Solved RTAC68U Traffic analyzer data issues

[marczol]

I have extremely high network traffic for 4 days in October see attached file. I was notified by my internet provider(starlink) i have exceeded my data usage of 1 TB over the last 6 months which the analyzer does verify. I have checked all the security information and i do not have any infected devices. Does anyone have any suggestions on what might be causing the issue? We work from home no kids, normal usage over the past 2 years we have been on starlink I do have a mesh network setup with a total of 3 routers all ASUS all RTAC68U models.

 

[ColinTaylor]

When you see ridiculously large numbers in the traffic stats you have to discount them. This is a known bug in the stats. You cannot possibly be sending or receiving 16 exabytes of data in a day.

What is your daily/monthly limit with Starlink? You said it's 1TB, is that monthly, yearly, etc?

 

[marczol]

1TB of data that is how I noticed this anamoly. Starling notified me that i am exceeding my data limit and nothing has changed in our household over the last 2 years with Starlink.

 

[ColinTaylor]

So to be clear, what exactly is the allowed Starlink limit. How much data and over what time period?

 

[marczol]

1TB per month

 

[marczol]

I would assume if, those numbers were real they would have shut down my connection. As i stated before we work from home stream all of our TV content and have no kids living at home that has been the same over the last 2 years on Starlink.

 

[ColinTaylor]

1TB per month

OK. So that equates to approximately 33.3GB per day. So even if you ignore the anomalous readings it appears that your average data usage is exceeding this.

I don't know whether they only count downloads or also include uploads. There were a couple of days when you were uploading quite a lot of data.

I suspect that over time your average data usage has just crept over the limit. Your behaviour may not have changed but things like Netflix streaming higher bitrate content can increase data usage a lot without you realising.

 

[marczol]

They measure from 7am -11pm (peak period) upload and download combined. I understand it is possible I was alarmed at the traffic information when i started checking. I wanted confirmation the data was incorrect that i was seeing. i appreciate you taking the time to respond.

 

[ColinTaylor]

If you suspect something rogue on your network you can turn on the Traffic Analyzer to collect more detailed information. Then you should be able to see how much each individual device is consuming.

 

[marczol]

I have looked at individual devices for usage and nothing abnormal or a device I do not recognize. Unfortunately, I cannot see the days where the data is way off the charts to see if there is a rogue device

 

[Tech9]

You have to use TrendMicro engine Traffic Analyzer only on this router. Traffic Monitor is broken on all 386 base Asuswrt versions.

 

[TurdleEggs]

You have to use TrendMicro engine Traffic Analyzer only on this router. Traffic Monitor is broken on all 386 base Asuswrt versions.

Is this part of the Asuswrt fw? I can't see where to enable TrendMicro engine Traffic Analyzer.

 

[ColinTaylor]

Is this part of the Asuswrt fw? I can't see where to enable TrendMicro engine Traffic Analyzer.

Traffic Analyzer is synonymous with TrendMicro. TrendMicro is not something that you enable individually. You just turn on the Traffic Analyzer.

 

[Tech9]

@TurdleEggs, this router (and all AC68U variants, except AC68U V4) has the traffic spikes in Traffic Monitor on all 386 firmware versions. The bug is in Asuswrt base. RMerlin had it fixed on 384 based Asuswrt-Merlin, but it came back with 386. This is why Traffic Analyzer is your only option on this model.

 

[brendanp]

@TurdleEggs, this router (and all AC68U variants, except AC68U V4) has the traffic spikes in Traffic Monitor on all 386 firmware versions. The bug is in Asuswrt base. RMerlin had it fixed on 384 based Asuswrt-Merlin, but it came back with 386. This is why Traffic Analyzer is your only option on this model.

Could this be worked around by modifying the Main_TrafficMonitor_daily.asp page in the www folder? I'd be perfectly happy if these erronious numbers were either 1: Set to 0, or 2: copied from the previous day ... at least that'd bring some the charge back inline and allow for *some* visualization of the daily traffic.

 

[Tech9]

Could this be worked around

No idea. What I know is Traffic Monitor is practically unusable in 386 firmware. Use Traffic Analyzer instead.