Why am I having data overages on my MiFi?
rasgrif
Newbie

My usage was more than 150% again as much in the first month we had the Mifi than before when we had a 3G FiveSpot. And we still had the 3G hotspot for the first 8 days of that month. Granted, with my child home from college we asked to add a four more GBs but- 10GB to 26 + GB? Because of the mid billing change of plan, I could not track usage online but I called 2 days before the billing period ended and was told I still had 4 GB. Bercause of that phone call eror, that last overage (4GB) was corrected on the bill after I called Verizon Customer Service. I am awaiting a bill audit but I checked hourly usage for the last two days and, at night, while we were asleep, and our computers were off or asleep, we show data usage in approx. 15 minute increments all night. 4.6 MB total between 1AM and 7AM.  (And no- no one should have been able to sit near by and pirate our signal- we live in the middle of a vast field of corn stubble). This has gone on every night as far back as I checked. And each overage varies-though most hover around 135-145 KBs. We are going to try some closer tracking for the next while but this seems like a device problem and there are other posts that suggest there is one. (I will post the outcome of this issue after the billing audit and, I feel sure, more long discussions with Verizon.) Late reporting from non-Verizon towers doesn't seem a logical answer to these constant and regular data usages. Any one else tracked the details of their overages and found similar patterns?

Labels (1)
0 Likes
1 Solution
John_Getzke
Champion - Level 1

One of your machines, most likely your child's computer from college, is talking over the internet at night.  Your data usage statistics do not reflect human interaction, it reflects how much data is being requested by your devices.  You do not have to be present at a keyboard to be held liable for data usage.

What you should do is try turning off your machines at night one at a time.  This will help you isolate which one is the late night chatter.  Once you know the source of the leak then dig deeper and see if you can figure out what may be going on from there.

From the looks of your data log the leak is fairly consistent which should make finding it fairly easy to do.  Keep checking your usage logs after you shut down a machine and see if the leak stops.  You could also do it the other way around too and only have one machine powered on at a time, that would actually be more scientific that the first approach.  A few data sessions on each machine at night should reveal the source of the problem.

View solution in original post

0 Likes
20 Replies
John_Getzke
Champion - Level 1

One of your machines, most likely your child's computer from college, is talking over the internet at night.  Your data usage statistics do not reflect human interaction, it reflects how much data is being requested by your devices.  You do not have to be present at a keyboard to be held liable for data usage.

What you should do is try turning off your machines at night one at a time.  This will help you isolate which one is the late night chatter.  Once you know the source of the leak then dig deeper and see if you can figure out what may be going on from there.

From the looks of your data log the leak is fairly consistent which should make finding it fairly easy to do.  Keep checking your usage logs after you shut down a machine and see if the leak stops.  You could also do it the other way around too and only have one machine powered on at a time, that would actually be more scientific that the first approach.  A few data sessions on each machine at night should reveal the source of the problem.

0 Likes
rasgrif
Newbie

Thank you for your response.as for my child's PC as the problem, it was not even in this state on the days these were recorded- just 2 Macs. We are now trying your suggestions on this but I would note this is new to the 4G device.- no other change since we changed (unwillingly) from a Verizon 3G. Are we able to switch this device to 3G for most usages?

Also- in another post, you suggested software to track usage, including what the machines are connecting with. I am considering doing that but saw a note from a Verizon Rep who said Verizon does not recognize data tracked by 3rd party programs. Convenient for them- but I also saw someone who used such logs to successfully sue Verizon- twice. Always considering that source for this info, if I can't get a handle on this fast, I may just fight to return the device and void the contract. I think Verizon has a lot of very angry people from the posts I saw and is responding poorly. I can not find a like level of anger for other 4G carriers on this issue.

Carol

Private info removed as required by the Terms of Service.

Message was edited by: Admin Moderator

0 Likes
John_Getzke
Champion - Level 1

Its true that VZW does not recognize 3rd party monitoring applications.  However, you don't need them to recognize anything, they are not in the computer maintenance business.  Its not their world to help you troubleshoot a misbehaving personal computer.  3rd party monitoring applications are  purely for your benefit so you can find the leak and stop it.

You have already proven that the Jetpack is doing its job and providing internet.  That's where VZW support stops.  Now the real task at hand is to get that troublesome PC to behave while it is connected.  When it comes to monitoring applications on a PC I suggest some free software called Networx.  Networx is the most user friendly monitoring application I have seen so far because it has a feature that can display and breakdown usage by the individual applications and services on a computer.  This makes it very easy to pinpoint the leak and put a stop to it.  There are other free monitors out there too like WireShark and ProcessMonitor from Microsoft, however those applications require much more knowledge to pick out the useful information that you need.

As far as configuring the Jetpack goes all Jetpacks should have a feature that allows them to stay in 3G only mode.  Granted that will make all devices use 3G while connected but it may be the easiest step to keep your usage down while your childs PC is connected to it.

Here's how I suggest you proceed:

1. Switch your Jetpack back to 3G only

2. Get a monitoring application installed on the troublesome PC (ex. Networx)

3. Get comfortable with the monitor and see if you notice anything unusual

4. When you are ready then turn off all PCs and leave on the bad PC

5. Switch Jetpack back to 4G

6. Monitor the activity and get a good sample

7. Compare the 3G activity to the 4G activity on that computer

This isolation test should tell you exactly what the problem is.  Once we know which app/service is misbehaving on 4G LTE then we can reevaluate to see if there are any options to stop it.  Sometimes its as simple as a configuration change to turn off updates.  Sometime the application needs something else or can be completely removed.  If no decisions can be made then your fall back is always to leave the Jetpack in 3G only until that PC can connect somewhere else.

If you would like the steps to convert the Jetpack to 3G only then send us your Jetpack model.  We can look up the user guide for you and provide you the steps from there.

0 Likes
rasgrif
Newbie

As I said, the PC can't be very responsible for these overages since it went out of state for two of the weeks in question. The Networx sounds great but is not Mac compatible. Any Mac suggestions?

My Jetpack is a MiFi 5510L. I would very much like the directions to go back to 3G for most usage.

Carol

Private info removed as required by the Terms of Service.

Message was edited by: Admin Moderator

0 Likes
John_Getzke
Champion - Level 1

Not a Mac guy, I do not have any good suggestions for monitoring in that world. : (  You might have to snoop around a Mac forum to see what other fellow Mac users suggest.

See page 54 of the MiFi 5510L User guide to switch to 3G Only:

http://www.novatelwireless.com/files/4513/6218/1792/UG_MiFi_5510L_VZW__30Jan2013.pdf

If the Jetpack was still leaking after the collage computer left the network then it may be an issue with the Macs afterall.  Use the isolation technique I mentioned above and see if you can figure out if one or both of the Macs are yapping on the internet without your knowledge.

0 Likes
Pitkingirl
Enthusiast - Level 2

if you use MIFI as you local network and you have a wireless printer, scanner, or multifunction device, Verizon is probably charging you for the data volume to and from this device.   I was doing some high-volume scanning of old paper records and our data usage went crazy.  I can't prove this, but after I reinstalled our old router and changed back to my internal network for all but internet, the usage has dropped back to normal.  I think this is a crooked business practice and even an invasion of privacy, since if they can track this as usage, they can also track the data.  I should not have to pay them for using my own internal communications.

John_Getzke
Champion - Level 1

Local traffic is not monitored by VZW.  You can scan, print, or send documents to local machines all you want and it will not impact your VZW bill.  All that VZW cares about is communication that goes over the internet.

If you have a personal device like a printer that happens to be performing network lookups or checking in with some kind of a online service then that usage will be held against you.  This is commonly the issue when users have a tablet and use some kind of a online print to email or scan to email feature.  Cloud printing features certainly do use the internet and the data will count against you.

No one is being crooked, there is simply a misunderstanding of how your connected devices are behaving when given different connection options.  I have seen numerous threads claiming that local data is being held against users and have not yet seen any evidence to support it.  There should be a better explanation if you look deeper into what is going on.

Pitkingirl
Enthusiast - Level 2

John:

Ethel's husband here.  I note you say 'monitored', not 'measured'.  Interesting detail that I'm not sure is unintentional. Not to say you are definitely wrong about this, but the evidence is heavy, from my 42 yeas of IT experience, that Verizon is charging us for local network traffic if I only use the MiFi as my router. The only thing I have not checked is system-to-system data movement as that is rare and usually we don't not even have mapped drives, and we use large USB drives for backups and data movement. Neither of us listens to music online since we have satellite radio and our own digital music on a local system for that and it is not on the network at all.  We do not download movies or music.  We went through all the research, including powering down EACH local wireless device for periods of time in turn, powering down ALL local wireless devices,  stopping any and all automatic downloads of updates and patches, not watching U-Tube videos that people send links to, not sending no large attachments such as photos, and THEN stopping my project of scanning hundreds of documents from our wireless multifunction device (print, scan, fax, copy).  According to the MFD setup, it is not allowed to communicate with the manufacturer as lots of them like to do these days. Our data usage only and immediately plummeted when I stopped the scanning project.  When I reinstalled our original router for our local network and continued my scanning project via THAT wireless network, MiFi data usage went way down to 'normal'.  I even monitored when my wife plays Words With Friends on her Ipad for which she has a separate account.  Our data volume is far exceeding what we experienced when my wife operated a home-based graphic design studio and regularly had large uploads and downloads of client designs and online testing of websites.  The volume is pretty much isolated to the 'phone' number allocated to the MIF  device and NOT to the other two numbers on the account.

Like I said, I can't prove it.  I also can't prove the government is not monitoring me.  But this smells very bad to me.

0 Likes
John_Getzke
Champion - Level 1

"Monitored" is my personal word for the scenario.  Didn't mean to stir up anything by it, but I think you get the gist.  We don't know if VZW can "see" our local traffic or not, that's a conspiracy conversation outside the scope of the current problem.  However the bill should not reflect your truly local activity. I don't doubt anyone's technical skills here, just saying no one has been able to prove it so far.   If you can find a way and capture the problem VZW should be able to refund you something for your efforts.

I'd be happy to work with you and answer any questions you have on the subject.  Likewise I'd be interested to reproduce any steps you can document for us to help you build your case.  I can tell you right now that we as users cannot see exactly what Verizon sees when it comes to preparing the bill. This is primarily the largest obstacle when it comes to determining a leak.  The raw data from our usage logs are hidden from us to protect our own privacy (or something like that).  All VZW will provide users with is a log of the various sessions.  Anything deeper than that needs to be rigged up with the use of monitoring devices and applications before the traffic hits the Jetpack. 

For example you could have an environment like this at home:

MonitoringEx.png

In this example the best spot to setup a monitor would be at the bridge.  Monitoring from here would capture everything headed to the internet.  The Jetpack could also use simple MAC filtering to ensure that only the bridge is connected to it and keep your logs clean from interference.  How granular you get from here will depend on your level of investment and interest into the subject.

Let me know if you have any questions.

0 Likes
No1rly
Newbie

Lots of questions. That setup is actually what I was thinking of using with a router acting as a bridge and switch, and then it hit me: the MiFi cellular connection to the tower and Verizon's network is a black box. So the concern I now have is the extent the customer is responsible regarding traffic between the MiFi and rest of Verizon's network.

Is incoming internet traffic unrestricted to the MiFi JetPack?

If it is filtered by Verizon, then how is it filtered?

If malicious and DoS attacks are aimed at the WAN IP from the outside, does is count as data usage?

What does the WAN IP and MAC represent? The Jetpack or something more upstream?

I'm not beyond investing in a cellular spectrum analyzer if a technique can be employed to correlate the statistical spectrum with actual data usage to at least a 90% confidence.

0 Likes
John_Getzke
Champion - Level 1

You are correct.  The cellular connection between the VZW device and towers is a black box.  Also included in that black box is the entire VZW network billing system that sits behind their NAT.  Common folk like us do not have a way to see any of this data to perform our own analysis.  All VZW will expose is the final bill at the end of the billing cycle and limited data on the various sessions that we consumed.  We can pick apart our personal traffic all we want but the key to solving a data issue would be to see what VZW sees and cross reference it with our own information.

To answer your questions to the best of my knowledge:

1. Unknown.  I have always assumed that any data sent from the VZW network to the device will be counted against the user of that device.  VZW does not care if the data makes it to an end users computer or not.  All VZW cares about is the traffic to and from the VZW device and their network.  Regardless of the circumstances those who use more are billed more.

2. Unknown.  VZW does not expose information on how it decides what portions of our traffic is billed against us.  For example the headers wrapped around each data packet are most likely not counted against us, but the raw data should be.  Another key factor would be errors, retransmissions and dropped packets.  If something happens to the data in transit as a result of the networks supporting it then its reasonable to assume a user could get billed multiple times for the same traffic until a successful delivery is made.  Factor that into the speed of the 4G LTE network and you can start to see how a simple download can quickly balloon out of proportion.

3. No (it shouldn't).  A DoS attack can only target the VZW firewall, not an individual device unless that device opened up a pathway to the attacker in the first place.  All VZW broadband devices are anonymous behind the VZW firewall by design, which is why all public IP dependent services do not work on the new LTE network.  There should be no way for a random DoS attack to target your specific device and bombard it with traffic unless there was a client already installed on one of the personal machines requesting the traffic in the first place.  I have seen a few threads on the VZW forums where DoS type traffic can be confirmed by VZW and has been refunded or discounted back to the user.  Some devices even detect this on their own and automatically shut themselves down.

4. The WAN IP is that of the NAT Firewall, same with the MAC.  There are no personal identifiers to the majority of all VZW devices on the new 4G LTE network.  Exceptions would include anyone on HomeFusion or a purchased static IP Address.  Some smartphones with full IPv6 enabled on them can also be directly targeted, but the majority of the personal broadband/jetpack devices cannot be.

A spectrum analyzer would be helpful in the hands of the right person when analyzing a data leak.  But remember, an analyzer without the VZW decoder will only be able to see the raw radio signals passing over the air.  This is helpful up to a point, especially when observing a good download vs. a bad download.  You could also analyze the spectrum while connected to different towers to isolate certain issues too.  In in end you would have to make assumptions based on the radio activity as to what is going on.  Raw radio issues would not necessarily be concrete evidence of any specific problem to the billing system, VZW hardware or connected personal devices, but it would be a good start.  I do not have access to a spectrum analyzer so I cannot offer any assistance on that subject.

0 Likes
obsestheart
Enthusiast - Level 1

I also have a wireless printer.  I am being charged overage almost every monrh. I am single no movie streaming no games no videos and only use 1 tablet and have a laptop I only use occasionally and keep it off. I turn the WiFi off my phone and tab. Verizon still has me going over a total of 7 gigs a month. I have 5 on the jet pack and 2 on my phone which is my plan. I get text every month like 10 days into my cycle that I've retched 90 percent and then go over within 2 days.

0 Likes
Typhoon1964
Newbie

Any use of the internet/wifi is use of the device. Turn off all auto updates and note that updating devices like a Garmin will eat data like a pig. Verizon now has an alert system that will help a little. You can set it for preset warning percentages but remember that some data usage may come from another carrier's tower and may be slow by several days to register. No expert but I had a similar experience and above helped me.

0 Likes
acmuns
Newbie

Clearly Verizon has a problem clarifying a technical situation that is always favorable to them and their bottom line.

I have had problems with being over billed on 2 hot spots and a MiFi. I can not even go into all of the times verizon has over billed me even when the devices are unplugged and not available for use. I have tried everything from customer service to screen shots of my bills and even called their corporate office.Nothing worked.I have even received auto generated texts of impending overages 5 minutes apart from each other when the devices are not in use. I went so far as to find another wireless carrier that used Verizon's network. I had 0 problems and never used more than 6 Gigs per billing cycle. Two months ago that wonderful and honest company was purchased by Verizon……..Two Days ago I returned to my vacation home after being gone for 2.5 months and looked at messages sent to my MiFi. ALL OF THEM SAID I WAS OVER MY 20Gig allowance.

No,friends, this is not a technical issue that can't be solved so don't waste your time. This is Fraud. This is a scam and Verizon knows it. Just brows the internet and look at all the complaints. I'm not going to take it anymore and will file a formal complaint with the FCC and the FTC.

Verizon needs to face a MASSIVE fine for abuse of government license, and willfully perpetrating a Fraud on it's customers.

Please feel free if you have documentation showing this abuse to add to my legal brief.

0 Likes
hk11
Newbie

I'm a network engineer and computer technician and ran into a MiFi data usage problem today. My customer has a single computer with a USB printer (no network) and the computer is connected to a Verizon MiFi. He's had this setup for about a month and two days ago his data usage went crazy, about 12GB in a matter of hours. He doesn't watch videos/movies or listen to music and the data consumption happened mostly while he was sleeping. He started getting text message alerts, one after the other. He had to up his data plan to 20GB (from 4GB) just to try to not go bankrupt from the overage charges.

I did some wiresharking on it today and found that some process, yet unknown, was communicating on 192.168.1.2 (his computer's IP) and 192.168.3.6, both Class C local IP addresses. The protocol was TCP and the ports were 80 and 50850. While this was happening I attempted to ping 192.168.3.6 and got no response. I couldn't find any suspicious processes running on his machine.

Through my troubleshooting the problem appears to possibly have resolved itself, but I still don't know what I did to resolve it. I disabled every non-microsoft thing in MSConfig but later re-enabled all of it and the problem didn't come back. I also disabled his local LAN connection. It has no wires in it and no IP address, but I disabled it anyway.

But the real take away from all of this is that Verizon is charging people for Local Area Network traffic and that LAN traffic might not even be communication with a real machine/device. I really believe this problem should be reported to the FCC, although I really need to confirm that these packets were not passing out through the MiFi's WAN interface and that wasn't something I took the time to do this morning when I was troubleshooting it. It would not be a trivial effort and I don't think my customer will be willing to pay for it.

0 Likes
7e18n1
Specialist - Level 3

> I did some wiresharking on it today and found that some process, yet unknown, was communicating on 192.168.1.2 (his computer's IP) and 192.168.3.6, both Class C local IP addresses. The protocol was TCP and the ports were 80 and 50850. While this was happening I attempted to ping 192.168.3.6 and got no response.

Maybe you’ve never noticed this before, but such IP destinations are not all that unusual, especially on a laptop that connects to different networks. If you pulled this 3.6 IP as the destination of a packet from the subject computer, the printer driver may have a PORT configuration with that IP. Even if that port is disabled, the driver may still send data to that IP address at seemingly random intervals. If no such PORT configuration exists then look at the routes. The Ethernet driver might have that as a static IP address. These are the three most likely places that IP originated. Or, see if you can find that IP in the registry for a clue as to what’s trying to use it. If it’s not in the registry look closer at all third party software that might use a fixed IP address. Regardless, 192.168.3.x cannot ordinarily interact with the 192.168.1.x subnet in a hardware fixed /24 private network.

> But the real take away from all of this is that Verizon is charging people for Local Area Network traffic and that LAN traffic might not even be communication with a real machine/device.

From recent experiments, this is not the case. I watched this occur in the past but I have not observed it lately. You’ll have to provide details of your experiments if you find differently. My data plan renewed this morning and I checked it first thing with a 120 MB file between laptops and had no data usage.  

0 Likes
John_Getzke
Champion - Level 1

> 192.168.1.2 (his computer's IP) and 192.168.3.6

The Jetpack shouldn't have a subnet large enough to reach 3.6.  Normal default subnet mask is for one segment which should be 192.168.1.1 to 192.168.1.256 (minus two reserved for router IP and broadcast).  There shouldn't be anything on 3.6 to communicate with.  I would have the user doublecheck and confirm the basic configuration info with you. If its funky then reset the Jetpack back to the defaults.

> the data consumption happened mostly while he was sleeping

Clue here.  Automatic updates are well known to happen during off hours.

>TCP  ports were 80 and 50850.

Port 80 is normal http, most likely from a browser.
Service Name and Transport Protocol Port Number Registry

No idea what 50850 would be used for.  Some kind of automatic update from a background application or service I suppose. Whatever was happening the traffic may be on a different port the next time the machine fires off that process.

> I attempted to ping 192.168.3.6 and got no response.

That address is outside of the subnet on the Jetpack.  The machine would have to be bridged into two separate networks (most likely one wireless and one wired) for it to be able to communicate with that address.  If the machine was communicating with 3.6 at any time then it wouldn't have been going through the Jetpack to do so and wouldn't be on the VZW bill.

> I couldn't find any suspicious processes running on his machine

Wireshark is great, its wonderful to get a network engineers feedback on the situation.  However Wireshark doesn't reveal application information, only the network traffic that is running through that instance.  If this person continues to have problems I would suggest installing Glasswire in addition to wireshark.  Glasswire is more user friendly and it also provides us with a breakdown of internet usage by application which is very helpful in these situations.

Something isn't adding up in this scenario.  If traffic is truly transferring to 3.6 then it would be local traffic.  Not only would it be local but it would also not be going through the Jetpack.  I don't see how the Jetpack could even monitor traffic on a network its not connected to.

Do the VZW logs match up with your findings from Wireshark?

0 Likes
John_Getzke
Champion - Level 1

> Normal default subnet mask is for one segment which should be 192.168.1.1 to 192.168.1.256 (minus two reserved for router IP and broadcast).

Ugh.  To clarify I mean the default subnet mask is 255.255.255.0.  IP range is 192.168.1.1 to 1.256.  DHCP range is normally the first 100 IPs or so.

0 Likes
lexcamlo
Enthusiast - Level 1

Help! I see all these post's of other verizon customers who have experienced the very same thing I am going through. My current bill with Verizon is $3200!!  They are claiming that we have gone from 30gb to 300gb in one month! What can I do? We already pay $700/month for 8 lines of service, this is outrageous. I have called numerous times, I have downloaded all internet using device's usage history and they do not match, however, Verizon does  not believe me!

Thanks for the help!

bill.PNG

vzw_customer_support
Customer Service Rep

I am here to the rescue lexcamio! That is a lot of money and I totally understand your concern.  I can understand your concern. I have sent you a private message so I can further look into the matter.


AmberF_VZW Follow us on Twitter @VZWSupport If my response answered your question please click the �Correct Answer� button under my response. This ensures others can benefit from our conversation. Thanks in advance for your help with this!!

0 Likes