I am downloading huge amounts of data from 152.195.12.171. I know this only because my ISP sent me a high usage warning. I cut the Orbi RBR50 out by disconnecting the Internet cable from it, connecting the cable directly to my desktop. The undesired downloading stopped. Next, I physically and logically disconnected all devices connected to the Orbi except the desktop and rebooted the Orbi. The downloading began again. It appears the Orbi is the source. The Orbi firmware is the latest version. Anyone experience anything similar? I'm totally at a loss. Thank you--Henry

Thanks, that was one of the first things I checked for. All of the devices connected were known to me.

https://whois.domaintools.com/152.195.12.171 Is this the IP address thats on the WAN or Internet portion of the routers web page currently? I would try full factory reset of the router and set up from scratch. Disconnect ALL devices from the router accept for 1 wired or wireless PC. Besuer the PC is scanned for any malware and or shut off any background running applications. You might boot into safe mode W/networking as well if you can't ensure that your PC isn't doing something. Whats the Mfr and model # of the ISP modem your using with the router?

Thanks for the response. That IP address was given to me by my ISP. High usage is unusual for me, so he looked at where the traffic was occurring and told me my system was downloading huge amounts of data FROM 152.195.12.171. There is no indication on my desktop of that activity, and the internal traffic monitor is not recording it. The one thing I did not do is a factory reset on the router, so I will do that. I have already followed your other suggestion, namely connecting only the desktop computer to the router (wired). All other devices have been disconnected. I use a good virus software, but ran a complete scan yesterday anyway with no negative results. The downloading is pretty consistent and I ran the desktop with the Internet directly connected to the desktop for over 24 hours with no downloading, which is why I suspect it is not the desktop computer. As soon as I connect the Internet cable to the Orbi, the downloading begins again. My ISP is a rural wifi provider. I have no modem--it must be built into the antenna on my house. Just the raw cable coming in that I attach to the router. I will try the factory reset and post my results. Again, thank you for the response. --Henry

Hope this will help. :smileyfrustrated:

I did as you suggested, reset the router to factory settings, then connected only the desktop. Within minutes of re-connecting the Orbi to the Internet, my ISP emailed me that the traffic had started again. He noted another IP address was involved in addition to the one I mentioned earlier and said there were probably others, too, but he didn't track them all down. It goes in bursts, about once an hour, and the dowloading occurs for about 10 minutes at a time. I've cut the Orbi out again and will leave the connection directly to the desktop for another 24 hours to insure it remains quiet. I guess I have no choice but to contact Netgear Tech Support at this point. Thanks for your interest, and let me know if you think of something new to try. --Henry

Undesired Traffic | NETGEAR Communities

16 Replies

FURRYe38
Guru
Jun 05, 2018
https://whois.domaintools.com/152.195.12.171

Is this the IP address thats on the WAN or Internet portion of the routers web page currently?

I would try full factory reset of the router and set up from scratch. Disconnect ALL devices from the router accept for 1 wired or wireless PC.

Besuer the PC is scanned for any malware and or shut off any background running applications. You might boot into safe mode W/networking as well if you can't ensure that your PC isn't doing something.

Whats the Mfr and model # of the ISP modem your using with the router?
- HenryWinchester
  Tutor
  Jun 05, 2018
  Thanks for the response. That IP address was given to me by my ISP. High usage is unusual for me, so he looked at where the traffic was occurring and told me my system was downloading huge amounts of data FROM 152.195.12.171. There is no indication on my desktop of that activity, and the internal traffic monitor is not recording it.
  
  The one thing I did not do is a factory reset on the router, so I will do that. I have already followed your other suggestion, namely connecting only the desktop computer to the router (wired). All other devices have been disconnected. I use a good virus software, but ran a complete scan yesterday anyway with no negative results. The downloading is pretty consistent and I ran the desktop with the Internet directly connected to the desktop for over 24 hours with no downloading, which is why I suspect it is not the desktop computer. As soon as I connect the Internet cable to the Orbi, the downloading begins again.
  
  My ISP is a rural wifi provider. I have no modem--it must be built into the antenna on my house. Just the raw cable coming in that I attach to the router.
  
  I will try the factory reset and post my results. Again, thank you for the response. --Henry
  - FURRYe38
    Guru
    Jun 05, 2018
    Hope this will help. :smileyfrustrated:
sdsponger
Aspirant
Jun 06, 2018
That IP belongs to the Symantec Live Update ecosystem
FURRYe38
Guru
Jun 06, 2018
Lets try this, set a different SSID name and PW on the wireless portion of the router. Don't connect up any wireless devices, just leave them off line for now. This will prevent any wireless devices from connecting.

Wire connect up your PC to the back of the router. Boot your PC into Safe mode with Networking. Hit F8 right after you see the BIOS start screen during the reboot process. This will prevent any background running apps from causing any false positives or anything else. You might get on the phone with your ISP tech while your doing this and have them watch there logs for anything suspicious. Open IE11 and see if you can go to your ISP web site to start.

Let us know if yoru ISP sees anything. Hoping this might help narrow down whats happening and where.

Do you have your prior router by chance? Might try connecting that router back online and see if it exhibits the same thing or not.
FURRYe38
Guru
Jun 06, 2018
Hmmm:

https://community.netgear.com/t5/Orbi/Orbi-RBR50-F-W-2-1-4-10-Router-Continuously-Attempts-to-Seek/m-p/1586098/highlight/false#M33093
- HenryWinchester
  Tutor
  Jun 06, 2018
  Thanks for pointing to the most recent post about a possible download loop to the netgear updates site. Sounds like my problem.
  
  I did not employ your latest suggestions, partly because I fear they are beyond my novice-level ability, and partly because the last test I ran was to disconnect EVERYTHING from the router except the Internet cable and ran it that way for 2 hours. Checked with my ISP afterwards and the downloading continued, so I am convinced the problem has nothing to do with my desktop or any other device--the router itself is doing this.
  
  My problem began on April 28 and was only noticed by my ISP when he did his monthly "who went over their data limit" check. This problem can't be just mine, so I'm wondering how many others will be chiming in with the same problem in the near future since it has been just over a month.
  
  I'm beyond my complimentary tech support help period and I'll be hanged if I am going to pay them to inform them of a problem with their product that I have not caused. I may pursue warranty replacement, but I suspect any replacement product will exhibit the same problem.
  
  Thanks for all of the suggestions--I will continue to watch the discussions. In the meantime, I've run out of grace with my ISP and will have to disconnect the router.
  - FURRYe38
    Guru
    Jun 06, 2018
    You might try the blocking suggestion and see if this help any when you get sometime. Ya, this seems to be something going on with the Orbi router. Should not be happening.
    
    DarrenM
FURRYe38
Guru
Jun 07, 2018
Sounds good. Let us know how the new one works out. Hope it will fix what ever is going on. :smileyfrustrated:

Forum Discussion

Undesired Traffic