Where is my data going? And why is it so spartatic

[kd_special]

I have been using Rogers for over 15 years now. I have never had any issues. I use around 80 to 120 Gigs a month of Internet Data usage with a fmaily house hold. I have  netflix (Lowest bandwidth setting), One Mac Mini, A PS3, and a  Vonage phone and a few iPads. thecomputer is maybe used an hour a day if lucky and is mostly in sleep mode. 

We rarely go over our usage I think once in the last  2 years around xmas. Now all of a sudden in the past 2 months I have used well over 1000 Gigs of my home intenet data plan. I didn't really look at it last month when i got the notices as I assumed I was going to be slighty over because the kids were watching more netflix or somthing. Then the flags went up this billing period as in 5 days of my billing cycle im almost at 700 Gigs!

With in five days my usage looks like this. 

September 25, 2014 --- 1,230  MB

September 24, 2014 --- 264,488   MB 

September 23, 2014 --- 333,448 MB

September 22, 2014 --- 4,568  MB

September 21, 2014 --- 1,262 MB

I called support and they did confirm last billing peroid (Aug 21st - Sept 21st) I did over or come close to 300 gigs on 3 or 4 seperate days.

This is wrong, there is no way that I am racking up that much data in one single day with the devices I have. As well for it to be so sparatic like this. I have all the passwords set for wifi and the router login. Also I have no unusal ports open and have a DHCP lease time of one week and see no strange IP entrys besides the static IP address for the devices I have listed. 

Tech supports simple answr was I have a virus and its my fault. I honestly dont even think my connection can go that fast to download that much data in one single day. This is frustrating.

Whats even worse is tech support can't tell me which IP address is using all the bandwidth to help me trouble shoot the issue. none of those devices have viruses. Or any virus that would rack up stats of data usage like that. Im using the  CGN3ROG LOGIN HitTron modem with router built in. 

Is this thing being hacked for inernet use? I really doubt my neighbours are smart enough or have the need to do so. And also I would or should see them come up in the DHCP lease table if they were. When i look at my IP dhcp leased addresses for the past 5 days I dont see any other devices but my own,

Im really frustrated and will not accecpt these bills. As there is no reason why this should be happening and if it is indeed happening tech support should be able to help me trouble shoot it with out saying "You have a virus sir" They cant give me any information and are not willing to help me out. They are willing to give me one month with no overage costs which is nice but doesn't resolve the issue at all. 

It may be time to leave Rogers as they just don't believe me that Im not racking up this sparatic traffic. If I am racking up this outragous traffic, Prove it!!! and help me determine where it is comming from. Give me an Ip address or a time of the day when its happening Somthing I can use to do some digging here on my end. To Find this so called "Virus" Which i believe is non exsistant. how can they track the traffic for billing purposes but have no information about the traffic. Or prove to me that its happening. 

They said there is no logs in this router that will tell me when the traffic is happening Or on what IP. And they can magically monitor my usage for billing purposes but can not tell me when or where the traffic is going. I just don't believe that. 

Signed ---- long time rogers user extreamly frustrated.

***edited labels***

[Gdkitty]

They are most right in the case of that they can't tell you exactly where it's comming from internally.
Their usage is tracked as it comes out of the modem, that's where it ticks, so it doesn't really know what internal source it comes from. Even most 3rd party routers will not do it per ip if they have any form of usage monitoring... You usually have to get into custom firmware and specialty firewalls, etc.

One thing as min short term I would suggest is to swap the modem. This would eliminate the possibility of Mac address cloning.

The hard part with this is to have to check and 100% eliminate that it wasn't internal... Because if it was could happen regardless of carrier.

[aldinhopele]

Hi kd_special,

I defintely think this is a Rogers problem.

Over the last two months this has happened too.

One day, my wife and I used 250GB. Including one day when we weren't in the house.

2 investigations were started because we had an overcharge of $1,400.

In 2 years we had never come close to using 120GB (our limit) in one month.

Our bill was reset.

Now this month...we have another 75GB usage in one day. I think Rogers know this is a problem, hence MyRogers being down for 10 day. Anyone else with the problem?

September 09, 2014 3,177

September 08, 2014 1,014

September 07, 2014 74,078  

September 06, 2014 575  

September 05, 2014 1,520

[Gdkitty]

The myrogers was down for other issues
(System overload, etc around the iPhone reservations)

I usually check mine daily or every other day, and no issues here.
(But being a sys admin I am a little more critical of my network and monitor things in the house insanely more close than the average person would)

[kd_special]

Thanks for the replys guy. Honestly I fugured nothing would come form this post. Mac Adress cloning is where I think this issue may come from. After reading up on how that works it seems very possible. I had no idea somone could do that. 

My first plan of action is to swap my Modem. The second plan of action is to only use their modem as a modem only and use my own router. Just to hammer it in a bit more and make it more secure. I'd imagine since there thousands of these Modem/Routers out there hacking them is extreamly simple. 

I am going to start there and it will hopefullly end there. And fight with Rogers over the bill. Hope fully the issue goes away and then Ill only ave two months of rediculious overages to fight about.

Ill try that first.

kd

[koochigoo]

We are getting robbed.  Seems like a lot of people having the same issues.  Their first suggestion is to go unlimited which they can rob you twice as much for something you don't use.  I've been dealing with Rogers for 4 weeks and still no resolution.  Their way is "always your fault", you have a malware.  If I see another outrage charge on my data, I will be canceling for sure. Take a look.. 262 gb in one day and lots of 105, 75.. and we don't download and we do pretty much the samething daily.. that usually 2-4 gb.

September 29, 2014 2,357 

September 28, 2014 74,483

September 27, 2014 105,48  

September 26, 2014 2,604

September 25, 2014 2,133

September 24, 2014 1,729 

September 23, 2014 3,086

September 22, 2014 1,898  

September 21, 2014 2,869

September 20, 2014 4,246   

September 19, 2014 1,695  

September 18, 2014 502

September 17, 2014 1,273

September 16, 2014 4,031

September 15, 2014 15,314

September 14, 2014 2,512   

September 13, 2014 262,552

September 12, 2014 5,252 1

September 11, 2014 4,509

September 10, 2014 2,586   

September 09, 2014 59,899

[wayner92]

It is hard to believe that you used 333 GB in a day as that means that your modem was transferring data at 30Mbps every second of the day.

By my calculation 1 Mbps = 10.8GB/day.

1Mbps = 3600 Mbph = 450MBph = 1800 MBpd = 10.8 GB/d assuming 1GB =1000MB

FYI - it is possible that Rogers is having some trouble with their tracking.  My Daily internet usage contains no data from Sep 19-25 - it skips from Sep 18 to Sep 26.  For the most part this coincides with the outage at MyRogers. 

[aldinhopele]

kd_special and koochigoo.....I'm so glad someone else is in the same boat.

Last month...

Daily Total (MB)
  September 02, 2014     1,240     
  September 01, 2014     2,319     
  August 31, 2014     6,111     
  August 30, 2014     613     
  August 29, 2014     3,096     
  August 28, 2014     2,316     
  August 27, 2014     1,626     
  August 26, 2014     305     
  August 25, 2014     15     
  August 24, 2014     1,153     
  August 22, 2014     6,224     
  August 21, 2014     39,338
  August 20, 2014     35,894     
  August 19, 2014     3,926     
  August 18, 2014     1,448     
  August 17, 2014     55,137     
  August 16, 2014     29,228     
  August 15, 2014     4,243     
  August 14, 2014     1,557     
  August 13, 2014     1,399     
  August 12, 2014     1,689     
  August 11, 2014     232     
  August 10, 2014     1,721     
  August 09, 2014     5,529     
  August 08, 2014     691     
  August 07, 2014     2,881     
  August 06, 2014     1,070     
  August 05, 2014     235,355     
  August 04, 2014     337,123     
  August 03, 2014     82,050    

and ths month.....

  September 30, 2014     3,876     
  September 29, 2014     3,110     
  September 28, 2014     76,451     
  September 27, 2014     4,152     
  September 26, 2014     2,499     
  September 25, 2014     1,512     
  September 24, 2014     1,767     
  September 23, 2014     2,591     
  September 22, 2014     3,457     
  September 21, 2014     4,383     
  September 20, 2014     432     
  September 19, 2014     509     
  September 18, 2014     1,582     
  September 17, 2014     2,117     
  September 16, 2014     573     
  September 15, 2014     3,938     
  September 14, 2014     2,684     
  September 13, 2014     5,363     
  September 12, 2014     1,914     
  September 11, 2014     2,466     
  September 10, 2014     1,744     
  September 09, 2014     3,177     
  September 08, 2014     1,014     
  September 07, 2014     74,078     
  September 06, 2014     575     
  September 05, 2014     1,520     
  September 04, 2014     1,551     
  September 03, 2014     1,257

Can anyone beat 337GB in one day. Equivalent of watching 300 movies in one day. Even if I was downloading 300 movies I don't have the space on any computer to store them! Major problem at Rogers I think.

Rogers solution is go unlimited of course. Now onto 3rd investigation. Rogers won't reveal what the results of their first 2 investigations were and they waved the overage charge last month without me having to complaint I think that says something is up with their tracking. Let's see what they do this month. Cloned modem? I'm concerned that illegal actvity is happening and my wife and I are totally unaware. Can't trust my ISP.

[Gdkitty]

Thing is.. if it was a tracking problem..  you would think there was MORE people with the same issues?

I know my tracking is pretty much bang on.  I know most averages for the basic stuff i use, and monitor what biger downloads, watching is done.. and they usually all fall within a few 100 mb of my estimate.

This is not to say, that its something on YOUR side either.

UP to 20g extra? maybe.. some weird download, virus, etc.  At some of those values.. a little big.

But for those values.. likey something more is going on.

THere have been ALOT of reported cases.. of MAC cloning of modems.  This is quite a big possibility.
Groups/people, not sure exactly how, are obtaining the MAC addresses of exisiting modems out there.. and cloning them on their own modems.  Attach them into any rogers connection... and they are downloading off of someone ELSES plan for all intesive purposes.
Pulling 300+g.. if it was someone STEALING.. running a WHOLE TON of torrents (which is quite likely if they are doing illegal stuff), maxing out the connection speed, is still within a doable range if done for over 24 hours.

One thing in the long run to help eliminate things... would be to SWAP your modem for another... same model or different.. at least then you are on a different MAC and eliminate the above from the situation.

[aldinhopele]

The most helpful Rogers employee I have dealt with so far was through Twitter, believe it or not, who suggested after a long string of DMs to take the router back to a Rogers store and swap it out. So that's what I'm doing tomorrow for the start of the new billing cycle. This present modem had not been wiped. I.e. I could see the name the previous owner had assigned to the modem AND the password! Which was quite alarming. I had to call Rogers so they could reset the modem remotely.

Then of course the weird usage happens. It's frustraing constantly calling Rogers and explaining that the passwords have been changed, there are no viruses, I don't use P2P. Doubly frustrating when they say "Have you been watching Netflix?". I explained I would have to have 30 TVs running simultaneous Netflix movies for 24 hours to get those download overcharges.

I had something life 860GB usage for the month ($1400) overcharge. Equivalent to watching 3000 hours worth of movies.......even through a calendar month only has 740 hours.

[Gdkitty]

Yeah.. while i understand, that yes.. there are LOTS of users, who start using netflix, and dont realise WHAT the usage is, that it takes up etc..

It seems to be a FALLBACK to blame on.

A small higher amount? sure... but even they should realize that the larger amount, is something else. 
It seems to be a lack of training.. knoledge, etc.. of the phone reps 😞

HOPEFULLY the swapping modems will help you.

Good luck.

[kd_special]

I believe cloning is happening far more than Rogers would like to admit. An yes their phone support are not educated on the issue. I have swapped my modem and will track the usage for the next month. If it goes away I will be calling Rogers. Telling them to not charge me
Overages for the last two months and I will go from there. If they can't do that for a 15 yr plus customer I'm leaving. As they can not give me any evidence I have used this data.

They know something is wrong. They just can't admit it. I'm in Ontario is this happening to others in Ontario? In the GTA?

Kd

[Gdkitty]

The problems in these cases.. is the 'one person ruins it for everyone' scenarios.
It comes down to.... and this is not saying that YOU DID use it... but there is no proof that you DID NOT either.
The amount of poeple that would go OVER... quite possibly on PURPOSE.. then call in and say "Hey, it wasnt ME!!!" and then not get charged for it?  People would abuse the system 😞

So its not always easy 😞

I am not saying to NOT fight it.  Please do!.. its important.. and hopefully they may eventually realise to start figuring out something MORE to figure out whats going on.

Hopefully they can work something out, etc..

I have seen the same sort of reports from a few carriers (all cable ones.. as i dont think the same sort of setup is as easy to do say on DSL and other forms of internet)..
If you do swtich.. look around, and do ALL yorur research first.  Dont just jump on the next cheapest guy.  Look on forums and find out other comments about the service.  Find others in your area with that service and see how it is there (could be GREAT in A, but SUCK in B).  Double check on what their overage scenarios are, just incase they have something SIMILAR or even WORSE 😛

[kd_special]

Ohh I do not want to leave rogers. Like I said before I have beena 15 + year customer. Its more the fact that they refuse to admit that there is a problem. As well they give me zero options to trouble shoot the problem. I have no intention of leaveing I will only leave if they refuse to aknowledge that I have gone out of my way to try and find a solution and better prepare myself for my defence in fighting somthing that they ultimatly have the final say in. 

If they want to deny this customer a 200 dollar credit as im sure that now since I have gotten a new modem these freak data usages will dissapear at least for a few months and hopfully forever. Than they dont deserve my business. 

I have set my router up so that only known Mac addresses can connect eliminating the possibilty of outsiders guessing my wifi passwords or tunneling in on port 80 or 22 etc. Not there was any evidence of that at all in the first place (As I have a 1 week DHCP Lease time and two days after the 300 gig days I checked the IP address in the router log and no unknown devices connected.  

Its basically like this I have done more than my share as a customer to prevent this from happing. If im doing my part and they will not do their part by offering a secure connection and modem. Than they do not appreciate my business and they dont deserve my business. Somone else does.

Ill keep everyone posted. as I monitor my usage daily now. 

[aldinhopele]

Hi guys, another case. I really wonder how prevalent this is?

http://goo.gl/Gfdzcp

[Datalink]

Yes, sigh, looks like another case.  Anyone have a twitter account they can use to reply to Mrs Brewer?

[Gdkitty]

I added a reply to her tweet.

The best I can figure is MAC cloning.

If it was bad metering, would be for longer periods, unlikely a bad one day fine the next.

From what I was reading about MAC cloning is they tend to rotate every 1-3 days, so less likely to be noticed. Would match up that a lot of these users only see the spikes for a day or two.

[kd_special]

Well all was good for a few weeks. Now the problem has happened again. Yesterday 465 Gigs in one day. And a day where no one was home for even half the day. on a 24 hour clock thats 19 gigs an hour. No New IP address in the DHCP table and no new connections/ No unknown MAc addresses.

I don't know what to do now. 

Somonme could have taken this modems mac address again or they already had the MAC address and i simply got a returned modem from the store.  Now im going to have to call Rogers and have a fight with them and maybe unfortunatly cancel. I see no way for them to help me track this down or resolve the issue. 

The last managers i spoke to all agreed that this seems odd and they believe its fraud but them nor I can prove it. I may have to switch to another provider as im sure they wont  keep crediting my bill.. Which i really don't want to do I like Rogers and I need a new cell phone plan so i wanted to tie them togethr,.

Dang it.

[Gdkitty]

Have you swaped your modem from the inital time above that it happened?

If not.. they likely rotated around to your MAC again..

Swaping to a new one.. would at least give you a new MAC, thats NOT the same... but its not to say, that they dont have that one on their list either. 😞

[Datalink]

PM sent. Please check your email.

[kd_special]

So heres the new information I know.

I swapped out my modem/Router CEN3ROG (Hibtron) a few weeks ago and was watching the usage daily 1 to 5 gigs normal usage. The Oct 27 476 Gigs  thats 19 Gig per hour. 

No new Ip address connections no unknown devices or mac addresses.  I have no idea what to think?

Perhaps this Mac address of this modem was already known.

Tech support wants me to unplug my modem for 24 hours. then they can look at tracking the data. I will start with that and go from there. 

kd