Q: Unknown data usage early morning

Has anyone tried using a new AT&T provided sim card?

With two more days left in my billing cycle I checked the usage statistics posted by AT&T and compared them to the numbers recorded on my 4S and the wife's 3GS.  For some unexplainable reason, the phones showed MORE data usage than did AT&T (54.47/57.2 & 55.36/60.7 respectively)!!  Both of us recharge the phones at night prior to going to bed.  Once charged or nearly charged, we turn off WiFi and Cellular Data and close out all the apps.  As I pointed out in a post a week or so ago, I've even restored my phone and removed all Apps outside of DataMan Pro, Onavo, and Activity Monitor thinking there might be a rogue one in there.  Little or no change in what DataMan and Onavo report despite that.  Onavo shows an increasing amount of data being sent to or exchanged with "AppleIDXMLRPC" to the tune of 5.52MB since the 25th of April.  As I said in the earlier post, I have no idea what that might be but suspect something iTunes related.  I DON'T use my phone as my portable computer, I am retired and spend 95% of my time in or around the house.  I have WiFi through which I use my MacBook (kitchen/garage) and iMac (upstairs).

That brings me to the following occurrence which I noticed Friday.  I opened the MacBook to check email and saw that Gmail was reloading very slowly.  Right after that I went to Yahoo Finance and checked AAPL, again loading very slowly.  Closed the lid and walked into the living room where the DSL modem and Airport reside.  The DSL modem was furiously flashing away, indicating that data was being sent or received.  With the MacBook closed, the iMac upstairs sleeping, the only other device that could be doing it was my 4S as the wife was 500 miles away with her phone and iPad.  WT. . . . .Heck??

P.S. I change the Airport Extreme passwords every couple of months so the possibility of someone jumping on it seems pretty remote.  Besides, there are four families living on 9 acres of woodlands, the closest house being about 200 feet away. 

I turned our MCell off for 3 full days. During that period, iOS agreed with AT&T on data usage. I then turned it back on and again saw huge numbers from AT&T that iOS did not support. This, along with data showing that when I was out of town, there was no discrepancy either, leads me to believe in my case it's the MCell. I think I know "what" but I still don't know "why" and AT&T has shown little interest in digging into it.

Sim swap is an option and I'll do that if necessary, but I remain unconvinced that the sim is the issue, given good behavior away from the MCell. On a side note, I did update one phone today to 5.1.1 just in case that resolves it. Time will tell.

@JES42 - slightly higher iOS numbers I would consider normal, since AT&T can take time to post usage for a prior day. That XMLRPC traffic might be Diagnostics & Usage data. You might want to see if that's enabled on your iPhone. You can turn off the automatic reporting if the data starts adding up.

Turing off the reporting was one of the first things I did after getting the 4S in February, in fact, everything is turned off.  I've got what is essentially a "dumb" phone in my pocket - phone calls & normal texting until I turn cellulr data back on some time during the day. 

To address a couple of your mysteries, the reason AT&T doesn't list every transfer is because they DID when the phone was first released. People got 300 page bills. And there were huge protests over it.

The reason you see a large transfer at midnight (or 1, 2 or 3AM based on time zone) and also smaller transfers during the day is because of the way usage gets reported. Usage is collected by MTSOs (which control a group of towers), and they forward a single number for each phone to the billing system. As you leave the area covered by one the usage accumulated by that one is sent to the billing system. So if you travel around using data there will be one record for each MTSO's area you leave (the system knows when you leave an area because your phone registers in another area). The large transfer at midnight is the cumulative usage for the last area you were in. Rather than keep the record open until you leave that area it closes the record at midnight. By this process you should not see data from more than 24 hours earlier, unless there is a glitch in the system or if the usage was in a partner's area of coverage rather than the AT&T network and they delayed reporting it.

The ONLY way to know the actual time data transfers took place is to use an app like DataMan.

Lawrence:  Thanks for the additional information.  Unfortunately, AT&T's billing practice is still unclear:

• Large and detailed AT&T bills: Paper bills would be impractical for detailed reporting of data transactions.  AT&T's online client service portal, however, could easily provide a complete recap of data charges -- plus the ability to download a CSV version.  This functionality is currently in place for SMS messages and calls, but not for data transactions.  In addition, AT&T's own customer service managers and technical support team cannot access and explain our data bills.  This is puzzling and frustrating for customers, damaging the reputation of AT&T, the iPhone and Apple. 

• Multiple 'aggregate' billing events due to travel and multiple MTSOs:  This additional info is helpful, but does not explain our bills.  The strange charges listed in my previous post occured when our son's iPhone 4s was in our house,  He was not traveling with it from area to area -- and tower to tower.
• Tracking data usage with Dataman and Onavo:  We downloaded both, to try to reconcile and audit our AT&T bills.  I will report the results as soon as the next billing cycle closes.  This highlights the problem, however.  Customers should not be forced to buy apps, monitor data usage and try to audit their bills every month.  It is AT&T's responsibility to provide sufficient detail to explain their bill -- just as they do today for calls and SMS messages.  On the technical side, there is no way to accurately audit AT&T's bill with Dataman or Onavo -- due to the 1 to 5 day delay in posting aggregate transactions, and the lack of date / time detail. 

Let me post an experiment that I have started in case others would like to try it. Frustrated by the same problem others have been describing here and with no ability to look at the cellular packets, I created a setup where at least I could monitor all of my iPhone’s usage while on a wireless network. Skip down below to see the setup and results so far.

First, my problem: 2 iPhones demonstrating similar behavior as those in this forum but I will focus just on one. This iPhone has an unlimited domestic data plan grandfathered in with AT&T and a 125MB international data plan. The last two times we were in the Caribbean, we got overage notices and then got shut down by AT&T (which was probably good since the bill had gone over $1000 each time).

In looking at the billing statement, we had single 350MB line items on the bill almost every day. I will spare you all of the details of the conversations that I have had with AT&T since they have gotten nowhere. I do understand that the 350MB line item was an accumulation of all of the usage for the day and that even though it said “sent”, it was a combination of both.

For the record, I do have an MCell but that should be out of the equation when we are in the Caribbean.

Second, my experiment: Though I understand that some applications on the iPhone will send more data when connected over wireless than when connected over cellular, I believe that if you watch the iPhone’s packets while connected over wireless, it will pretty much contain at least all of the data packets that would be sent over cellular. So I did the following for my setup:

1. ) Set up my Mac for internet sharing. Doing this, I had wired Ethernet coming into my Mac and it provided a wireless network different from that in my home.
2. ) I set the iPhone to use this new wireless network and had it as the only device on it.
3. ) I ran Wireshark, a free packet analyzer, on my Mac on had it capture all packets that went over this new wireless network.

Third, my early results: Wow, there was a lot of activity! In capturing data for 18 hours, there were 461K packets. Scanning them quickly, here are the most common IP addresses and who owns them:

The biggest offender seems to be 173.194 group belonging to Google, particularly 173.194.68.109 and it seems to be primarily outgoing. A large number were 1484 bytes in length.

Though I don’t understand why either Amazon or Microsoft are in the mix, I concentrated on Google. The phone used IMAP for gmail so I began investigating that. To see if there was a difference, I switched it to use Exchange as described on Google’s setup page and it did not seem to make a difference in the traffic.

One of the first interesting things I noticed is that if I am reading email on my Mac, when I select it and it goes unbold to designate read, the unread count on my phone is updated in less than a second (impressive). However, in order to pull this off, 27 packets are sent between my iPhone and Google, including two from my iPhone that are 1484 bytes each. If I delete a message on my Mac, it is about 50% worse.

If on my iPhone, I look in a mail folder that has only three mail messages, 50K of data is sent to my phone.

More experiments will eventually follow when I have time.

Feel free to comment on the validity of this experiment or post your results from a similar experiment.

Is the Google traffic the exploit that Google planted for iPhones?

http://www.geek.com/articles/news/google-exploits-safari-bug-to-plant-cookies-sa ys-its-known-functionality-20120217/

Since you have WireShark you may want to register and download the FREE trial of Cascade Pilot that compliments WireShark bigtime.

The full-featured, 30-day Cascade Pilot evaluation, please go tohttp://www.riverbed.com/us/contact/cascade-pilot-30-day-trial.php. Cascade Pilot feature-specific videos are also available athttp://www.riverbed.com/us/products/cascade/cascade_pilot.php should you prefer to begin a self-education process by viewing these short and very worthwhile canned demonstrations of this analysis tool.

I can confirm the same thing. Found out with a warning email from AT&T... And it only started happening May 2nd. They started listing the data of my IPad like this:

Date 05/06 is what put me over the limit! (Note: I have no Microcell and it only happens on my Ipad2, not either of my iphones...)

No more individual listings prior to May 2nd. So I'm guessing that the one lump theory is what one fellow said. They just post it at the same time each night. But the business data rep had no reasoning for it and is willing to credit me back next billing. Now in ths event, I think I know what happened. I started playing a game called Air Supremacy on my IPad 2... I'm always in a WIFI area with my IPad and have the basic data plan of 250megs   a month. I've noticed that the game would force out of WIFI and start Gobbling up 3G data. Author says impossible but it's the only hard driven data software I use on the pad. So I shut off 3g for a few days and game worked fine. Now I turned it back on after my AT&T call with an acception. I'm now running a Data Usage Software called: Data Man Pro... http://itunes.apple.com/us/app/dataman-pro-real-time-data/id433617332?mt=8 Using an app like this was suggested by AT&T rep and I think is a great idea. It will track all data usage, (wifi too), and even tell you what is using it. This will help nail it at a local level. If this is what happened with the game, it will tell me. So we shall see.

Hope this helps some of you out trying to snag the issue.

DataMan Pro just issued an update, and now shows data used per app in 10 minute intervals.  This is really just what we need. 

That 10 minute reporting has always been in the version I downloaded a month or so ago but not for individual Apps.  I ended up turning it off because it ended up being a battery hog.  Will have a look at it.  I'm anxious to see how "Doug from MA's" test goes using the individual wireless network plus Wireshark.

I just got the latest update yesterday.  I've never had battery problems with DMP.  I leave it on all the time.  You could try Battery Doctor to improve your battery performance.  It's either free or .99.  I got it too long ago to remember which.

Now had DMP for over a month and reported some discrepancies back to them as there were some reports missing about 4-5 days then all of a sudden a great 900Mb report outta nowhere but after this latest update when you look at the Apps usage it looks like they've finally come up with a way to see what apps are using how much data.  One line with what seems to be Cellular and one with Wi-Fi.  Looks MUCH better so far but it'll be interesting to see how it stacks up against the next AT&T bill.  When we're paying about $200 a month for two iPhones and getting over-charged for data usage we're still questioning, it's getting ridiculous. Lol.

A quick new rundown on Dataman Pro and the changes visually. Looks MUCH better

http://you-are-all-you-need-to-be.blogspot.com/2012/05/small-ray-of-sunshine-on- cloudy.html

~Calineil~

On a recent data usage problem that I encountered during the last 10 days. Perhaps one problem can be caused with email accounts accessing imap servers.

More: https://discussions.apple.com/thread/3944408