Unknown data usage early morning

These Data Usage events started occurring for me at the beginning of May 2010. I only noticed them because I wanted to see if going to the 200 mb plan would be beneficial. To my surprise, my phone was using more than 200 mb all on its own.

To try and determine who/what was doing this, I turned on Airplane mode and there were no 3G access attempts during those 2 nights that Airplane mode was on. I turned Airplane mode off, and the data usage began again.

I tried looking at the iPhone log file but it only records about 4 hours worth of events.

If anyone is awake within a couple of hours after their phone makes these 3G accesses, you can check your log file to see what APP is doing this.

To do this, you'll need the iPhone Configuration Utility that you can download here:

http://support.apple.com/kb/DL851

Hook your iPhone up via the sync cable and run the Configuration Utility. Select the iPhone under Devices on the left and then click the Console Tab. The log file will appear in the window below. Right around the time that you see "Internet/Media Net Activity" on your Billing, there should be some recorded events in the Log File.

Kenny

Message was edited by: KennyGardner

Message was edited by: KennyGardner

So I just got off a lengthy call to ATT and Apple. The ATT tech walked me through all the normal things we have discussed, as well as checking Data Roaming and inquiring about apps that might use Openfeint statistics. After hitting the wall she transferred me to an Apple tech who was puzzled as well, but agreed with me that the answers must lie with ATT, since the cellular network and data moved on it are their servers.

Here were the suggestions gleaned from this call:
#1 Leave feedback about this on Apple's iPhone Feedback form as this tends to get more attention than the forums. You can find this here:
http://www.apple.com/feedback/iphone.html

#2 MAYBE Using a network iPhone app that can track data to see where it is going. If you search the app store for 'traceroute' you will several listed. However due to Apple limitations these may not work for this type of issue like an actual unix terminal service would.

#3 Suggested by me. Since I am getting an iPhone 4, I considered jail-breaking my Gen 1 phone and installing an actual unix terminal app that would allow me to do a tcpdump to see all data moving and an out of my phone.

At the least we should all follow suggestion #1, and push this issue into the light to get Apple talking to ATT about this.

I believe I may have found the culprit for me... and perhaps for you guys as well. It's one of two things I think - not sure since I did both at the same time.

For 3-4 nights, I left Cellular data off, just to prove the data reported early morning wasn't data deferred from earlier in the day. Sure enough, if turning off Cellular Data overnight, no mysterious data showing up early morning.

Then I did these two things:
1) Plugged iP4 into iTunes, CTRL-click on iphone and do 'Reset Warnings', then CTRL-click again and hit 'Sync', and then the "would you like to send Apple crash reports, bla bla bla"... hit "Disagree"

2) go to http://oo.apple.com using your iPhone ( http://support.apple.com/kb/HT4228)

After doing those two things, I started leaving Cellular Data ON over the last couple of nights.

Low and behold - at worst, 1-2MB overnight and that's from some emails that came in overnight. No huge 40-50MB chunks, or even 100+MB chunks which I've also had...

I don't know which of the two did it, or maybe a combination of both. I don't really care, all I wanted is to eliminate any "unapproved by ME" data being transferred overnight without my knowledge or consent. Seems to be working so far after two nights. Will continue to monitor obviously.

Here's my log:
- first 3 days (7/2-7/4) included tethering - ignore the amount, but note late night transfers - and I was asleep for sure
- next 3 days (7/5-7/7) or so, no tethering, no streaming while on 3G... still some late night activity...
- from 7/8 to 7/11, Cellular Data turned off at night
- 7/12 did some streaming before going to bed - explains the 50MB (ouch)
- left Cellular Data ON 7/13 early morning - a mere 1.2MB at 2:22am... and it didn't log yet, but similar for 7/14 (as I reset my data usage meter on the iphone last night, and only had like 2MB this am)...

07/13 08:37 PM phone Internet/MEdia Net Sent 3047KB
07/13 07:04 PM phone Internet/MEdia Net Sent 4492KB
07/13 06:56 PM phone Internet/MEdia Net Sent 440KB
07/13 06:48 PM phone Internet/MEdia Net Sent 74KB
07/13 06:34 PM phone Internet/MEdia Net Sent 22KB
07/13 04:20 PM phone Internet/MEdia Net Sent 356KB
07/13 03:01 PM phone Internet/MEdia Net Sent 1698KB
07/13 11:36 AM phone Internet/MEdia Net Sent 1418KB
07/13 10:49 AM phone Internet/MEdia Net Sent 20KB
07/13 09:21 AM phone Internet/MEdia Net Sent 160KB
07/13 09:13 AM phone Internet/MEdia Net Sent 25KB
07/13 02:22 AM phone Internet/MEdia Net Sent 1178KB
07/12 07:22 PM phone Internet/MEdia Net Sent 9616KB
07/12 06:08 PM phone Internet/MEdia Net Sent 94KB
07/12 03:24 PM phone Internet/MEdia Net Sent 227KB
07/12 02:41 PM phone Internet/MEdia Net Sent 83KB
07/12 01:27 PM phone Internet/MEdia Net Sent 53KB
07/12 12:55 PM phone Internet/MEdia Net Sent 87KB
07/12 12:06 PM phone Internet/MEdia Net Sent 118KB
07/12 11:29 AM phone Internet/MEdia Net Sent 124KB
07/12 11:25 AM phone Internet/MEdia Net Sent 166KB
07/12 07:35 AM phone Internet/MEdia Net Sent 4490KB
07/12 12:16 AM phone Internet/MEdia Net Sent 50056KB
07/11 10:40 PM phone Internet/MEdia Net Sent 6181KB
07/11 05:25 PM phone Internet/MEdia Net Sent 4503KB
07/11 08:30 AM phone Internet/MEdia Net Sent 5673KB
07/10 02:52 PM phone Internet/MEdia Net Sent 20045KB
07/10 08:43 AM phone Internet/MEdia Net Sent 400KB
07/09 06:50 PM phone Internet/MEdia Net Sent 9776KB
07/09 10:36 AM phone Internet/MEdia Net Sent 84KB
07/08 06:52 PM phone Internet/MEdia Net Sent 8029KB
07/08 11:51 AM phone Internet/MEdia Net Sent 40329KB
07/08 11:23 AM phone Internet/MEdia Net Sent 20KB
07/08 10:39 AM phone Internet/MEdia Net Sent 23KB
07/08 09:10 AM phone Internet/MEdia Net Sent 94KB
07/08 08:04 AM phone Internet/MEdia Net Sent 20727KB
07/07 05:51 PM phone Internet/MEdia Net Sent 44277KB
07/07 05:32 PM phone Internet/MEdia Net Sent 46KB
07/07 05:20 PM phone Internet/MEdia Net Sent 18KB
07/07 05:11 PM phone Internet/MEdia Net Sent 36KB
07/07 04:41 PM phone Internet/MEdia Net Sent 28KB
07/07 04:01 PM phone Internet/MEdia Net Sent 26KB
07/07 03:51 PM phone Internet/MEdia Net Sent 41KB
07/07 03:40 PM phone Internet/MEdia Net Sent 13KB
07/07 03:24 PM phone Internet/MEdia Net Sent 21KB
07/07 03:21 PM phone Internet/MEdia Net Sent 5KB
07/07 01:23 PM phone Internet/MEdia Net Sent 267KB
07/07 11:40 AM phone Internet/MEdia Net Sent 200KB
07/07 10:58 AM phone Internet/MEdia Net Sent 47KB
07/07 02:21 AM phone Internet/MEdia Net Sent 2789KB
07/06 06:54 PM phone Internet/MEdia Net Sent 30890KB
07/06 05:53 PM phone Internet/MEdia Net Sent 154KB
07/06 04:25 PM phone Internet/MEdia Net Sent 192KB
07/06 01:34 PM phone Internet/MEdia Net Sent 260KB
07/06 12:59 PM phone Internet/MEdia Net Sent 47KB
07/06 12:29 PM phone Internet/MEdia Net Sent 317KB
07/06 12:20 PM phone Internet/MEdia Net Sent 822KB
07/06 11:37 AM phone Internet/MEdia Net Sent 7985KB
07/06 09:55 AM phone Internet/MEdia Net Sent 1696KB
07/06 08:51 AM phone Internet/MEdia Net Sent 65KB
07/06 02:00 AM phone Internet/MEdia Net Sent 9000KB
07/05 02:36 AM phone Internet/MEdia Net Sent 62762KB
07/04 05:53 PM phone Internet/MEdia Net Sent 4802KB
07/04 05:39 PM phone Internet/MEdia Net Sent 30KB
07/04 05:27 PM phone Internet/MEdia Net Sent 117KB
07/04 01:57 AM phone Internet/MEdia Net Sent 123514KB
07/03 10:16 PM phone Internet/MEdia Net Sent 160271KB
07/03 09:54 PM phone Internet/MEdia Net Sent 58411KB
07/03 03:56 PM phone Internet/MEdia Net Sent 35445KB
07/03 02:47 AM phone Internet/MEdia Net Sent 90791KB
07/02 10:45 PM phone Internet/MEdia Net Sent 110815KB
07/02 10:44 PM phone Internet/MEdia Net Sent 69KB
07/02 09:36 PM phone Internet/MEdia Net Sent 1642KB
07/02 05:38 PM phone Internet/MEdia Net Sent 2007KB
07/02 05:22 PM phone Internet/MEdia Net Sent 55KB
07/02 04:57 PM phone Internet/MEdia Net Sent 74KB
07/02 04:17 PM phone Internet/MEdia Net Sent 20KB
07/02 03:58 PM phone Internet/MEdia Net Sent 17KB
07/02 01:22 PM phone Internet/MEdia Net Sent 316KB
07/02 11:18 AM phone Internet/MEdia Net Sent 954KB
07/02 10:40 AM phone Internet/MEdia Net Sent 85KB
07/02 10:15 AM phone Internet/MEdia Net Sent 21KB
07/02 02:54 AM phone Internet/MEdia Net Sent 30982KB
07/02 12:54 AM phone Internet/MEdia Net Sent 490KB
07/02 12:08 AM phone Internet/MEdia Net Sent 33566KB

link to my original thread: http://discussions.apple.com/thread.jspa?threadID=2520025

After I started a separate thread earlier today about this same issue, I was directed to this ongoing thread. I have read this thread in its entirety, and I have a few observations I'd like to add:

1. While some seem satisfied with the explanation that the mysterious data usage in the middle of the night is actually just an accumulated figure for their entire day's usage, this is not the case for many others including myself. My bill very clearly shows my actual data usage at all the appropriate times — the bus ride to and from work and my time away from Wifi during lunch for example; the mysterious charges on my bill are *IN ADDITION* to my easily-monitored daily usage.

2. I'm seeing my morning data usage, reading the news while I get ready for work, show up on my cellular usage when the phone should be connected to Wi-Fi. So my iPhone 4, perhaps others, are not rejoining the Wi-Fi network after awaking from sleep, despite claiming they have. This jibes with another user's report of visibly confirming he was on Wi-Fi before downloading a big file, only to have it show up on his cellular data charges.

3. While all the latenight data could be push email, no one has really addressed that checking for and receiving but a few attachment-free emails a night would not account for even 1MB, let alone 5, 6, 10 or 100.

Now a couple conspiracy theories:

4. This thread was started June 5th, when people started noticing unclaimed data usage on their iPhones; AT&T introduced their capped data plans on June 2nd. How convenient. How even more convenient that AT&T's most common "solution" to customers is upgrade to a more expensive data plan.

5. A number of people noticed unexplainable data spikes earlier than June — around April. I have a theory that this may have been when Apple started collecting user data for iAd placement, and that may be what all of this unexplained usage is about. If this is the case, I expect they are only collecting data from users with push notifications enabled, because they're less likely to notice the extra usage and it conveniently masks the data collection (i.e., disabling push stops the mysterious usage so it must be all of those emails I never get at night).

6. Or, it's just a push notification glitch stuck in a loop, coupled with shoddy send/receive code that makes 40kb bloat to 3MB 😝

Lawrence Finch wrote:
The only way to force it to be on WiFi is to leave the screen on. Once the screen goes off WiFi goes off. So if you turn off cellular data you will receive or send no data when the phone is on standby. No cellular, no WiFi.

Apparently if you don't have a 3G connection (out of range, SIM card removed, etc., or maybe if the cellular data is turned off) then iOS 4 will persist the WiFi connection even when the screen is locked. (It may also be a requirement that the phone be plugged in; I haven't tested this myself.) See:

http://forums.macrumors.com/showthread.php?t=936074
http://discussions.apple.com/thread.jspa?threadID=2470304

chcn wrote:

Lawrence Finch wrote:
The only way to force it to be on WiFi is to leave the screen on. Once the screen goes off WiFi goes off. So if you turn off cellular data you will receive or send no data when the phone is on standby. No cellular, no WiFi.

Apparently if you don't have a 3G connection (out of range, SIM card removed, etc., or maybe if the cellular data is turned off) then iOS 4 will persist the WiFi connection even when the screen is locked. (It may also be a requirement that the phone be plugged in; I haven't tested this myself.) See:

http://forums.macrumors.com/showthread.php?t=936074
http://discussions.apple.com/thread.jspa?threadID=2470304

Definitely true. You can test this yourself if you are able to get the IP address of your phone. There are multiple ways of doing this - your WiFi router usually has a page in the admin console that tells you what devices are connected and what their IP addresses are. There are also iPhone apps that tell your what your WiFi and 3G IP addresses are.

Anyway, once you get your WiFi IP address, get to a computer on your WiFi network and try this.

First, open some form of command line interface (in Windows, run the command 'cmd', in Mac OS X use Terminal). Type 'ping <ip address>' and hit enter. You should see something that looks like this:

PING 10.2.204.130 (10.2.204.130): 56 data bytes
64 bytes from 10.2.204.130: icmp_seq=0 ttl=63 time=55.623 ms
64 bytes from 10.2.204.130: icmp_seq=1 ttl=63 time=86.491 ms
64 bytes from 10.2.204.130: icmp_seq=2 ttl=63 time=100.350 ms
64 bytes from 10.2.204.130: icmp_seq=3 ttl=63 time=23.572 ms

(10.2.204.130 is my phone's current address - yours will differ and so will the timings). All this does is that it sends small amounts of data to your phone asking your phone to reply if its there, and these lines mean that your phone replied.

Now, with cellular data on, lock your screen and wait a couple of minutes - it seems the amount of time it takes to disable the wifi varies. Sometimes its as little as 15s, but other times its longer. If you run the same command as before, you should now see this:

Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
Request timeout for icmp_seq 4
Request timeout for icmp_seq 5

What this says is that your computer is no longer hearing back from your phone - i.e. your phone isn't on the WiFi network anymore.

Now, if you unlock your phone again and turn cellular data off and repeat this test, you should find that your phone will still respond to your computer even after it has been turned off for a while.
PING 10.2.204.130 (10.2.204.130): 56 data bytes
Request timeout for icmp_seq 0
64 bytes from 10.2.204.130: icmp_seq=1 ttl=63 time=80.645 ms
64 bytes from 10.2.204.130: icmp_seq=2 ttl=63 time=58.475 ms
64 bytes from 10.2.204.130: icmp_seq=3 ttl=63 time=82.140 ms
64 bytes from 10.2.204.130: icmp_seq=4 ttl=63 time=104.099 ms
64 bytes from 10.2.204.130: icmp_seq=5 ttl=63 time=25.705 ms

For this to happen, your phone doesn't need to be plugged in. I haven't tested the case where the phone is plugged in and cellular data is on.

These tests were all run on an iPhone 4 so YMMV if you have a different model - I don't know the exact differences.

Message was edited by: Lawrence T.

Message was edited by: Lawrence T. <added quote of message I'm replying to>

I had a user whose iPhone 4 had excessive data usage between 2 AM and 5 AM, and in general when they were away from Wi-Fi.

In the Mail app I found an email with an attachment that had been stuck in the Mail app’s Outbox for weeks. I deleted the email after turning off data connections on 8/27.

The Mail app was constantly trying, unsuccessfully, to send the email, and was using up a lot of cellular data bandwidth at night when Wi-Fi was unavailable.

Once the email was deleted, the nighttime cellular data usage stopped almost completely. See the data usage log below.

I also downloaded an iPhone profile that is recommended to improve communication between iPhones with iOS 4 and Exchange servers. See http://support.apple.com/kb/TS3398

Tom

08/29/2010 02:15 AM phone Media Net/Internet 7 O H
08/28/2010 10:21 PM phone Media Net/Internet 10 O H
08/28/2010 02:28 AM phone Media Net/Internet 59 O H
08/27/2010 11:25 PM phone Media Net/Internet 40 O H
08/27/2010 09:52 PM phone Media Net/Internet 9 O H
08/27/2010 09:46 PM phone Media Net/Internet 7 O H
08/27/2010 09:42 PM phone Media Net/Internet 7 O H
08/27/2010 09:39 PM phone Media Net/Internet 7 O H
08/27/2010 09:36 PM phone Media Net/Internet 7 O H
08/27/2010 09:29 PM phone Media Net/Internet 8 O H
08/27/2010 09:26 PM phone Media Net/Internet 7 O H
08/27/2010 09:06 PM phone Media Net/Internet 8 O H
08/27/2010 09:03 PM phone Media Net/Internet 7 O H
08/27/2010 09:00 PM phone Media Net/Internet 7 O H
08/27/2010 08:53 PM phone Media Net/Internet 7 O H
08/27/2010 08:47 PM phone Media Net/Internet 7 O H
08/27/2010 08:40 PM phone Media Net/Internet 7 O H
08/27/2010 08:30 PM phone Media Net/Internet 7 O H
08/27/2010 08:04 PM phone Media Net/Internet 7 O H
08/27/2010 08:01 PM phone Media Net/Internet 7 O H
08/27/2010 07:57 PM phone Media Net/Internet 7 O H
08/27/2010 07:54 PM phone Media Net/Internet 8 O H
08/27/2010 07:51 PM phone Media Net/Internet 8 O H
08/27/2010 07:41 PM phone Media Net/Internet 7 O H
08/27/2010 07:38 PM phone Media Net/Internet 8 O H
08/27/2010 07:31 PM phone Media Net/Internet 7 O H
08/27/2010 07:28 PM phone Media Net/Internet 7 O H
08/27/2010 07:15 PM phone Media Net/Internet 16 O H
08/27/2010 05:12 PM phone Media Net/Internet 21 O H
08/27/2010 05:10 PM phone Media Net/Internet 7 O H
08/27/2010 05:07 PM phone Media Net/Internet 7 O H
08/27/2010 01:49 PM phone Media Net/Internet 28 O H
08/27/2010 12:19 PM phone Media Net/Internet 9 O H
08/27/2010 12:13 PM phone Media Net/Internet 47 O H
08/27/2010 12:06 PM phone Media Net/Internet 18 O H
08/27/2010 02:40 AM phone Media Net/Internet 12177 O H
08/26/2010 02:28 AM phone Media Net/Internet 274688 O H
08/25/2010 09:58 PM phone Media Net/Internet 22518 O H
08/25/2010 06:42 PM phone Media Net/Internet 36207 O H
08/25/2010 02:46 AM phone Media Net/Internet 83427 O H
08/24/2010 09:57 PM phone Media Net/Internet 18712 O H
08/24/2010 04:22 AM phone Media Net/Internet 159369 O H
08/24/2010 12:55 AM phone Media Net/Internet 5087 O H
08/23/2010 08:06 PM phone Media Net/Internet 8 O H
08/23/2010 02:28 AM phone Media Net/Internet 43976 O H
08/22/2010 02:24 AM phone Media Net/Internet 247852 O H
08/21/2010 01:44 AM phone Media Net/Internet 53446 O H
08/20/2010 05:35 PM phone Media Net/Internet 70760 O H

shortduck wrote:
Can any1 please tell me how to do this, or a webpage.
I have searched almost 10-15 pages on this thread to get get an answer.

Thanks

Try the post at the end of http://discussions.apple.com/thread.jspa?messageID=12033716 - about 12 pages back, so you can't have been really looking 10-15 pages back...

Maybe we are asking the wrong people. I have sent the following to Saurik@Saurik.com:
Saurik,

AT&T and Apple are both ducking this issue. I brought it up some time ago. I do not believe it has anything to do with apps. Is this something you could take a quick peek and comment on?

http://discussions.apple.com/thread.jspa?threadID=2450738&tstart=0&messageID=123 16472#12316472

Thank you and I support your work financially,


Maybe if more of us ask him he would take an interest in the problem. I believe he is the man that can answer this question.

This is not the solution to the issues described within this thread--- this is an app to monitor your data usage for both cellular and WiFi

DataMan - Monitor & Geotag Your Data UsageBy XVision
http://itunes.apple.com/us/app/dataman-monitor-geotag-your/id393282873?mt=8