usage at their end, just saw it on my account record and set up a fault ticket:-
https://portal.plus.net/wizard/?p=view_question&id=47869712
since then, I've had to start again describing my problem 3 more times, so now 4 in total.
And the basic start point is "are you sure you have wifi disabled, are you sure no one has your password" etc. Do they not read previous comments about the 3 routers?
Culminating in attempt 4 today.
I'm totally exasperated by Plusnet support, most of the guys seem very knowledgeable, but I always have to restart.
the guy before this one logged a "get back to you tommorow" record, but never did, and I was ignore for 9 days till I reminded them of my problem today, just to be told, Oh, are you sure wifi is..... "AGGGGHHHHH!!!!"
I've asked for new routers to be supplied (at my cost) three times now, sealed in a box, locked password, no wifi etc. to help prove the problem.
I've asked for a new account to be setup from scratch, for me to transfer to - ignored twice, possibly 3 times (need to check)
With this new one starting from scratch again, or so it seems, has anyone any idea as to what I can do next?
I loved Plus net, brough then several (8 I think) customers over the time, Ok, I get a few quid discount! I thought perhaps this might help, but no. It's anoying me so much now, not necessarily the lack of fixing, but the re-starting and treating me like a child, that I'm ready to jump ship, and take as many as my users with me as possible - they turn to me for help, so if they want help, I prefer them on the same supplier.
I'm ready for throwing in the towel as I'm back to square one today 
any thoughts?
Seems like they are not "joined up" and no-one takes ownership of problems.
Jeff

[#2]

have you ever given anyone an old router?
have you tried altering your PN account password (not the router one)

[#3]

I've been asked both of these questions many times by plus net.
I've never supplied one of my routers to anyone.
And my password on plusnet has been changed (they confirned this) so any old router would have been logged out anyhow.
I an 100% certain that the problem is at plusnet, and one guy early on at PN confirmed my router was on idle, with just normal chatter, but my usage for that period had a large phantom usage.
Jeff

[#4]

Hi jethro10,
I've seen your ticket reply and I'm sorry it's taking so long to sort out. I'll pass it back over to our traffic management team and ask them to investigate further.
Jojo

[#5]

Just to add to what Jojo has said, we'll config a router and send that out in the morning as requested on your ticket. If that doesn't work we can look at shifting your details over to another account just to rule that out too.

[#6]

Thanks both of you.
I know it's a pain, and you probably get so many people that have no clue what they are doing when they talk to you, but honestly, I've tried everything I can at my end to isolate this.
both of these seen sensible next steps to take to me.
thanks
Jeff

[#7]

jethro10,
We'd just need to wait and see what happens with the router that Jojo sent yesterday. Do let us know if there's no change and we'll take a look at this again for you.

[#8]

Have you established if the traffic is between Plusnet and the router only or if it is between the PCs and Plusnet?
One thing I would do is to put NetWorX on all the PCs to record all the usage (you can set it to ignore LAN traffic).

[#9]

Another thought: Do any of your routers support SNMP?

[#10]

Yet another thought: A long time time ago I found that I was getting a lot of DCOM (port 135) traffic going out as a broadcast so I added a block rule to the router for this. I've since upgraded operating systems a couple of times so whether this is still needed I don't know. If you have a number of PCs it could mount up.

[#11]

Quote from: jelv

Have you established if the traffic is between Plusnet and the router only or if it is between the PCs and Plusnet?

It happens with a WIFI disabled router and NO network cable plugged into it, so can't be PC's. As far as I can tell, there is no traffic, it's just PN recording there is somehow.

Quote from: jelv

One thing I would do is to put NetWorX on all the PCs to record all the usage (you can set it to ignore LAN traffic).

My Pc is running a version of Linux, but I have monitored it with wireshark, and was getting nothing but protocol chatter, no real usage - but over 700Mb was recorded in the same 2 hour test on my PN account screen.
Jeff

[#12]

In that case the traffic is going to be reaching your router from the internet. Could you configure things to forward all traffic to a Linux box which acts as the router and then wireshark the traffic coming in?
Have you tried setting the Plusnet firewall to block the traffic coming in? https://portal.plus.net/my.html?action=firewall&firewallPage=advanced (don't forget you have to do a disconnect/reconnect after changing that setting)

[#13]

Quote from: jelv

Yet another thought: A long time time ago I found that I was getting a lot of DCOM (port 135) traffic going out as a broadcast so I added a block rule to the router for this. I've since upgraded operating systems a couple of times so whether this is still needed I don't know. If you have a number of PCs it could mount up.

It's not local (to me) traffic breaking out. It happens with wifi disabled and network cable unplugged
If router is switched off, PN record no usage.
If router is switched on, with no WIFI and no network cable plugged in, approx 70% of the time it records phantom usage on PN member usage screen. I've done it with 3 different routers, so it's not a router problem - to be honest, what else can I do other than disable wifi, and remove the network cable. The router is then isolated to the internet only and it's then beyond me to go any further.
They have said many times it is possibly me giving a router setup with my details to a friend for instance, but this is not a sensible comments, as usage only records when I'm switched on at home - if it was a second router, usaged would be effectivley random, no?
To be honest, what else can I do other than disable wifi, and remove the network cable. The router is then isolated to the internet only - so at this point, it's BT or PN who need to look at it.
They are sending me a locked down router, Ok from their perspective, it removed me as a problem, possibly fiddling with routers etc. I appreciated there is a lot of basic users out there who know zilch about stuff, and this would help them for sure. But I've been there, done that basically 
If PN had any sense about them, they would have create a second account for me, and locked the router to that account, totally removing in one swathe, me and my kit and the old account as being a problem. As it is, it seems like it's a router locked to my current account - oh well    it's a (small) step I guess.
I'll send them back a bunch of free routers as a present when they fix it    From my position, i can't see I'm far from getting a MAC code and removing PN as a potential source of the problem, a bit sad if I have to do that though 

Jeff

[#14]

Quote from: jelv

In that case the traffic is going to be reaching your router from the internet. Could you configure things to forward all traffic to a Linux box which acts as the router and then wireshark the traffic coming in?

Yeah, I've effectively done this step and had nothing but low level protocol chatter, which also helped me conclude it was a problem only PN could solve for me.
They assure me they have been monitoring my traffic, and they set a fixed IP address to aid this, although not sure they have been, as feedback has been zero on this, and I get a new PN support person each time, wanting to start from scratch with "is your wifi disabled? AAGGGGHHHH!"

Quote from: jelv

Have you tried setting the Plusnet firewall to block the traffic coming in? https://portal.plus.net/my.html?action=firewall&firewallPage=advanced (don't forget you have to do a disconnect/reconnect after changing that setting)

I've just looked, it's switched off, so I'm getting all traffic, but would not wireshark have picked up lots of traffic if this was a problem? PN certainly havn't offered this as a solution, infact I was unaware I had a PN firewall    I'll switch it on right now - you never know I guess.
thanks
Jeff

[#15]

Do you ever use P2P? If so other users will be trying to connect to you for some time after you have closed your P2P software even if all the PCs are off. That would only be stopped by turning off the router. Again wiresharking the traffic coming in to the router would be the only way to find out. If this is something similar is the reason a new account isn't going to help.
I know once or twice in the past Plusnet have arranged a time for a user to have all his PC's off (but router on) and they have wiresharked all the traffic from their end.
I don't think the locked down router is going to make a scrap of difference as it looks like it's incoming traffic that's the issue.