[Durham] What is eating up my bandwidth?

[Dougie Nisbet]

I'm running out of ideas. Short of going round and switching things off 
one by one, which might not be such a bad idea.

I'm with Zen and get 100GB/month broadband allowance. For the past few 
months I've noticed that it's creeping up, and recently I've ran out. In 
fact I ran out at 20 minutes to midnight on the 30th June and decided I 
could last 20 minutes without internet. Right now I'm up to 27GB used, 
and it's only the 7th of the month! Where's it all going? I've commented 
out the obvious culprits (get-iplayer for example), and I'm not too 
worried about uploads as they're not included in the allowance.

The next step was to look at ways of seeing where it's being used. I've 
looked at lots of utilities for showing where bandwidth is being used. 
Currently I've got iftop running:

     iftop  -F 192.168.1.0/255.255.255.0

which seems to be doing what I want - showing stuff going into and out 
of the homelan, but not internal traffic.

Of course, I soon hit upon the problem of not seeing all traffic. After 
googling for tools and advice I realised that switches are too good at 
being switches, so I bought one of these (a Netgear GS510E 5-port switch):

http://www.amazon.co.uk/gp/product/B002U08F2S/ref=oh_details_o09_s00_i00?ie=UTF8&psc=1

that allows port mirroring on port 5. I've got my Linux desktop in port 
5 and all other ports mirrored to it.

I really thought that would do the trick and I'd see some smoking gun - 
but alas no. The bandwidth still gets eaten up and even though I've been 
running iftop for days it's not really showing anything of concern. I 
wonder sometimes if things are blipping, briefly using lots of bandwidth 
then terminating - I've a feeling iftop wouldn't show that unless I was 
staring at it at the time.

I suppose there's wifi. My router is wireless and we have two iphones 
and two ipads, although we connect to the other (5) WAPs too. Perhaps I 
could disable the wifi on the router, forcing it to go through the WAPs, 
which would then, in theory, show up as it'd have to go via the Netgear 
switch.

Dunno. Anyone any ideas on how to problem solve this? I know I can just 
turn things off but this would be a) inconvenient and b) an admission of 
defeat. I'd rather track the culprit down.

Dougie