cancel
Showing results for 
Search instead for 
Did you mean: 

High usage showing in VMBU

maranello
Pro
Posts: 1,267
Thanks: 200
Fixes: 2
Registered: ‎11-01-2008

High usage showing in VMBU


I have noticed unusually high usage on VMBU over the past couple of days. My router is normally powered up 24/7, it is a Dlink 2640 but wireless has been disabled. I know that there has been no deliberate usage during yesterdays and todays off peak periods (only one desktop connected, which was powered down), but VMBU is showing around 5.5 - 6 MB  of usage where normally this would be less than 0.5MB. This seems somewhat excessive for 'background' traffic. I can't really tell how much peak usage is affected as there has been some genuine usage.
Is this a problem with the VMBU data, or is there something more sinister going on. If the latter, what advice can you give to determine to cause. If the off-peak usage rate continues during peak hours, this amounts to over 15MB a day and 0.5GB out of my 10GB monthly allowance.
My other car isn't a Ferrari
11 REPLIES 11
maranello
Pro
Posts: 1,267
Thanks: 200
Fixes: 2
Registered: ‎11-01-2008

Re: High usage showing in VMBU


I've been continuing to monitor usage, from work. Seems to be running at an average of around 400kB per hour. SWMBO is at home and has only used connection to check emails and BBC weather site.
This rate of usage whilst not alarming in terms of imminent risk of using up my monthly allowance, is nevertheless 10 times greater than I have previously seen.
Should I be concerned?
My other car isn't a Ferrari
Oldjim
Resting Legend
Posts: 38,460
Thanks: 787
Fixes: 63
Registered: ‎15-06-2007

Re: High usage showing in VMBU

I wonder if she keeps watching the video of the weather forecast
maranello
Pro
Posts: 1,267
Thanks: 200
Fixes: 2
Registered: ‎11-01-2008

Re: High usage showing in VMBU


Unlikely, she's been too busy clearing the snow off the driveway.  Wink
The study where the desktop sits doesn't stay warm for very long and she would rather sit in the lounge in front of the woodburner. I'm planning to buy her a netbook but haven't settled on a make/model yet.
The off-peak usage is the best indicator of what appears to be excessive background traffic. Could this be an attempt at IP address or port hacking? Will the router firewall be adequate to stop this if it is happening, and prevent an attack on the desktop when it is powered up and in use?
My other car isn't a Ferrari
maranello
Pro
Posts: 1,267
Thanks: 200
Fixes: 2
Registered: ‎11-01-2008

Re: High usage showing in VMBU


VMBU is still showing high rates of usage, 8.5MB since midnight.
Router was powered down for 10 minutes yesterday, in an attempt to get a different IP address allocated just in case this is being targeted.
I ran full AV and spyware scans, nothing showing. Should be irrelevant anyway since high usage shows when connection not in use.
Confirmed that Wireless is disabled, and my wired desktop has not been in use since late yesterday afternoon.
0.5MB per hour seems excessive for 'background' usage.
My other car isn't a Ferrari
MisterW
Superuser
Superuser
Posts: 14,575
Thanks: 5,411
Fixes: 385
Registered: ‎30-07-2007

Re: High usage showing in VMBU

Quote
0.5MB per hour seems excessive for 'background' usage.

That does seem a little high Huh
Mine's normal about 70kB total for the midnight-8am period, and that includes voip registration traffic for my Gigaset phone.
What setting have you got on the PlusNet firewall ? 

Superusers are not staff, but they do have a direct line of communication into the business in order to raise issues, concerns and feedback from the community.

maranello
Pro
Posts: 1,267
Thanks: 200
Fixes: 2
Registered: ‎11-01-2008

Re: High usage showing in VMBU

Firewall is on and set to Low, as it has always been. From VMBU, high usage appears to have started sometime during peak usage period on Wed 6th Jan.
My other car isn't a Ferrari
orbrey
Plusnet Alumni (retired)
Plusnet Alumni (retired)
Posts: 10,540
Registered: ‎18-07-2007

Re: High usage showing in VMBU

Hi maranello,
If this is some form of attack it should show in your router logs, but I'd say the router firewall would be fine to keep these out. Is there any chance it could be windows updates or something else downloading overnight? I notice from your VMBU pages this isn't happening every night.
Do the router logs show anything at all?
maranello
Pro
Posts: 1,267
Thanks: 200
Fixes: 2
Registered: ‎11-01-2008

Re: High usage showing in VMBU

Hi Matt,
Nothing showing in router logs as such, although I need to check the log settings in the router in case it is not set to log any form of attack.
It is hard to say if it is or isn't happening every night, to be honest I'm sure it is continuous throughout the day as well as overnight, it's just that with little or no genuine usage off-peak it is easier to spot that it is going on. Unlikely to be Windows updates as the desktop was powered down during the whole of the offpeak periods on the 7th, 8th and today.
Updated 12/01/10 9:20am - I didn't get around to checking router logs last night due to other demands (work, food and finally sleep). I've set up my router (D-link DSL-2640B) to email me the logs when full. Only one message received soon after the last router reboot on Sunday pm, which shows nothing untoward. What should I be looking for?
My other car isn't a Ferrari
maranello
Pro
Posts: 1,267
Thanks: 200
Fixes: 2
Registered: ‎11-01-2008

Re: High usage showing in VMBU


Further update.
I tried to do a router disconnect, rather than a full reboot,  yesterday evening. The idea was to keep the sync rate which is better than it has been for a while, but to disconnect from Plusnet and reconnect later with a different IP address.
When I clicked on the disconnect button, the connection stayed up and the browser window just hung for ages. Could not access any other of the router setup/config or status pages, etc. Restarting the browser did not help. The only option left was to do a power off reboot. After powering up a few minutes later, I could again access router menus. Looking at VMBU logs today I am still getting high background usage. Router logs don't appear to give any indication of a problem.
Would setting Plusnet firewall to High have any effect?
My other car isn't a Ferrari
MisterW
Superuser
Superuser
Posts: 14,575
Thanks: 5,411
Fixes: 385
Registered: ‎30-07-2007

Re: High usage showing in VMBU

Quote
Would setting Plusnet firewall to High have any effect?

High will block all incoming ports. If it is an external attack then setting to High should stop any traffic. It will also prevent you from using a VPN though.

Superusers are not staff, but they do have a direct line of communication into the business in order to raise issues, concerns and feedback from the community.

maranello
Pro
Posts: 1,267
Thanks: 200
Fixes: 2
Registered: ‎11-01-2008

Re: High usage showing in VMBU

Thanks for replies, but problem appears to be cured (fingers crossed). Smiley
Problem is, I'm not sure if it is anything I have done that has fixed it.  Huh
Overnight usage (midnight to 8am today) is showing as half of what is has been for the past week, todays peak period usage is around 30-40kB per hour. The only thing I have tried to change (yesterday morning) is the reporting detail in the router logs. I would expect this to have an indiscernable effect.
It may be pure coincidence, but I did spot an Openreach van parked close to my local cabinet, with an engineer sat inside working on his laptop. Though I struggle to imagine what sort of cabinet problem could be resulting in an apparent increase in my usage. Or what would persuade an Openreach engineer to work on a Sunday. Wink
I guess I'll just have to keep an eye on VMBU in case the problem returns.
My other car isn't a Ferrari