Undesired Traffic

[HenryWinchester]

I am downloading huge amounts of data from 152.195.12.171.  I know this only because my ISP sent me a high usage warning.

I cut the Orbi RBR50 out by disconnecting the Internet cable from it, connecting the cable directly to my desktop.  The undesired downloading stopped.  Next, I physically and logically disconnected all devices connected to the Orbi except the desktop and rebooted the Orbi.  The downloading began again.  It appears the Orbi is the source.  The Orbi firmware is the latest version.

Anyone experience anything similar?  I'm totally at a loss.  Thank you--Henry

[FURRYe38]

https://whois.domaintools.com/152.195.12.171

Is this the IP address thats on the WAN or Internet portion of the routers web page currently?

I would try full factory reset of the router and set up from scratch. Disconnect ALL devices from the router accept for 1 wired or wireless PC.

Besuer the PC is scanned for any malware and or shut off any background running applications. You might boot into safe mode W/networking as well if you can't ensure that your PC isn't doing something.

Whats the Mfr and model # of the ISP modem your using with the router?

[HenryWinchester]

Thanks for the response.  That IP address was given to me by my ISP.  High usage is unusual for me, so he looked at where the traffic was occurring and told me my system was downloading huge amounts of data FROM 152.195.12.171.  There is no indication on my desktop of that activity, and the internal traffic monitor is not recording it.

The one thing I did not do is a factory reset on the router, so I will do that.  I have already followed your other suggestion, namely connecting only the desktop computer to the router (wired).  All other devices have been disconnected.  I use a good virus software, but ran a complete scan yesterday anyway with no negative results.  The downloading is pretty consistent and I ran the desktop with the Internet directly connected to the desktop for over 24 hours with no downloading, which is why I suspect it is not the desktop computer.  As soon as I connect the Internet cable to the Orbi, the downloading begins again.

My ISP is a rural wifi provider.  I have no modem--it must be built into the antenna on my house.  Just the raw cable coming in that I attach to the router.

I will try the factory reset and post my results.  Again, thank you for the response.  --Henry

[FURRYe38]

Hope this will help.

[HenryWinchester]

I did as you suggested, reset the router to factory settings, then connected only the desktop.  Within minutes of re-connecting the Orbi to the Internet, my ISP emailed me that the traffic had started again.  He noted another IP address was involved in addition to the one I mentioned earlier and said there were probably others, too, but he didn't track them all down.  It goes in bursts, about once an hour, and the dowloading occurs for about 10 minutes at a time.

I've cut the Orbi out again and will leave the connection directly to the desktop for another 24 hours to insure it remains quiet.  I guess I have no choice but to contact Netgear Tech Support at this point.

Thanks for your interest, and let me know if you think of something new to try.  --Henry

[FURRYe38]

Ok, Let us know how it goes...

@DarrenM

[sdsponger]

That IP belongs to the Symantec Live Update ecosystem

[HenryWinchester]

No, no Ring products.

[FURRYe38]

Lets try this, set a different SSID name and PW on the wireless portion of the router. Don't connect up any wireless devices, just leave them off line for now. This will prevent any wireless devices from connecting.

Wire connect up your PC to the back of the router. Boot your PC into Safe mode with Networking. Hit F8 right after you see the BIOS start screen during the reboot process.  This will prevent any background running apps from causing any false positives or anything else. You might get on the phone with your ISP tech while your doing this and have them watch there logs for anything suspicious. Open IE11 and see if you can go to your ISP web site to start.

Let us know if yoru ISP sees anything. Hoping this might help narrow down whats happening and where.

Do you have your prior router by chance? Might try connecting that router back online and see if it exhibits the same thing or not.

[FURRYe38]

Hmmm:

https://community.netgear.com/t5/Orbi/Orbi-RBR50-F-W-2-1-4-10-Router-Continuously-Attempts-to-Seek/m...

[HenryWinchester]

Thanks for pointing to the most recent post about a possible download loop to the netgear updates site.  Sounds like my problem.

I did not employ your latest suggestions, partly because I fear they are beyond my novice-level ability, and partly because the last test I ran was to disconnect EVERYTHING from the router except the Internet cable and ran it that way for 2 hours.  Checked with my ISP afterwards and the downloading continued, so I am convinced the problem has nothing to do with my desktop or any other device--the router itself is doing this.

My problem began on April 28 and was only noticed by my ISP when he did his monthly "who went over their data limit" check.  This problem can't be just mine, so I'm wondering how many others will be chiming in with the same problem in the near future since it has been just over a month.

I'm beyond my complimentary tech support help period and I'll be hanged if I am going to pay them to inform them of a problem with their product that I have not caused.  I may pursue warranty replacement, but I suspect any replacement product will exhibit the same problem.

Thanks for all of the suggestions--I will continue to watch the discussions.  In the meantime, I've run out of grace with my ISP and will have to disconnect the router.

[FURRYe38]

You might try the blocking suggestion and see if this help any when you get sometime. Ya, this seems to be something going on with the Orbi router. Should not be happening.

@DarrenM

[randomousity]

So, I haven't seen anyone else mention this, though it seems like @FURRYe38 was maybe alluding to it. Is it possible you have a rogue device on your network? E.g., a device belonging to a neighbor (roommate, family member) is connected to your wifi, and this device is the one sucking up all your data? This could explain why the excessive download only happens when the Orbi is connected to your ISP, and not when you bypass the Orbi. Changing the SSID and wifi password (or even only one or the other) would prevent devices from connecting wirelessly. You could look at Attached Devices under either Basic, or Advanced > Administration
and see all the connected devices, and you may find one you can't identify, which could be the culprit, rather than the Orbi itself. Changing either the SSID and/or wifi password would be a way of testing where the traffic is coming from, as the rogue device wouldn't be able to connect after the change.

[HenryWinchester]

Thanks, that was one of the first things I checked for.  All of the devices connected were known to me.

[FURRYe38]

I would try configuring some blocking on the suggestions made and see what happens. Seems this is all coming from the Orbi router.

---

@HenryWinchester wrote:

Thanks, that was one of the first things I checked for.  All of the devices connected were known to me.

---

[HenryWinchester]

FURRYe38--

I held off on the blocking experiment to see what progress I could make with Netgear (even if it worked, it would have been a work-a-round rather than a solution).  My Orbi is still under warranty, so I followed that link today to invoke a warranty replacement.  Success.  A replacement RBR50 is on the way.  90 minute call and $30 for priority shipping.  I still think they have an internal problem they are as yet unware of, but I remain hopeful.  I'll post once I try the replacement unit and my ISP has a chance to monitor it long enough to know whether I still have a problem.

Again, many thanks for your interest and suggestions.  And, my thanks to others who took the time to weigh in.

[FURRYe38]

Sounds good. Let us know how the new one works out. Hope it will fix what ever is going on.