Bandwith usage well under

[moz]

Hi all. I'm new to the forums here, new to posting but have tried to google through here before. The answer is probably there and I've missed it.. but I've installed gargoyle 1.4.3 pm a netgear wndr3700v2.
It is set up as a gateway to my BiPAC 7800N. Gargoyle handles all wireless traffic.

I had set up Gargoyle to help me trace down some unusual internet usage. My internet usage has been between 1 to 2 gigs per day, where it should be around 400MB unless we download something. So I'm trying to account for the remaining downloads, and unfortunately, gargoyle hasn't answered my question.

Today, bandwith usage is sitting at 130MB however my ISP is showing 1060MB. That's a pretty big discrepancy. Anyone got any tips as to what to do to try and account for all downloading activity?

Incidentally, the web usage page doesn't show anything, although the enable web usage monitor has always been ticked...

Thanks in advance.

[DoesItMatter]

What that sounds like is someone might have hacked your
Billion BiPac router and is using your internet.

Logon to your Billion and change your password for your wireless.

Make it really complex with lots of special characters and try
to go for at least 25+ characters for a password.

Also make sure you are using WPA2-AES for the Billion wireless password.

[moz]

Thanks for your response.
I am using the Netgear with Gargoyle to manage the wireless.
While my password isn't very strong, and I'm only using WEP, I do monitor the connected hosts. Each address listed there, both in the Connected Wireless Hosts and the Current DHCP leases, I have been able to verify is an approved device.
While the billion device handles the internet connection, the only thing plugged into it is the Netgear with Gargoyle.
So if anything wireless is using my internet, I would assume that it would be shown in the connected devices and therefore show usage?

[pbix]

I would use the command 'ifconfig' at the command line to get a bullet proof accounting of how many bytes went through your gargoyle WAN interface. In your case the WAN interface is probably eth1.

Keep track over a couple of days. You can trust those statistics for accuracy in that they account for absolutely anything that goes through the interface regardless of source.

I have a situation with a satellite ISP. Their accounting says I am using 30% more that my accounting said. Naturally the "error" is in their favor and as a result no proper investigation was done as it would have been if the tables were reversed. Hope you have better luck.

[Eric]

You can probably track down a little more information by using the "Bandwidth Distribution" page. This should show you what IP address/hostname used the bandwidth. That way you can check whether that IP/host is from a device currently connected to your network.

The connected host page only shows hosts that are currently connected to your network -- it's possible that someone connected and then disconnected while you weren't looking.

However I agree with pbix that if Gargoyle is showing you lower numbers than your ISP, I doubt that the problem is someone unauthorized connecting to Gargoyle. In that case, either someone got access to your Billion router, your ISP is wrong, or there is a bug in Gargoyle (it's possible, though I've put a lot of effort into making sure the bandwidth monitor is correct, and a log of users have reported that it works well for them).

[mix]

You know the difference between a megabit and a megabyte right? Here is a hint, it's a factor of 8.

[moz]

Thanks for the suggestions guys. This one has still got me scratching my head. Today, I upgraded my Billion to the latest firmware and reconfigured it from factory defaults, and also did the same to my Netgear upgrading it to Gargoyle 1.4.4 and also reconfiguring from factory defaults.

Since doing this, Gargoyle has recorded a total of 64MB whereas actual internet usage surged ahead by 785MB in a space of around 10 hours.

I am wondering if the usage is by something that is not listed on the connected host page?

The usage has been something I've been trying to track down over the past month, and lately, the daily usage has gone up and up and up, up to 2GB per day. I haven't done any downloading myself, and while others deny that they download anything, I have been trying to use Gargoyle to prove otherwise, but it is not giving me any data to use.

Maybe I have something wrong with my setup? I have the 7800N (192.168.0.1) handling the connection through its EWAN port to a fibre box. The Gargoyle (192.168.0.2) box connects to the 7800N by Gateway. Could other devices be somehow directly going to the 7800N bypassing the Gargoyle box and thus not having its usage recorded?

[hnl_dk]

...
Maybe I have something wrong with my setup? I have the 7800N (192.168.0.1) handling the connection through its EWAN port to a fibre box. The Gargoyle (192.168.0.2) box connects to the 7800N by Gateway. Could other devices be somehow directly going to the 7800N bypassing the Gargoyle box and thus not having its usage recorded?

Do you have any machines setup manually?
And what is the DHCP settings?
What router do you have setup as the gateway?
If you want everything to go through your Gargoyle router, do you need 192.168.0.2 to be in the gateway field (you can try to check it on the status page of your computers).

How to find the DHCP info on WinXP (I know this is in Danish, but you get the point)

status_1.png (5.26 KiB) Viewed 9892 times

How to find the DHCP info on WinXP - picture 2 (I know this is in Danish, but you get the point)

status_2.png (18.4 KiB) Viewed 9892 times

[DoesItMatter]

Keep the troubleshooting very simple...

Try this:

http://www.analogx.com/contents/downloa ... eeware.htm

Grab that Netstat Live and install on your PC

Very good freeware monitoring tool for network activity

Unplug everyone else and disable wireless for a certain timeframe.

Make sure your computer is the ONLY connection

Then do some downloading / web-surfing / etc. and compare numbers

If Netstat Live on your PC matches your provider / Gargoyle,
then that means someone else on your network is doing downloading.

Like someone mentioned above - is there a chance that your
provider is listing usage as megabits while other stuff is
reporting usage as megabytes?

[mix]

I guess you are saying it's only a coincidence when you said "130MB however my ISP is showing 1060MB" is equal to 130 MB x 8 = 1040 Mbps

We don't know if your isp is counting the overhead associated with ADSL2 towards your total usage. I also don't see how you can tell when a "day" starts and stops in Gargoyle, and if this is the same exact time your isp is using as a "day." You could be comparing different periods of time.