Constant incoming stream chewing up bandwidth

Discussion in 'Tomato Firmware' started by m00kie, Oct 11, 2008.

  1. m00kie

    m00kie Addicted to LI Member

    With the newly implemented bandwidth cap policy at Comcast I, like many others, am starting to pay closer attention to my bandwidth usage. During a period of relative inactivity I noticed my monthly usage increasing at a rate that seemed inconsistent with my actual usage. I discovered that there is a constant stream of incoming data 24/7, at a fairly consistent rate of approximately 512 kbit/s (64 KB/s). This stream will chew up 5.5 GB per day, or 165 GB per month! :eek:

    I have a WRT54GS running Tomato 1.21, and I am using the router's bandwidth monitor. My first attempt was to determine which device in my network was responsible for this traffic, but I found that with hard wired devices disconnected and wireless networking disabled, the incoming traffic continues.

    I am a bittorent user, and started to think that what I was seeing might be a stream of incoming connection requests. To test this theory I changed my IP address. Before and after tests with confirmed that my IP address was successfully changed, but the traffic persisted.

    Finally, I connected one of my machines directly to the cable modem, bypassing the router, and monitored bandwidth using DU Meter. To my surprise, DU Meter showed negligible incoming traffic, which stayed around 5 kbit/s. Now I'm totally confounded.

    I am desperate to identify what the source of this traffic is and assess what I can do to eliminate or at least limit it. Any suggestions would be greatly appreciated!
  2. bogderpirat

    bogderpirat Network Guru Member

    64kbyte/s is a lot for background chatter, so i'd rule that out. if you have no devices connected to the router and it still says it has that much traffic, i'd check for any scripts that you might have that could be causing this (like something that gets downloaded off the web into the router's memory, but hangs in a loop).
    if there's nothing that can account for the traffic, try backing up the configuration and reset the router to see whether the traffic persists. if it does, then, well, i don't know.
  3. m00kie

    m00kie Addicted to LI Member

    Thanks for the suggestion! I did as you suggested. After a reset, before restoring my original configuration, I checked bandwidth monitor and saw the same traffic as before. This is very discouraging!
  4. xjulzkx

    xjulzkx Addicted to LI Member

    Log into your Tomato web interface on your WRT54GS router, Navigate to your "Access Restrictions" on the side menu, and create a new restriction.

    Tick 'enabled'
    Enter a Description
    Tick 'all day' and 'everyday'
    Select 'normal restriction' from Type:
    Select 'all computers/devices' from Applies To:
    Then under Port/Application, leave everything as is but select 'All IPP2P Filters' from the application drop down list, then click 'Add'
    Last of all click 'Save' down the bottom of the page.

    Now check to see if this fixed your bandwidth issue, if it does, check P2P software on your computer.

    You mentioned after plugging your computer into your modem directly (ethernet cable) it stopped leeching this mysterious bandwidth. Well, how are you connected to your WRT54GS when it leeches the bandwidth, via wireless or via ethernet?

    Try plugging an ethernet cable from your computer to your WRT54GS router and see if it leeches the bandwidth still. If not, it might appear to be some software trying to take advantage of your wireless connection (I'm standing out here, not sure if you have a wireless adapter on your system or what). Basically, single out if it's happening through your wireless connection, or ethernet wired connection to your WRT54GS.

    If setting up the access restriction I posted above fixed the problem, then it's obviously some software you have running on your system causing the problem. The other possibility would be the network translation from your computer to the WRT54GS router which then goes to your modem that's providing your local network the comcast connection.
  5. m00kie

    m00kie Addicted to LI Member

    I set a new rule restricting all P2P traffic, as suggested, but it had no effect. For the heck of it I set up a rule blocking all internet access for all devices, and the traffic continues.

    Also, xjulzkx, I don't understand your last comment about NAT being potentially responsible. Could you explain? This is something I've not heard before.

    I performed the following experiment this morning: I disabled wireless networking on the router. I disconnected all wired devices except one PC. I checked the daily WAN bandwidth on the router - 1.40 GB. I then disconnected the PC from the router and waited exactly 30 minutes, at which time I reconnected the PC to the router. The daily WAN bandwidth had increased to 1.50 GB. With no devices connected to the router, the traffic continues.

    Again I connected the PC directly to the cable modem, and DU Meter reported minimal traffic (~ 5 kbps as opposed to the 512 kbps seen on the WRT54GS.)

    Based on this it seems clear to me that the router is in some way responsible for this traffic, and not one of the devices attached to it. Does anyone think otherwise?
  6. bogderpirat

    bogderpirat Network Guru Member

    do you have any means of checking on comcast's site whether you're actually using up any traffic, or if it's just bogus data reported by the device, that actually doesn't use up any internet-connective quota?
  7. m00kie

    m00kie Addicted to LI Member

    Unfortunately, no. Though they should, I don't believe Comcast provides any means by which customers can track their usage. If they did I'd probably just check that occasionally rather than rely upon the router's monitor.

    I agree that it seems quite possible that the device is reporting bogus data, but it's hard to imagine that I'm the only one experiencing this strange behavior. If I KNEW it were bogus I could just asses my usage based on a 415 GB cap rather than a 250 GB cap, but I'd feel much more comfortable understanding what's going on, and even more comfortable with a monitor than can be trusted to report accurate data!
  8. neurobash

    neurobash Addicted to LI Member

    Well m00kie, I just installed tomato v1.21 on a WRT54G today, and I notice the same constant incoming traffic. Comcast is my ISP as well. Haven't had much time to investigate, but if I find out anything useful I'll post it.
  9. neurobash

    neurobash Addicted to LI Member

    Hmm.. well I disabled the WAN interface and the traffic persists. Not sure what's up with all the chatter between the router and the cable modem, my WAN light flashes constantly as did it on the SMC this router replaced. :confused: Unfortunately this makes trying to monitor bandwidth pretty useless. :thumbdown:
  10. Mastec

    Mastec Network Guru Member

    I have Comcast too. I see it as well with my setup but not to the level that you are experiencing. Are you sure its actual bandwidth being used and not just communication between the router and modem being registered? Below is a screenshot of mine so far this month... The days where the bandwidth exceeds 4 GB are days my family and I watch movies. The other days BW usage is just normal traffic with 5 computers accessing the Internet. With me listening to streaming music, my boys playing WoW and downloading updates through uTorrent. Daughter watching music videos, listening to streaming music and the wife playing her online games. So far being about half way through this month I have only used 47.99 GB leaving me with little over 202 GB for the rest of the month.

    Attached Files:

  11. m00kie

    m00kie Addicted to LI Member

    Thanks neurobash. I'm glad to hear that I'm not the only one seeing this odd traffic! What model modem do you have? Mine is a very old RCA DCM305, which I was thinking of getting replaced today in the hopes that it might help.

    Also, I'm really curious: is the incoming traffic that you are seeing hovering around the 512 kbps mark as well?
  12. m00kie

    m00kie Addicted to LI Member

    Hey Mastec, thanks for the reply. I can't say for sure that it's actual bandwidth being used. There is a 'cable activity' light on the modem which should be off when there is no data flowing across the cable (i.e. out to the internet) and flashing when there is. On my modem this light is constantly flashing which leads me to suspect that the traffic that the router is detecting is in fact coming in from the outside rather than from the modem itself.
  13. Mastec

    Mastec Network Guru Member

    Actually the flashing Link light on the modem shows that there is connectivity between the modem and router or PC, not activity. This has been discussed over at the Comcast forums.
  14. Mastec

    Mastec Network Guru Member

    BTW... I have the Arris telephony modem. The Link light blinks at a steady pace, same as the WAN light on my Asus. I believe if it blinked due to traffic it would behave like a LAN LED when information is transmitted back and forth. Like start/stop off and on, not steady.
  15. m00kie

    m00kie Addicted to LI Member

    Thanks, that's good to know. I had read on a Cox support page that a blinking activity light means that "data is being transferred between the modem and the head-end." I'm pleased that's not true.
  16. Mastec

    Mastec Network Guru Member

    I just looked through the pdf file for the Arris modem which I use. It has a definition for all the lights. For the Link light it states... Link: indicates Ethernet or USB connectivity between the Telephony Modem and computer. Hope that helps :)
  17. SempaiJR

    SempaiJR LI Guru Member

    same thing here

    I too am noticing the activity light. I disconnected all my wired lines and turned off the wireless and still get the activity.
    In my case the orange activity light is solid, blinks every now and again.
    before all this the light was always blinking and at times will not light up at all, but now forget it. the only light on the router that blinkis the 'Internet' light (wrt54gs). Can not figure it out.
  18. Mastec

    Mastec Network Guru Member

    Did you see my posts?

  19. SempaiJR

    SempaiJR LI Guru Member

    Yes I have read your post.
    But tomato is showing activity in MB, for example last night I had accumlated 186MB when all my wired PC where disconnected and wiresless off. I know that that is not much, but it does accumalted thus subtracting from when I truly need it.

    anyhow thanks for your replies, I guess we will have to see what comcast says.
  20. slamcat

    slamcat Network Guru Member

    I am betting this is ARP multicast traffic between the cable headend and the modem. Cox does it, but they also know this happens and account for it on the usage caps.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice