Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[xus]

Have you disabled the wireless on the Asus to ensure nothing is connecting wirelessly?

Yeah, one of the first thing i tried.
Looking at the line stats the upstream HEC errors are through the roof, i may be totally wrong, but if an HEC error is encountered would that cause the device to re-transmit, error again, re-transmit etc.. causing the constant upload when something active on the network?

[licquorice]

But as burakkucat says, I can't see how you are seeing the traffic on the Asus unless it was coming from the modem LAN2 port, yet you say disconnecting LAN2 doesn't stop it.

[xus]

yeah disconnecting LAN2 makes no difference - I understand what you and burakkucat are saying, but i don't understand why the router would say mac address X is uploading GB of data, and it says mac address X is connected to the wan port. (you can see this in a couple of screenshots i posted in post 20). i'm stumped.

The HEC errors, is that a different issue altogether?

[gt94sss2]

Try disabling QoS on the HG612 and/or the Asus to see if that makes a difference - though a quick google suggests the traffic monitoring functionality on the Asus is buggy.

[xus]

Yeah i have read the traffic monitoring isn't the greatest mate! seems to be pretty accurate apart from this though.. i don't think the buggy traffic stats are to blame though as resetting the modem to factory settings seems to stop the uploading for a few days (router doesn't see ANY traffic from modem at all.. like what is normally expected)
QoS is disabled on the router already, have disabled it on modem just now and still seeing upstream traffic.

[d2d4j]

Hi

Why not try dslstats monitoring on hg612 to compare the throughput of connection

This I think would give you a better idea if the figures your seeing are correct or not

Many thanks

John

[xus]

I did look into that but i run a mac which doesn't seem to support any dslstats programs that i could find! I have an old windows laptop lying around i could pull out if running dslstats would help, i wasn't sure i'd even be able to understand what it was reporting hence not pulling it out sooner!

[ejs]

Wouldn't it be possible to create a modified firmware for the HG612, and slip in some trojan or backdoor, that accesses the Internet via the router? I think we recently saw someone's unusual LAN setup, with a switch connected to a WAN port, with different kinds of traffic (PPPoE and IP) going through the same cable.

[xus]

I guess it would be possible.. i did just recently buy the modem from fleabay already unlocked
device info:

Product type   EchoLife HG612 
Device ID   10C61F-21530315408K25015453
Hardware version   VER.B
Software version   V100R001C01B030SP08
Firmware version   A2pv6C038m.d24j
Batch number   BC1P6.030.A2pv6C038m.d24j

[d2d4j]

Hi

I would use old windows laptop and plug the lan2 of hg612 directly into laptop, after correctly setting the LAN up on laptop (thus bypassing router etc)

In dslstats, there is a tab for stats, which show current, daily and monthly, but chose current to compare against your current on router.

I believe this would show hg612 not using that bandwidth but if it does, and you are 100% sure nothing is running, wireless fully disabled on router, then you have a major issue.

Do you use external backups, or have time machine running, or similar ie iCloud and is this synchronising data when your computer(s) are connected.

It's just a thought

Many thanks

John

[Dray]

But disconnecting LAN2 didn't stop the uploads, so it's not coming from the modem is it?

[xus]

Thanks John will give it a try
@Dray - no didn't stop it but traffic stats say its coming from MAC address of modem Lan1
Lan2 mac shows no traffic

[d2d4j]

Hi

@dray, your correct I believe in that the hg612 is not sending data directly itself.

The router is showing the wan port (or lan1 on hg612) Mac and not that of the external to dslam. So is showing traffic at router level, not modem.

My thought was to fully separate out the router to modem and compare the results, which should show within 5 mins or so, if comparing current (live) stats ie router showing say 5 mb out and hg612 showing say 1 mb.

If both match, then there is something sending out data, which as it does not happen when no devices connected to router, then it has to be something on the computers/devices which connect to router (not trying to teach you to suck eggs here sorry), which is why my thoughts turned to iCloud or remote back ups, time machine etc...

In this instance, I would connect each computer/device every 10 mins and watch the current graph, to see when it starts to happen, which would narrow the search

I hope that helps and sorry if I'm wrong

Many thanks

John

[xus]

Thanks for your help guys, will try it out and report back. Any idea on large number of HEC errors in my last screenshot? something i should be worried about?

[d2d4j]

Hi

I would compare the hec against the hec on dslstats once up and running.

I would consider retransmissions would not form a loop, which is what I think your intimating is happening, and if it did form a loop, I would expect you to report an output growing experiential, and show on your network as sluggish or very slow

I could be wrong so apologise in advance

Many thanks

John