NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

Notanetworknerd's avatar
Notanetworknerd
Follower
Jan 17, 2023

RBR40 - how to determine bandwidth consumption

Hello, NetGear community!

I'm having a "discussion" with my ISP, who claims that I'm using a ton more data than I have historically used.  But they're also claiming that they can't "see" what MAC is being so greedy.


All laptops are up-to-date on security and scans.  
I have an RBR-40 with one satellite, and firmware is also up to date.

I've searched all over it, but other than the logs (which are showing only typical port-scan sorts of things) I cannot find anything that will help me identify the offending MAC that's eating all the data.

Can someone point me in the correct direction?  I'm not a netwoorking nerd, but I am in IT and can follow directions excellently.


Thanks very much for any help you can offer!

2 Replies

Sort By
  • plemans's avatar
    plemans
    Guru
    Jan 17, 2023

    There isn't an option to track "by device" bandwidth. Its one of the most common requests. 

    I've ran into it before to. 

    It happened with one of my computers got a miner installed on it and was burning through data unexpectedly. 

    I found it by shutting off all my devices and running groups of them for a day. Then I'd check my daily usage of data and it allowed me to narrow it to a specific group and from there it was pretty easy to determine which it was. 

     

    if you have devices on windows, you can check their data usage that is built into windows. 

     

  • CrimpOn's avatar
    CrimpOn
    Guru
    Jan 17, 2023
    Notanetworknerd wrote:

    But they're also claiming that they can't "see" what MAC is being so greedy.

    They are correct.  Residential router use Network Address Translation (NAT) to give the appearance of all activity coming from a single IP address. https://en.wikipedia.org/wiki/Network_address_translation 

     

    plemans is right. Customers have been asking for this capability since 2018 and it has the most support of any suggestion:

    https://community.netgear.com/t5/Idea-Exchange-For-Home/idb-p/idea-exchange-for-home/tab/most-kudoed (435 Likes plus 127 on a similar request).

     

    Aside from the process of elimination, there is another way to search for the "offender":

    • Use the debug feature to capture LAN/WAN traffic
      On the Orbi debug page, http://orbilogin.net/debug.htm,htp://orbilogin.net/debug.htm
      Enable LAN/WAN packet capture
      Start Capture
      Wait an hour or so
      Save Capture
    • This will save a file debug-log.zip to your computer.
      There are two files of interest: lan.pcap and wan.pcap
      Extract them from the zip file.
    • Use a program designed to read pcap files (Wireshark is free for Windows)
    • Open either wan.pcap or lan.pcap and selecct the Statistics option "Conversations"
    • There is a chance that something will "pop out" in the sense of "WTF?  What's all this talking to *&^%.com"???
    • I would not try this when there are a bunch of devices streaming video and "Zooming" because those will generate very big Conversations.