I have Airtel Broadband PPPoE connection with Public Dynamic IP assigned to my router Dlink DIR 615 (It’s old model and now discontinued). Intermittently I have noticed instances of unusually high uploads from my Internet account. For example in say 10 hours over 80 GB of data gets ‘uploaded’ and against that only a negligible say 100 MB of data gets ‘downloaded’ automatically when no device is connected to the router. I later verified this with data consumption charts available in my account.
I installed data loggers on my mobile phone and no unusual activity or data consumption found. No PC / Laptop connected to the router when it happens. Router is secure, very long complex password WPA2 and WPS disabled. Port & Address restricted firewall, PING on WAN is disabled The massive uploads happen even if I disabled WIFI which means whatever happens, must be at the WAN port.
I contacted ISP and they said is that the connection has physical port binding which means that if another LAN cable is taken out from the hub or whatever device they have at the common area in the apartment complex, no one else can get on to the internet even if they know my PPPoE user id/password. The access is bound to a particular physical port on the ISP's device.
I am sure this is not a data logging error as whenever it happened, I could see the Internet LED rapidly glowing on the router, so it was for real.
It stops as soon as I reboot the router as it generally takes another Dynamic Public IP from the ISP.
Nothing much found in the router logs. Router does not seem to be able to differentiate between normal uploads/downloads and such instances of massive uploads.
See the screenshot for ISP chart. Yellow bar is upload and brown bar is download.
What kind of activity, if any, at the WAN port of the router can cause massive data uploads when no devices are connected to the router and even WiFi is disabled? From where this data is generated?