Last two days (Friday and Saturday) there was mysterious massive upload done through my BT Home hub router - about 9Gb in 2 days. Knowing that it is not us, as we don't do streaming, p2p, nor uploading any photos etc, I scanned my computers immediately - no virus nor malware found. I used netstat command in command prompt to check download/upload readings for each computer and even disconnected 1 computer from internet, but the data transmitted readings showed on my BT home hub page kept increasing. But I did not see any thing was being uploaded from my computers/device.
I rang BT customer support but they were unable to provide me details on which computer/device was uploading nor they could provide which time the upload was done (we went out for a concert on Friday night, no one used computers/device between 16:00-00:00). BT customer support could not tell me which IP the upload was addressed to.
Meanwhile I found plenty of OUT block entries in my router's event log:
Datetime OUT: BLOCK  ICMP replay (ICMP type 3 code 1 XX.XXX.XX.XXX->XXX.XXX.XXX.XX on ppp3)
I decided to restart my router, after that the router data transmitted readings is back to normal, I guess the upload had been stopped. But until I restarted the router at around 5pm Saturday, my router had already uploaded another about 4Gb data. I don't have Fri-Sat event logs anymore after restart, else I could investigate those IPs further.
Has anyone ever seen this situation before? Thanks for reading.
Thanks for reply. We don't use cloud. Since we do not like taking photo, we don't have any cloud accounts except dropbox, and the last time we used dropbox was last year.
BTW, when I was typing the first post, I noticed the data transmitted reading was increasing abnormally like yesterday, I did another restart of router to stop it.
It is frustrating as I have to monitor it very frequently now 😞
All you can do is to disconnect all devices, make sure the upload stops, then connect each device, one at a time, to identify which device is causing it.
Make sure you do not have any loopbacks, which can be caused by powerline adapters.
If its your PC causing it, then you will need to run a tool like Process Explorer
Assuming its a Windows PC. This will identify any processes which are using network resources.
There is always a certain amount of background data used by the hub itself. Have you also checked to see if anyone is connected to your BT Wifi hotspot, if you are opted in?
might be worth changing your wireless password too, i was once hacked and someone ran up 35gb of downloads turned out my neighbour was a wiz at nicking peoples wifi passwords and using their connection. far fetched but it eliminates a possibility