Orbi RBK50 Massive data usage and traffic meter is half of what ISP sees

[AlmostHappy]

Since setting up my Orbi I have had great coverage and everything is running quite fast. I really want to love this thing, but the crazy data usage is kiling me.

I got an email from my ISP that I have gone over my monthly 1 TB data cap. This has never happened before. Going back through my monthly usage (from ISP) the last year every month is 550GB-650GB. The month I setup my orbi system (mid month) I hit 690GB. The next month 980GB. This month is already at 1050GB.

• There have been no new devices and usage habits are the same. 
• I verified the firmware is up to date (v2.5.1.8)
• Turned on traffic metering. All though it is just the basic total and not by device (that is another story......)

I have two months of data usage on the Orbi. My issue is what traffic meter shows is WAY off from what the ISP is seeing.

This month IPS = 1050GB, Orbi = 561GB.

Last month ISP = 980, Orbi = 620.

The totals Orbi shows me are consistent with what I have been using for the past year. After a ton of time on the phone with the ISP ( I was sure it was on their side) after shutting down my wifi (nothing hardwired) for a couple hours, Orbi shows no data in the traffic meter. However, the ISP shows 2.5GB. When I shut down the Orbi completely for two hours, there is no data usage from my ISP. What the hell is Orbi doing that uses that much data when there are no clients on it?  

I have only had this setup since Sept and really pissed that if I want a real traffic meter and a router that doesn't double my data usage I need a new router.

[CrimpOn]

Perhaps it would help to describe

• Which Orbi model this is, and exactly which firmware is running on it
• What is the Orbi connected to (brand/model)?
• Are all devices connected to the Orbi, or are some devices connected to the internet modem?

[AlmostHappy]

As it says in the post:
Model RBK50
Firmware v2.5.1.8

All devices are on WiFi to the Orbi and only the Orbi is connected to the cable modem.

[FURRYe38]

What is the Mfr and model# of the ISP modem the NG router is connected too?

---

@AlmostHappy wrote:

Since setting up my Orbi I have had great coverage and everything is running quite fast. I really want to love this thing, but the crazy data usage is kiling me.

I got an email from my ISP that I have gone over my monthly 1 TB data cap. This has never happened before. Going back through my monthly usage (from ISP) the last year every month is 550GB-650GB. The month I setup my orbi system (mid month) I hit 690GB. The next month 980GB. This month is already at 1050GB.

• There have been no new devices and usage habits are the same. 
• I verified the firmware is up to date (v2.5.1.8)
• Turned on traffic metering. All though it is just the basic total and not by device (that is another story......)

I have two months of data usage on the Orbi. My issue is what traffic meter shows is WAY off from what the ISP is seeing.

This month IPS = 1050GB, Orbi = 561GB.

Last month ISP = 980, Orbi = 620.

The totals Orbi shows me are consistent with what I have been using for the past year. After a ton of time on the phone with the ISP ( I was sure it was on their side) after shutting down my wifi (nothing hardwired) for a couple hours, Orbi shows no data in the traffic meter. However, the ISP shows 2.5GB. When I shut down the Orbi completely for two hours, there is no data usage from my ISP. What the hell is Orbi doing that uses that much data when there are no clients on it?  

I have only had this setup since Sept and really pissed that if I want a real traffic meter and a router that doesn't double my data usage I need a new router.

---

[1qwerty1]

AlmostHappy,

Check out my post "Outbound traffic to Amazon space" which discusses some outbound traffic from Orbi units.

If you have access to pi-hole and you use it as your internal DNS server, point your Orbi router to it for DNS resolution. Then, blacklist the following domains (remove []):

advisor[.]ngxcld[.]com
readycloud[.]netgear[.]com
readyshare[.]netgear[.]com
presence[.]ngxcld[.]com
registration[.]ngxcld[.]com
updates1[.]netgear[.]com

Or blacklist them on your firewall (tcp/443) if your firewall supports FQDN objects. I believe updates1 will prevent the unit from checking on the updates (via FTP protocol).

The worst one is the advisor one (I was seeing 8 packets per minute). This is some web analytics platform.

Let us know if your bandwidth usage goes down.

[CrimpOn]

---

@AlmostHappy wrote:

The totals Orbi shows me are consistent with what I have been using for the past year. After a ton of time on the phone with the ISP ( I was sure it was on their side) after shutting down my wifi (nothing hardwired) for a couple hours, Orbi shows no data in the traffic meter. However, the ISP shows 2.5GB. When I shut down the Orbi completely for two hours, there is no data usage from my ISP. What the hell is Orbi doing that uses that much data when there are no clients on it?  

---

How was WiFi "shut down"?  (I have wanted to do this and have not found the right "box to check".)

It might be interesting to capture the Network traffic using Orbi's debug feature:

Connect to http://orbilogin.net/debut.htm

Check the box "Enable LAN/WAN Packet Capture"

Check "Start Capture"

Collect data. (at a rate of about 1GB/hour, this will not take very long.  10 miinutes should be plenty)

Uncheck the box "Enable LAN/WAN Packet Capture"

Click "Save Debug Log"

The debug-log.zip file contains  two files: LAN and WAN.  These files are "PCAP" files that can be read with a number of free programs.  I use Wireshark, which is free for Windows and Mac (from http://wireshark.org).

The WAN file shows all traffic between the Orbi and the internet.  (If your ISP is like mine, there will be TONS of ARP broadcasts and garbage that can be filtered out by using a display filter with the public IP of the Orbi.)

The LAN file shows all traffic on the LAN side.

If WiFi is shut down, there should be nothing on the LAN side.  With Traffic Meter reporting zero, there should be nothing on the WAN side.

It would be tempting to suspect the ISP modem of playing some (evil) part in this.  If just having power on the Orbi, but no users creates 1GB/hour, something is amiss.  The ISP modem is "just a modem", correct?  No router? No WiFi?

[AlmostHappy]

@CrimpOn from the Orbi app I disabled every client. It is a bit of a pain as each disable causes a refresh so it takes a bit if you have a lot of clients.

I will try the debugging tonight and see what that shows.

As for the modem, it is my modem and not from the isp. I can’t think of the brand and model right now, but it is just a modem, no router or WiFi.

[CrimpOn]

---

@AlmostHappy wrote:
@CrimpOnfrom the Orbi app I disabled every client. It is a bit of a pain as each disable causes a refresh so it takes a bit if you have a lot of clients.

---

It  might be faster to just change the Orbi SSID. That should disconnect all of the clients at once.  Back when I was doing "Factory Resets" and setup from scratch (more times than I enjoyed), I would leave the Orbi with the default SSID until I had created all of my device reservations, DHCP pools, etc. etc.  THEN, I would change the SSID to my preferred one (I have kept the same WiFi SSID/Password  through the past four WiFi systems so that none of my devices need to be set up again.)  BOOM, everything would connect and get the IP address I wanted them to have.

The reason I ask about the modem is that strange phenomenon of the Orbi saying "nothing happening" and the ISP saying "1GB/hr".  I am looking for for packets to be flying around when only the two devices are active.

I also have never given much thought to what exactly an ISP measures in terms of "traffic."  Is it "up" and "down" both?  Does it count "broadcast" packets from other subscribers?  (i.e. I "receive" them, but I didn't ask for them, and don't "want" them.)

[AlmostHappy]

@CrimpOn WOW!! Even just 5 minutes running the debug is with only the router on (changed SSID, so much quicker) got so much. I installed wireshark and took a look at the wan file. Man I am lost. There is so much info in there and none of it really means much to me at a first glance. I will have to read up on the tool and what I am looking at.

@1qwerty1 I am going to pick up a pi and setup pi hole tomorrow. I will filter that list you posted and see if that helps. My ISP (Comcast) can't seem to find the right person to help me get data usage in realtime or even one day chunks (Monday's call they did, but now they don't have that access) and they can only see my current monthly usage. Once I get the pi hole running and block those sites, I should be able to compare my routers daily usage and just do the math for them (delayed by 24 hours).

Thank you all for pointing me in the right direction. I will update here after a few days of running it and see how things are going.

[CrimpOn]

Can you park the WAN and LAN capture files on cloud storage somewhere (Google Drive, DropBox, etc.) and post a link (or send me a private message with the link).  I am really puzzled what can be "going on" when the Orbi has zero devices connected.  Would love to look through the capture files.

[AlmostHappy]

@CrimpOn and @1qwerty1 

Just wanted to follow up on this. I got pi hole setup and added the 6 domains from above. After a couple of months running this, I have seen that since the pi started my bandwidth usage has gone back to what it was before the Orbi. 

Thank you all for the help and I am so glad I got that running.