Security Passwords for Admin and the RBR750

[Phyber]

For security reasons, is it a good idea to have a totally different password for the Admin web access to the settings pages as well as the RBR750 password for WiFi access (home users)?

[CrimpOn]

I would vote, "Yes". Under most circumstances customers elect to use the same (exactly) SSID/password on their home WiFi for years as they transition from one system to the next (and the next).  I have kept the same SSID/password for 20 years. While I have routinely shared my WiFi with guests, friends, family, etc. I have never shared the admin login password.

[Phyber]

I've never shared my admin pw but it is the same as my WiFi pw ☹️. The Guest Network has a separate SSID and password. I will change my admin pw to something else.

The reason I ask is that there has been a huge increase in our data usage this month and we haven't changed our usage habits so I'm afraid that someone else is using our network. Nothing is squirrely or out of the ordinary other than the huge increase in data usage. I just changed the pw to the GN but haven't changed the admin (via web access) or WiFi. Out of the two, I would think that the admin pw would be the first I should change.

I do have Access Control enabled and Allow all new devices to connect. The devices listed are all ones that I recognize so nothing is unusual. However, I do not have the boxes to the left of each device checked because I'm not sure if I need to do so or not. My networking skills are very basic at best. Pretty much just plug and play.

[CrimpOn]

 

---

@Phyber wrote:

The reason I ask is that there has been a huge increase in our data usage this month and we haven't changed our usage habits so I'm afraid that someone else is using our network. Nothing is squirrely or out of the ordinary other than the huge increase in data usage.

---

Oh, something has changed and the task of discovering exactly what changed is not trivial.  This is one area where Netgear's product definitely "falls short" of expectations. Other routers, including the Open Source OpenWRT that the Orbi is based on are able to identify data usage by device.  This has been the top requested feature addition since 2018. (See https://community.netgear.com/t5/Idea-Exchange-For-Home/idb-p/idea-exchange-for-home  Items 1, 4, and 10 with a total of 663 Kudos)

If all the devices connected to the system are legitimate, then no one is pirating the internet connection.

The only tool that Netgear provides is a Traffic Meter feature on the web administration Advanced Tab.  See page 92 of the User Manual: https://www.downloads.netgear.com/files/GDC/RBK752/RBK752_UM_EN.pdf 

For example, you could record the values for "Today" at one hour intervals to determine what the general pattern of internet traffic.  Maybe specific hours of the day consume more data than others.  Perhaps there is a computer that have some background process that runs constantly.  There are a number of ways to monitor Windows usage by application.  (Know nothing about Apple.)

[Phyber]

Thanks. We don't use hardwired computers (all WiFi) and it's usually just the two of us.

We have Xfinity but use our own modem (Motorola DOCSIS 3.1). I'm thinking that if there aren't any unauthorized users, or devices left on (other than the security cameras) then there is an issue on the Comcast side and how they are calculating our data usage.

Comcast claims that the average data usage for households is 397GB per month. We've averaged 434GB over the previous 5 month period but this month we are up to 987GB.

I have seen the Traffic Meter and it is set to defaults. I'll see if I can figure out how to do the Today, from say 8am to 10pm and see what it indicates. If I set it to Today, with those parameters, will it record everyday going forward until I disable it?

Thanks for your time.

[CrimpOn]

Double the usage certainly points to "something changed".  The tools I would use are simply not available to you.**

I wonder if Xfinity can provide any detail about your usage?

**  Having a desktop computer with Ethernet, I would tap directly into the link between Orbi and the ISP router and capture every packet of data that flows between them for several hours.  One third of a day might be about 10GB of data.  Then use Wireshark to display the "Conversations" that were recorded.  Search for the owner of the IP address with the most traffic and that might provide a clue as to which device is responsible.

Another tool is an option on the Debug page (http://orbilogin.net/debug.htm ) to Enable LAN/WAN Packet Capture.  Let the router record everything that goes through for an hour, save the debug-log.zip file and look at two files inside it (lan.pcap and wan.pcap - on the 750 they are called BR.pcap and eth0.pcap)  Wireshark can identify the 'Conversations' with the most data usage.  Wireshark is available for Windows, MacOS, and Linux (https://www.wireshark.org )

[Phyber]

Xfinity Security said they would contact me in two weeks after I changed passwords and contacted Ring to see what they can see on their end (which is nothing). My guess is that they will be of little help other than to try and tell me that I need to use their gateway (at a monthly charge) or upgrade to their Unlimited Data, which is really expensive. I don't need more than the allotted 1.2TB so I'm hoping the admin and GN pw changes will resolve the issue.

I'll try the debug option but that is above my pay grade as far as understanding what I'm doing. I do have a current Mac so hopefully Wireshark is available for it.

Thanks.