Linux, desperate, how can I find a particular website that sucks all my bandwidth?

[Chris]

[added ucol]

I have a mobile broadband contract with Spusu of only 5GB data per month.
I use my Android phone for tethering and I have disabled all apps from
accessing mobile data, so the data gets only used by my laptop, running
Debian Bookworm, when it connects to the Android hotspot.
I basically use the same sites every days (online translators). I use
Thunderbird for email and Usenet only from public wifi, so this doesn't
go into my data allowance. Same thing for the occasional Youtube videos.
Ma daily data has jumped from around 50MB a day to 250-300MB a day!
I have installed an extension on Firefox that blocks all images, frames,
movies, etc. I still get these dreaded 250 MB a day.
Is there a program that I can run on Linux that checks at what time I
have peaks of data?
I have to rule out (I hope) viruses, trojan horses, etc, as this is
Linux and not Windows, but you never know.
I don't have any automated updaters of any kind. Firefox has been
configured not to update itself, same thing for plugins.
I have disabled Firefox memory cache and enabled disk cache to save data.
So what is it?

I've cross-posted to uk.comp.os.linux as this is more of a linux question.

Nowadays lots of software has their own updaters. Linux is better than most
as updates go via the repo mostly. Have you checked the package manager
isn't downloading updates in the background?

Same on your phone? Are you able to disable automatic downloads of OS
updates. I believe the play store does this transparently

[grinch]

Post by Chris
[added ucol]

I have a mobile broadband contract with Spusu of only 5GB data per month.
I use my Android phone for tethering and I have disabled all apps from
accessing mobile data, so the data gets only used by my laptop, running
Debian Bookworm, when it connects to the Android hotspot.
I basically use the same sites every days (online translators). I use
Thunderbird for email and Usenet only from public wifi, so this doesn't
go into my data allowance. Same thing for the occasional Youtube videos.
Ma daily data has jumped from around 50MB a day to 250-300MB a day!

snip

Post by Chris
Same on your phone? Are you able to disable automatic downloads of OS
updates. I believe the play store does this transparently

The prime suspect for the laptop is google .I have noticed the my add
blocker on my pfsense firewall is constantly blocking Firefox phoning
home,even though my default search engine is duckduckgo.

Fire up a copy of wireshark or tcpdump if you like doing things the hard
way and see where your network traffic is going.

I remove cookies etc every day using bleachbit, cookies phone home as well.

Set the updates on your phone to WiFi only and the phone is probably
phoning home as well.

[Ottavio Caruso]

Post by Chris
[added ucol]

I have a mobile broadband contract with Spusu of only 5GB data per month.
I use my Android phone for tethering and I have disabled all apps from
accessing mobile data, so the data gets only used by my laptop, running
Debian Bookworm, when it connects to the Android hotspot.
I basically use the same sites every days (online translators). I use
Thunderbird for email and Usenet only from public wifi, so this doesn't
go into my data allowance. Same thing for the occasional Youtube videos.
Ma daily data has jumped from around 50MB a day to 250-300MB a day!
I have installed an extension on Firefox that blocks all images, frames,
movies, etc. I still get these dreaded 250 MB a day.
Is there a program that I can run on Linux that checks at what time I
have peaks of data?
I have to rule out (I hope) viruses, trojan horses, etc, as this is
Linux and not Windows, but you never know.
I don't have any automated updaters of any kind. Firefox has been
configured not to update itself, same thing for plugins.
I have disabled Firefox memory cache and enabled disk cache to save data.
So what is it?

I've cross-posted to uk.comp.os.linux as this is more of a linux question.
Nowadays lots of software has their own updaters. Linux is better than most
as updates go via the repo mostly. Have you checked the package manager
isn't downloading updates in the background?
Same on your phone? Are you able to disable automatic downloads of OS
updates. I believe the play store does this transparently

Yes, all automatic updates were disabled long ago both on Debian and on
Android.

[Paul]

Post by Chris
[added ucol]

I have a mobile broadband contract with Spusu of only 5GB data per month.
I use my Android phone for tethering and I have disabled all apps from
accessing mobile data, so the data gets only used by my laptop, running
Debian Bookworm, when it connects to the Android hotspot.
I basically use the same sites every days (online translators). I use
Thunderbird for email and Usenet only from public wifi, so this doesn't
go into my data allowance. Same thing for the occasional Youtube videos.
Ma daily data has jumped from around 50MB a day to 250-300MB a day!
I have installed an extension on Firefox that blocks all images, frames,
movies, etc. I still get these dreaded 250 MB a day.
Is there a program that I can run on Linux that checks at what time I
have peaks of data?
I have to rule out (I hope) viruses, trojan horses, etc, as this is
Linux and not Windows, but you never know.
I don't have any automated updaters of any kind. Firefox has been
configured not to update itself, same thing for plugins.
I have disabled Firefox memory cache and enabled disk cache to save data.
So what is it?

I've cross-posted to uk.comp.os.linux as this is more of a linux question.
Nowadays lots of software has their own updaters. Linux is better than most
as updates go via the repo mostly. Have you checked the package manager
isn't downloading updates in the background?
Same on your phone? Are you able to disable automatic downloads of OS
updates. I believe the play store does this transparently

Yes, all automatic updates were disabled long ago both on Debian and on Android.

Since it is only 250MB of data per day, capture an entire day of
traffic with Wireshark. Don't forget to turn on the network translation
before doing the trace, so the network addresses are symbolic.

Name Resolution
Resolve MAC addresses
Translate MAC addresses into names.
Resolve network names
Translate network addresses into names. <=== at least this one
Resolve transport names
Translate transport names (port numbers).

I've seen claims it's possible to capture traffic with program
names, I've not been able to find the details.

In terms of things that update, Firefox and Chrome might use the
Update Manager for their updates. But things like Snap and Flatpak
log into home base every day, to check version numbers. The flatpak
download seemed particularly long.

Paul

[Ottavio Caruso]

Post by Paul

Post by Chris
[added ucol]

I have a mobile broadband contract with Spusu of only 5GB data per month.
I use my Android phone for tethering and I have disabled all apps from
accessing mobile data, so the data gets only used by my laptop, running
Debian Bookworm, when it connects to the Android hotspot.
I basically use the same sites every days (online translators). I use
Thunderbird for email and Usenet only from public wifi, so this doesn't
go into my data allowance. Same thing for the occasional Youtube videos.
Ma daily data has jumped from around 50MB a day to 250-300MB a day!
I have installed an extension on Firefox that blocks all images, frames,
movies, etc. I still get these dreaded 250 MB a day.
Is there a program that I can run on Linux that checks at what time I
have peaks of data?
I have to rule out (I hope) viruses, trojan horses, etc, as this is
Linux and not Windows, but you never know.
I don't have any automated updaters of any kind. Firefox has been
configured not to update itself, same thing for plugins.
I have disabled Firefox memory cache and enabled disk cache to save data.
So what is it?

I've cross-posted to uk.comp.os.linux as this is more of a linux question.
Nowadays lots of software has their own updaters. Linux is better than most
as updates go via the repo mostly. Have you checked the package manager
isn't downloading updates in the background?
Same on your phone? Are you able to disable automatic downloads of OS
updates. I believe the play store does this transparently

Yes, all automatic updates were disabled long ago both on Debian and on Android.

Since it is only 250MB of data per day, capture an entire day of
traffic with Wireshark. Don't forget to turn on the network translation
before doing the trace, so the network addresses are symbolic.
Name Resolution
Resolve MAC addresses
Translate MAC addresses into names.
Resolve network names
Translate network addresses into names. <=== at least this one
Resolve transport names
Translate transport names (port numbers).
I've seen claims it's possible to capture traffic with program
names, I've not been able to find the details.
In terms of things that update, Firefox and Chrome might use the
Update Manager for their updates. But things like Snap and Flatpak
log into home base every day, to check version numbers. The flatpak
download seemed particularly long.
Paul

You overestimate me. Last time I used Wireshark was circa 2007 and I was
paid good money to do that and I wasn't very good at it.