Random router spikes to 800MB/s, but max LAN is 10MB/s

Started by Satou

I'm running Networx 5.5.4 on win 7 x64.

Recently, we've started streaming Netflix, and so I was worried about my data cap.

So, I set Networx to monitor the entire router traffic.

A week ago, Networx reported about 7.5GB down and 4GB up, this was used within about 15-20 minutes maximum. I didn't have a chance to look at it immediately, so it could have taken even shorter for that much data to have "gone through the router."

At first I was concerned that someone had connected to my password-protected LAN, and stolen files from the local network. Because those speeds (about 3MB/s minimum) are far higher than my ISP max speed of ~450KB/s down, ~80KB/s up. So the only explanation was that some data had been transferred between computers on my local network, through the wifi connection.

I checked my router settings page, and I found multiple clones of my wired desktop PC. These were "connected" to the router, but it really is only 1 PC, there were about 6 copies listed. The copies all had different MAC addresses. So I thought, maybe someone is making THEIR device look like my PC, but they have to connect with a different MAC because it's actually another device?

Well, I changed my password and everything's fine for a week, until today. I get a report from Networx that I used about 3.5GB over the past 10 seconds. Worried, I go to the PC that monitors the router speed, and I see these random spikes, that appear for maybe 1 second, and then rest for 5-6 seconds, then spike again for 1 second. Every spike, Networx toolbar speed graph showed D: 800M, U: 200M (or about that much, it flashed pretty quick.) So this means Networx was reporting the router as using 800MB/s of download bandwidth and 200MB/s upload.

I looked around and found out that some hard drives can't even take that much read/write speed, so what is causing this?

Is Networx causing a false positive? I had about 19GB of use this time in my hourly history, for that single hour. But I disconnected the wifi quickly, and the 800M spikes stopped.

Does anybody know what this is? Am I paranoid? I don't think anyone could take data from my router that fast. So my only two things left that could be the issues are the router and Networx itself.
Sometimes I move files over wifi. The max speed there is maybe 10-11MB/s...

Also, today there were no extra devices listed on the router settings page. Before this, I set up mac filtering, so the network will only accept connections from the listed mac addresses. No phantom PCs this time, but strange activity. Help....
SoftPerfect Support forum - Andrew avatar image

Re: Random router spikes to 800MB/s, but max LAN is 10MB/s?   09 February 2017, 17:16

Most likely it's simply that the router reports incorrect values. We've found that a large number of routers have bugs in their firmware, some even reported negative numbers!

Are you monitoring the router via UPnP? If so, try these utilities: UPnP Gateway Traffic Monitor and UPnP Monitor. Most likely they'll report incorrect readings as well.

If it worked okay before, restarting the router should help.
Yes, I monitor using the UPnP option in the router monitoring section of Networx. Here's something I missed. When I go to the Main tab and click on the Networks... button at the bottom, it shows this

SoftPerfect support forum

I checked my router settings page and the actual router MAC is the top one. I don't recognize the other one, and I keep a list of all the MACs of devices we use.

It's very strange.

I was able to download the second program, but not the UPnP Gateway Traffic Monitor. I emailed the site and told them of their database issue.

Now that I think of it more, when I was setting up the notifications to show me when excessive use was happening. I set it up to be about 700KB over 1 second. This is above my max of ~500 total up and down, so I figured it would be best to know asap rather than wait a full minute or something, if someone was actually in the network.

When I was testing it while loading a youtube video to max out the bandwidth, I noticed it would activate sometimes. And on the Networx graph there would be this kind of shape (recreated in paint)

SoftPerfect support forum

In other words, it looked like Networx or the router lost connection for a second, and then in the next second it displayed that little gap that it missed, as taking place during that next second, in addition to the actual regular traffic.

I'll try those programs and see what happens for now.
Actually, that top triangle should be reversed. Like so:

SoftPerfect support forum

This makes more sense too because the "discovered data" would line up in time with the gap that was missed, and then stack on top of the rectangle of maxed out bandwidth.

Anyway. OCD this time, I guess.
SoftPerfect Support forum - Andrew avatar image

Re: Random router spikes to 800MB/s, but max LAN is 10MB/s?   09 February 2017, 18:59

The Networks dialog merely shows you what routers you connected to and when. So this MAC address 00-01-5C-70-64-46 is probably not at your home.

If you have a laptop that you carry around, looks like you went somewhere on 2/2/2017 and connected to WiFi there - it doesn't indicate your home network was hacked.

Sometimes you can get the answer faster if you try the forum search and/or have a look at the software user manual to see if your question has already been answered.

Our forum rules are simple:

  • Be polite.
  • Do not spam.
  • If possible, check your spelling and grammar.

Author:

Email:

Subject

A brief and informative title for your message, approximately 4–8 words:

     

Spam prevention: please enter the following code in the input field below.

 ********  **      **   ******   **     **  **    ** 
 **        **  **  **  **    **  **     **   **  **  
 **        **  **  **  **        **     **    ****   
 ******    **  **  **  **        **     **     **    
 **        **  **  **  **         **   **      **    
 **        **  **  **  **    **    ** **       **    
 ********   ***  ***    ******      ***        **    

Message: