[ILUG] Re: Problems with Three Mobile-Broadband Router

[Ian Spillane]

Thought people might like to know how I got on with the mystery
bandwidth problem.

I cannot fault Three. The router stats (telneting to the ppp.log) and
Three.ie stats match.

vnstat showed up ordinary traffic for the server machine which matched
the proxy reports from sarg.

However vnstat showed unusually high and unaccounted for traffic
direct from the laptop to the router - bypassing the system proxy.

The solution to finding an answer was a very neat program called darkstat.

Run darkstat with, e.g.:

sudo darkstat -i wlan0

and access simple graphs and host reports at http://localhost:667

Believe it or not the little ordinary Pidgin was at fault. Its
Facebook chat ability was logging GBs of unnecessary bandwidth and
costing a fortune in over quota fees. Actually about 1GB of bandwidth
per day!!

Anyone out there with Pidgin and a Facebook chat account beware. Check
your usage with darkstat.

The problem is noted by others online but it seems odd that Ubuntu
updates have not either disabled or fixed the problem. It has been
very expensive for some people. And me. I will struggle to the end of
this billing month on a third of my quota left and have already paid
out about 150€ on over quota fews in the last two months.

Ian

2009/7/20 Ian Spillane <iantheteacher at gmail.com>:
> Folks,
>
> I have a puzzle. I would welcome any insights.
>
> I have a Three USB Broadband dongle. Recently bought a compatible
> wireless router from Three.
>
> My 15GB allowance is draining very very fast. I have been charged
> megabucks for over quota MBs. I cannot explain it.
>
> At present I have two machines running (sometimes three). To monitor
> web usage I have set up a squid proxy server. Both machines have proxy
> settings set in the environment variables.
>
> Squid reports a reasonable amount of Internet traffic - about 200Mb in
> the last 24 hours - and it is all reasonable in the Sarg reports. This
> is backed up by vnstat reports on eth0 traffic to the router (even
> though this would also include local traffic and tend to be a lot
> higher).
>
> However both the router's own ppp.log and Three.ie online usage
> monitor have recorded over 950Mb of usage (about 500Mb during the
> night when I wasn't using any machine).
>
> No major distro updates are happening. I live in a completely isolated
> rural area where you have to be in my farm yard to get my wifi signal.
>
> I would welcome suggestions on how to prove what is going on.
>
> Is there a bullet-proof way to audit all Internet traffic out of a network?
>
> Ian
>



-- 
Ian Spillane
Ballyguyroe South, Shanballymore, Cork, Ireland
085-7263117

More rambling than you can shake a stick at (well it is summertime,
I'm off-duty):

http://twitter.com/iantheteacher
http://www.facebook.com/ianspillane
http://systemnotebook.blogspot.com/