I have Airtel Broadband PPPoE connection with Public Dynamic IP assigned to my router Dlink DIR 615 (It’s old model and now discontinued). Intermittently I have noticed instances of unusually high uploads from my Internet account. For example in say 10 hours over 80 GB of data gets ‘uploaded’ and against that only a negligible say 100 MB of data gets ‘downloaded’ automatically when no device is connected to the router. I later verified this with data consumption charts available in my account.

I installed data loggers on my mobile phone and no unusual activity or data consumption found. No PC / Laptop connected to the router when it happens. Router is secure, very long complex password WPA2 and WPS disabled. Port & Address restricted firewall, PING on WAN is disabled The massive uploads happen even if I disabled WIFI which means whatever happens, must be at the WAN port.

I contacted ISP and they said is that the connection has physical port binding which means that if another LAN cable is taken out from the hub or whatever device they have at the common area in the apartment complex, no one else can get on to the internet even if they know my PPPoE user id/password. The access is bound to a particular physical port on the ISP's device.

I am sure this is not a data logging error as whenever it happened, I could see the Internet LED rapidly glowing on the router, so it was for real.

It stops as soon as I reboot the router as it generally takes another Dynamic Public IP from the ISP.

Nothing much found in the router logs. Router does not seem to be able to differentiate between normal uploads/downloads and such instances of massive uploads.

See the screenshot for ISP chart. Yellow bar is upload and brown bar is download.

What kind of activity, if any, at the WAN port of the router can cause massive data uploads when no devices are connected to the router and even WiFi is disabled? From where this data is generated?

enter image description here

  • 1
    You have an X/Y question. You've jumped to a possible explanation without confirming the problem. Your situation is: "you are seeing massive data uploads from your ISP account. Why?" Don't jump to "attacks on the WAN port". Don't even jump to "attacks". You first need to confirm the data you have. – schroeder Mar 5 '20 at 14:11
  • If I just say that there are massive uploads from my account, why? Then I am soliciting opinions. With enough troubleshooting & elimination of possibilities, I have nailed it down to suspicious activity at the WAN Port, if Attack does not suit as a right word, I will change it to activity at WAN Port. – user228349 Mar 9 '20 at 14:14
  • That's right, you are now soliciting opinions. You are seeing strange volumes and you want to know why. We can't tell you. You need to gather more info and narrow down the potential options. – schroeder Mar 9 '20 at 14:23
  • You might need to run some packet captures to trace where the traffic is coming from. – schroeder Mar 9 '20 at 14:24

You provide few informations. Have you checked the log of the router to see which IP and with which protocol the upload takes place? You should then check that you have not enabled remote assistance and that the firewall: - block access on any port and protocol from the outside to the inside. The installed firewall should be stateful, so if you don't allow open connection access from the outside, you can feel comfortable. - Open external access only for the ports and protocols in use by the hosts inside your network. The administrator password has nothing to do with WPA and WPS. You should change it often and do it with the device connected by cable for more security, not wirelessly.