Hi all,
recently I too have started to struggle with this problem, so I thought it would be useful to report my experience.
My terse answer is: the problem could be due to iCloud synchronization.
The complete reasoning follows in this post, in which I try to summarize my findings so far, accompanying them with a proper defence. I hope this helps getting rid of the problem as well as establishing or retracting the validity of several commonly suggested repair actions.
Excessive unintended usage of mobile data (up to ~600MB per "data session"), of course depleting my 1GB weekly plan.
Occurring on an iPhone 6 and on an iPad Air 2 (same Italian mobile operator: TIM), both using iOS 9.2.1.
The only cellular data usage counter that significantly (enormously) increased after each occurrence of such a condition is "System Services->General". Definitely none of the app-specific counters indicated unexpected amounts of consumed data.
I have been using iOS 9 roughly since its roll-out in Italy last september. Since then, I have performed all the released minor upgrades, up to the most recent iOS 9.2.1. Mobile data usage has always been perfectly fine and in line with my usage pattern up to about a couple of weeks ago (no iOS upgrades occurred at that time).
Therefore, I am fairly sure iOS 9 is not the (only) culprit.
I have at least two reasons for concluding this.
- I have tried to execute a manual backup of my chats while I was connected to WiFi, which is backed by an ADSL with 1Mb/s upload bandwidth. WhatsApp reported the total backup size to be 496MB, therefore it should have taken more than one hour to perform a full upload. Instead, it took just about 2 minutes, and the upload progress evidently "leaped" some chunks of data (and the corresponding percentage values). This makes me conclude that backups are incremental (i.e., only data that has changed since the last backup is uploaded to the server), which makes perfectly sense.
- The excessive data usage problem occurs also on the iPad, where WhatsApp has never even been available as an app.
Of course I have been thinking several times that the anomalous traffic could be triggered from the network instead of the mobile device (e.g., something like "ping storms" or any other kind of traffic coming from the mobile network and silently soliciting a response from the mobile device, or even just sent to the device without any responses expected).
However, I find it somewhat unlikely because the detailed report of my data plan usage, issued by the mobile operator, reveals that unintended bulk transfers occurred in the following conditions, which are very likely to match malicious activity patterns:
- For the iPhone, they mostly occurred at the exact times when I switched it on.
- For the iPad, they mostly occurred around midnight (consider that I turn off my access point in the evening - before midnight - and the iPad is powered on 24/7).
I conclude this because I just keep WiFi off for most of the time on my iPhone, therefore there is no reason for cellular data to be consumed to "come to the rescue" of WiFi. In the rare cases when I use WiFi, I am usually at home with very high signal strength.
After resetting cellular data usage counters, I have tried to download a previously purchased app totaling around 5MB. Most of the consumed data traffic was accounted in the "App Store" entry of the "Settings->Cellular data" menu. Only less than 1 MB was reported for "System services", 0 of which for the "General" entry.
As a side note, I have always been keeping the "Use cellular data" option turned on for automatic app updates, without ever seeing any relevant data usage (I suppose the App Store self-limits when connected via cellular network). Moreover, dates of last update of the apps do not coincide with the dates for which the mobile operator's log reported abnormal data consumption, so I can reasonably assume that not even automatic app updates are involved.
Based on the observation at point 3 above (that unintended bulk transfers occurred at the time of switching on the phone), I have tried to monitor the active TCP connections on the iPhone at boot time, immediately after the "Apple" logo disappeared. I have used the HE.NET app for this purpose. With the help of a Whois service invoked on the remote endpoint's IP of each TCP connection, I could narrow down the involved services to the following:
- Yahoo
- Dropbox
- Amazon
- Adobe
- Google
- CloudFlare
- Akamai
Most of these are justified by the presence of an associated app. Others (Akamai, CloudFlare, Adobe) are fairly generic but still apparently reasonable.
According to the operator's cellular data usage log, the largest amounts of data have been consumed on the iPhone on a specific day of the week: Saturday. There are no special operations I accomplish on this day, especially at the time of switching on the phone and, definitely, nothing that I didn't do in the era when the problem never occurred. Unfortunately, this observation is a bit flawed considering that the same report on the iPad showed data consumption also on other days of the week.
So far during my experiments iCloud was the only service that caused an increase of the "System services->General" counter. The tests were pretty simple: after resetting cellular data usage counters, I have applied changes to a document in an app which synchronizes with iCloud. The app-specific data counter did not increase significantly at all, whereas the "General" counter increased by a more or less expectable amount.
Even more, in a file manager app that has access to iCloud I have tried to drop a file of a few Megabytes in the iCloud area, seeing no increase for the app-specific counter and an increase of a few Megabytes of the "General" counter.
In the end, this makes me suspect that iCloud could be the culprit. I am keeping cellular data usage for iCloud disabled in the following days. Even if this rather annoys me (since the goal of keeping everything synchronized at any time is defeated), I hope at least it will help me get rid of this very disturbing problem. Of course, the reason why this started to happen suddenly, without any updates/upgrades or configuration changes occurring between the "before" and the "after", will remain a mystery. For the moment, I can only assume that some iCloud-based app has been "inadvertently flawed".
Hope this helps you as well.