Re: MiFi Overages like crazy
No1rly
Newbie

Lots of questions. That setup is actually what I was thinking of using with a router acting as a bridge and switch, and then it hit me: the MiFi cellular connection to the tower and Verizon's network is a black box. So the concern I now have is the extent the customer is responsible regarding traffic between the MiFi and rest of Verizon's network.

Is incoming internet traffic unrestricted to the MiFi JetPack?

If it is filtered by Verizon, then how is it filtered?

If malicious and DoS attacks are aimed at the WAN IP from the outside, does is count as data usage?

What does the WAN IP and MAC represent? The Jetpack or something more upstream?

I'm not beyond investing in a cellular spectrum analyzer if a technique can be employed to correlate the statistical spectrum with actual data usage to at least a 90% confidence.

0 Likes
Re: MiFi Overages like crazy
John_Getzke
Champion - Level 1

You are correct.  The cellular connection between the VZW device and towers is a black box.  Also included in that black box is the entire VZW network billing system that sits behind their NAT.  Common folk like us do not have a way to see any of this data to perform our own analysis.  All VZW will expose is the final bill at the end of the billing cycle and limited data on the various sessions that we consumed.  We can pick apart our personal traffic all we want but the key to solving a data issue would be to see what VZW sees and cross reference it with our own information.

To answer your questions to the best of my knowledge:

1. Unknown.  I have always assumed that any data sent from the VZW network to the device will be counted against the user of that device.  VZW does not care if the data makes it to an end users computer or not.  All VZW cares about is the traffic to and from the VZW device and their network.  Regardless of the circumstances those who use more are billed more.

2. Unknown.  VZW does not expose information on how it decides what portions of our traffic is billed against us.  For example the headers wrapped around each data packet are most likely not counted against us, but the raw data should be.  Another key factor would be errors, retransmissions and dropped packets.  If something happens to the data in transit as a result of the networks supporting it then its reasonable to assume a user could get billed multiple times for the same traffic until a successful delivery is made.  Factor that into the speed of the 4G LTE network and you can start to see how a simple download can quickly balloon out of proportion.

3. No (it shouldn't).  A DoS attack can only target the VZW firewall, not an individual device unless that device opened up a pathway to the attacker in the first place.  All VZW broadband devices are anonymous behind the VZW firewall by design, which is why all public IP dependent services do not work on the new LTE network.  There should be no way for a random DoS attack to target your specific device and bombard it with traffic unless there was a client already installed on one of the personal machines requesting the traffic in the first place.  I have seen a few threads on the VZW forums where DoS type traffic can be confirmed by VZW and has been refunded or discounted back to the user.  Some devices even detect this on their own and automatically shut themselves down.

4. The WAN IP is that of the NAT Firewall, same with the MAC.  There are no personal identifiers to the majority of all VZW devices on the new 4G LTE network.  Exceptions would include anyone on HomeFusion or a purchased static IP Address.  Some smartphones with full IPv6 enabled on them can also be directly targeted, but the majority of the personal broadband/jetpack devices cannot be.

A spectrum analyzer would be helpful in the hands of the right person when analyzing a data leak.  But remember, an analyzer without the VZW decoder will only be able to see the raw radio signals passing over the air.  This is helpful up to a point, especially when observing a good download vs. a bad download.  You could also analyze the spectrum while connected to different towers to isolate certain issues too.  In in end you would have to make assumptions based on the radio activity as to what is going on.  Raw radio issues would not necessarily be concrete evidence of any specific problem to the billing system, VZW hardware or connected personal devices, but it would be a good start.  I do not have access to a spectrum analyzer so I cannot offer any assistance on that subject.

0 Likes
Re: MiFi Overages like crazy
obsestheart
Enthusiast - Level 1

I also have a wireless printer.  I am being charged overage almost every monrh. I am single no movie streaming no games no videos and only use 1 tablet and have a laptop I only use occasionally and keep it off. I turn the WiFi off my phone and tab. Verizon still has me going over a total of 7 gigs a month. I have 5 on the jet pack and 2 on my phone which is my plan. I get text every month like 10 days into my cycle that I've retched 90 percent and then go over within 2 days.

0 Likes
Re: MiFi Overages like crazy
Typhoon1964
Newbie

Any use of the internet/wifi is use of the device. Turn off all auto updates and note that updating devices like a Garmin will eat data like a pig. Verizon now has an alert system that will help a little. You can set it for preset warning percentages but remember that some data usage may come from another carrier's tower and may be slow by several days to register. No expert but I had a similar experience and above helped me.

0 Likes
Re: MiFi Overages like crazy
acmuns
Newbie

Clearly Verizon has a problem clarifying a technical situation that is always favorable to them and their bottom line.

I have had problems with being over billed on 2 hot spots and a MiFi. I can not even go into all of the times verizon has over billed me even when the devices are unplugged and not available for use. I have tried everything from customer service to screen shots of my bills and even called their corporate office.Nothing worked.I have even received auto generated texts of impending overages 5 minutes apart from each other when the devices are not in use. I went so far as to find another wireless carrier that used Verizon's network. I had 0 problems and never used more than 6 Gigs per billing cycle. Two months ago that wonderful and honest company was purchased by Verizon……..Two Days ago I returned to my vacation home after being gone for 2.5 months and looked at messages sent to my MiFi. ALL OF THEM SAID I WAS OVER MY 20Gig allowance.

No,friends, this is not a technical issue that can't be solved so don't waste your time. This is Fraud. This is a scam and Verizon knows it. Just brows the internet and look at all the complaints. I'm not going to take it anymore and will file a formal complaint with the FCC and the FTC.

Verizon needs to face a MASSIVE fine for abuse of government license, and willfully perpetrating a Fraud on it's customers.

Please feel free if you have documentation showing this abuse to add to my legal brief.

0 Likes
Re: MiFi Overages like crazy
hk11
Newbie

I'm a network engineer and computer technician and ran into a MiFi data usage problem today. My customer has a single computer with a USB printer (no network) and the computer is connected to a Verizon MiFi. He's had this setup for about a month and two days ago his data usage went crazy, about 12GB in a matter of hours. He doesn't watch videos/movies or listen to music and the data consumption happened mostly while he was sleeping. He started getting text message alerts, one after the other. He had to up his data plan to 20GB (from 4GB) just to try to not go bankrupt from the overage charges.

I did some wiresharking on it today and found that some process, yet unknown, was communicating on 192.168.1.2 (his computer's IP) and 192.168.3.6, both Class C local IP addresses. The protocol was TCP and the ports were 80 and 50850. While this was happening I attempted to ping 192.168.3.6 and got no response. I couldn't find any suspicious processes running on his machine.

Through my troubleshooting the problem appears to possibly have resolved itself, but I still don't know what I did to resolve it. I disabled every non-microsoft thing in MSConfig but later re-enabled all of it and the problem didn't come back. I also disabled his local LAN connection. It has no wires in it and no IP address, but I disabled it anyway.

But the real take away from all of this is that Verizon is charging people for Local Area Network traffic and that LAN traffic might not even be communication with a real machine/device. I really believe this problem should be reported to the FCC, although I really need to confirm that these packets were not passing out through the MiFi's WAN interface and that wasn't something I took the time to do this morning when I was troubleshooting it. It would not be a trivial effort and I don't think my customer will be willing to pay for it.

0 Likes
Re: Re: MiFi Overages like crazy
7e18n1
Specialist - Level 3

> I did some wiresharking on it today and found that some process, yet unknown, was communicating on 192.168.1.2 (his computer's IP) and 192.168.3.6, both Class C local IP addresses. The protocol was TCP and the ports were 80 and 50850. While this was happening I attempted to ping 192.168.3.6 and got no response.

Maybe you’ve never noticed this before, but such IP destinations are not all that unusual, especially on a laptop that connects to different networks. If you pulled this 3.6 IP as the destination of a packet from the subject computer, the printer driver may have a PORT configuration with that IP. Even if that port is disabled, the driver may still send data to that IP address at seemingly random intervals. If no such PORT configuration exists then look at the routes. The Ethernet driver might have that as a static IP address. These are the three most likely places that IP originated. Or, see if you can find that IP in the registry for a clue as to what’s trying to use it. If it’s not in the registry look closer at all third party software that might use a fixed IP address. Regardless, 192.168.3.x cannot ordinarily interact with the 192.168.1.x subnet in a hardware fixed /24 private network.

> But the real take away from all of this is that Verizon is charging people for Local Area Network traffic and that LAN traffic might not even be communication with a real machine/device.

From recent experiments, this is not the case. I watched this occur in the past but I have not observed it lately. You’ll have to provide details of your experiments if you find differently. My data plan renewed this morning and I checked it first thing with a 120 MB file between laptops and had no data usage.  

0 Likes
Re: MiFi Overages like crazy
John_Getzke
Champion - Level 1

> 192.168.1.2 (his computer's IP) and 192.168.3.6

The Jetpack shouldn't have a subnet large enough to reach 3.6.  Normal default subnet mask is for one segment which should be 192.168.1.1 to 192.168.1.256 (minus two reserved for router IP and broadcast).  There shouldn't be anything on 3.6 to communicate with.  I would have the user doublecheck and confirm the basic configuration info with you. If its funky then reset the Jetpack back to the defaults.

> the data consumption happened mostly while he was sleeping

Clue here.  Automatic updates are well known to happen during off hours.

>TCP  ports were 80 and 50850.

Port 80 is normal http, most likely from a browser.
Service Name and Transport Protocol Port Number Registry

No idea what 50850 would be used for.  Some kind of automatic update from a background application or service I suppose. Whatever was happening the traffic may be on a different port the next time the machine fires off that process.

> I attempted to ping 192.168.3.6 and got no response.

That address is outside of the subnet on the Jetpack.  The machine would have to be bridged into two separate networks (most likely one wireless and one wired) for it to be able to communicate with that address.  If the machine was communicating with 3.6 at any time then it wouldn't have been going through the Jetpack to do so and wouldn't be on the VZW bill.

> I couldn't find any suspicious processes running on his machine

Wireshark is great, its wonderful to get a network engineers feedback on the situation.  However Wireshark doesn't reveal application information, only the network traffic that is running through that instance.  If this person continues to have problems I would suggest installing Glasswire in addition to wireshark.  Glasswire is more user friendly and it also provides us with a breakdown of internet usage by application which is very helpful in these situations.

Something isn't adding up in this scenario.  If traffic is truly transferring to 3.6 then it would be local traffic.  Not only would it be local but it would also not be going through the Jetpack.  I don't see how the Jetpack could even monitor traffic on a network its not connected to.

Do the VZW logs match up with your findings from Wireshark?

0 Likes
Re: MiFi Overages like crazy
John_Getzke
Champion - Level 1

> Normal default subnet mask is for one segment which should be 192.168.1.1 to 192.168.1.256 (minus two reserved for router IP and broadcast).

Ugh.  To clarify I mean the default subnet mask is 255.255.255.0.  IP range is 192.168.1.1 to 1.256.  DHCP range is normally the first 100 IPs or so.

0 Likes
Re: MiFi Overages like crazy
lexcamlo
Enthusiast - Level 1

Help! I see all these post's of other verizon customers who have experienced the very same thing I am going through. My current bill with Verizon is $3200!!  They are claiming that we have gone from 30gb to 300gb in one month! What can I do? We already pay $700/month for 8 lines of service, this is outrageous. I have called numerous times, I have downloaded all internet using device's usage history and they do not match, however, Verizon does  not believe me!

Thanks for the help!

bill.PNG