I have a wireless broadband from my provider. Back their router I have the ASUS 68U Asuswrt-Merlin ver. 384.13 with vpnserver (openvpn). As the monthly datause is limited (50 GB) I try to follow up my use once a week. Today I discovered 8 GB use through only two hours. This is not normal and should not be possible as I only use the broadband and vpn to watch my webcamera now and then. In fact I couldn't use more than 1 GB an hour with my setting if I watch online.
This high unknown data use has happend two or three times the last two years and now I am very keen for investigate it hoping to find the reason.
The Traffic Analyzer on the ASUS show only 2-300 MB the same period, but I am aware of that my wireless broadband can double that due to vpn etc. The wireless broadband router is set to bridge.
Her is the log from the asus and I hope someone can point out possible reason for the high data use. I have hidden the real ip and user and shortened the log where nothing happen.
Feb 23 11:40:12 acsd: selected channel spec: 0x180b (9l)
Feb 23 11:41:15 ovpn-server1[6397]: vpn user/ip.no TLS: tls_process: killed expiring key
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no TLS: soft reset sec=0 bytes=794363633/-1 pkts=906812/0
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_VER=2.4.6
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_PLAT=win
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_PROTO=2
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZ4=1
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZ4v2=1
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZO=1
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_COMP_STUB=1
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_COMP_STUBv2=1
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_TCPNL=1
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_GUI_VER=OpenVPN_GUI_11
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no PLUGIN_CALL: POST /usr/lib/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no TLS: Username/Password authentication succeeded for username 'xxxxx' [CN SET]
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no Outgoing Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no Incoming Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305
Feb 23 11:55:13 acsd: scan in progress ...
Feb 23 12:10:21 acsd: selected channel spec: 0x180b (9l)
Feb 23 12:21:31 ovpn-server1[6397]: 146.88.xxx.4:51355 TLS: Initial packet from [AF_INET6]::ffff:146.88.240.4:51355, sid=12121212 12121212
Feb 23 12:22:31 ovpn-server1[6397]: 146.88.xxx.4:51355 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Feb 23 12:22:31 ovpn-server1[6397]: 146.88.xxx.4:51355 TLS Error: TLS handshake failed
Feb 23 12:22:31 ovpn-server1[6397]: 146.88.xxx.4:51355 SIGUSR1[soft,tls-error] received, client-instance restarting
Feb 23 12:25:22 acsd: scan in progress ...
Feb 23 12:40:29 acsd: selected channel spec: 0x180b (9l)
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no TLS: soft reset sec=0 bytes=605118140/-1 pkts=688538/0
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_VER=2.4.6
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_PLAT=win
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_PROTO=2
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZ4=1
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZ4v2=1
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZO=1
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_COMP_STUB=1
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_COMP_STUBv2=1
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_TCPNL=1
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_GUI_VER=OpenVPN_GUI_11
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no PLUGIN_CALL: POST /usr/lib/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no TLS: Username/Password authentication succeeded for username 'xxxxx' [CN SET]
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no Outgoing Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no Incoming Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Feb 23 12:41:18 ovpn-server1[6397]: vpn user/ip.no Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305
Feb 23 12:55:30 acsd: scan in progress ...
Feb 23 13:40:44 acsd: selected channel spec: 0x180b (9l)
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no TLS: tls_process: killed expiring key
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_VER=2.4.6
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_PLAT=win
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_PROTO=2
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZ4=1
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZ4v2=1
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZO=1
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_COMP_STUB=1
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_COMP_STUBv2=1
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_TCPNL=1
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_GUI_VER=OpenVPN_GUI_11
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no PLUGIN_CALL: POST /usr/lib/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no TLS: Username/Password authentication succeeded for username 'xxxxx' [CN SET]
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no Outgoing Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no Incoming Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305
Feb 23 13:55:45 acsd: scan in progress ...
Feb 23 14:10:53 acsd: selected channel spec: 0x180b (9l)
Feb 23 14:24:20 watchdog: Forced DDNS update (after 1 days)
Feb 23 14:24:20 rc_service: watchdog 252:notify_rc restart_ddns
Feb 23 14:24:20 start_ddns: update WWW.ASUS.COM update@asus.com, wan_unit 0
Feb 23 14:24:20 inadyn[32127]: In-a-dyn version 2.5 -- Dynamic DNS update client.
Feb 23 14:24:21 inadyn[32127]: Update forced for alias xxxxx.asuscomm.com, new IP# 91.xxx.xx.xx
Feb 23 14:24:23 inadyn[32127]: Certificate verification error:num=10:certificate has expired:depth=0:/CN=ns1.asuscomm.com
Feb 23 14:24:23 inadyn[32127]: OpenSSL error: 1024:error:1416F086:lib(20):func(367):reason(134):NA:0:
Feb 23 14:25:54 acsd: scan in progress ...
Feb 23 14:41:01 acsd: selected channel spec: 0x180b (9l)
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no TLS: soft reset sec=0 bytes=1064523456/-1 pkts=1250259/0
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_VER=2.4.6
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_PLAT=win
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_PROTO=2
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZ4=1
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZ4v2=1
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZO=1
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_COMP_STUB=1
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_COMP_STUBv2=1
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_TCPNL=1
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_GUI_VER=OpenVPN_GUI_11
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no PLUGIN_CALL: POST /usr/lib/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no TLS: Username/Password authentication succeeded for username 'xxxxx' [CN SET]
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no Outgoing Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no Incoming Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305
Feb 23 14:56:02 acsd: scan in progress ...
This high unknown data use has happend two or three times the last two years and now I am very keen for investigate it hoping to find the reason.
The Traffic Analyzer on the ASUS show only 2-300 MB the same period, but I am aware of that my wireless broadband can double that due to vpn etc. The wireless broadband router is set to bridge.
Her is the log from the asus and I hope someone can point out possible reason for the high data use. I have hidden the real ip and user and shortened the log where nothing happen.
Feb 23 11:40:12 acsd: selected channel spec: 0x180b (9l)
Feb 23 11:41:15 ovpn-server1[6397]: vpn user/ip.no TLS: tls_process: killed expiring key
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no TLS: soft reset sec=0 bytes=794363633/-1 pkts=906812/0
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_VER=2.4.6
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_PLAT=win
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_PROTO=2
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZ4=1
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZ4v2=1
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZO=1
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_COMP_STUB=1
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_COMP_STUBv2=1
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_TCPNL=1
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_GUI_VER=OpenVPN_GUI_11
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no PLUGIN_CALL: POST /usr/lib/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no TLS: Username/Password authentication succeeded for username 'xxxxx' [CN SET]
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no Outgoing Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no Incoming Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Feb 23 11:41:16 ovpn-server1[6397]: vpn user/ip.no Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305
Feb 23 11:55:13 acsd: scan in progress ...
Feb 23 12:10:21 acsd: selected channel spec: 0x180b (9l)
Feb 23 12:21:31 ovpn-server1[6397]: 146.88.xxx.4:51355 TLS: Initial packet from [AF_INET6]::ffff:146.88.240.4:51355, sid=12121212 12121212
Feb 23 12:22:31 ovpn-server1[6397]: 146.88.xxx.4:51355 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Feb 23 12:22:31 ovpn-server1[6397]: 146.88.xxx.4:51355 TLS Error: TLS handshake failed
Feb 23 12:22:31 ovpn-server1[6397]: 146.88.xxx.4:51355 SIGUSR1[soft,tls-error] received, client-instance restarting
Feb 23 12:25:22 acsd: scan in progress ...
Feb 23 12:40:29 acsd: selected channel spec: 0x180b (9l)
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no TLS: soft reset sec=0 bytes=605118140/-1 pkts=688538/0
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_VER=2.4.6
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_PLAT=win
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_PROTO=2
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZ4=1
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZ4v2=1
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZO=1
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_COMP_STUB=1
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_COMP_STUBv2=1
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_TCPNL=1
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_GUI_VER=OpenVPN_GUI_11
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no PLUGIN_CALL: POST /usr/lib/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no TLS: Username/Password authentication succeeded for username 'xxxxx' [CN SET]
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no Outgoing Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Feb 23 12:41:16 ovpn-server1[6397]: vpn user/ip.no Incoming Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Feb 23 12:41:18 ovpn-server1[6397]: vpn user/ip.no Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305
Feb 23 12:55:30 acsd: scan in progress ...
Feb 23 13:40:44 acsd: selected channel spec: 0x180b (9l)
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no TLS: tls_process: killed expiring key
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_VER=2.4.6
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_PLAT=win
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_PROTO=2
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZ4=1
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZ4v2=1
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZO=1
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_COMP_STUB=1
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_COMP_STUBv2=1
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_TCPNL=1
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_GUI_VER=OpenVPN_GUI_11
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no PLUGIN_CALL: POST /usr/lib/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no TLS: Username/Password authentication succeeded for username 'xxxxx' [CN SET]
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no Outgoing Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no Incoming Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Feb 23 13:41:16 ovpn-server1[6397]: vpn user/ip.no Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305
Feb 23 13:55:45 acsd: scan in progress ...
Feb 23 14:10:53 acsd: selected channel spec: 0x180b (9l)
Feb 23 14:24:20 watchdog: Forced DDNS update (after 1 days)
Feb 23 14:24:20 rc_service: watchdog 252:notify_rc restart_ddns
Feb 23 14:24:20 start_ddns: update WWW.ASUS.COM update@asus.com, wan_unit 0
Feb 23 14:24:20 inadyn[32127]: In-a-dyn version 2.5 -- Dynamic DNS update client.
Feb 23 14:24:21 inadyn[32127]: Update forced for alias xxxxx.asuscomm.com, new IP# 91.xxx.xx.xx
Feb 23 14:24:23 inadyn[32127]: Certificate verification error:num=10:certificate has expired:depth=0:/CN=ns1.asuscomm.com
Feb 23 14:24:23 inadyn[32127]: OpenSSL error: 1024:error:1416F086:lib(20):func(367):reason(134):NA:0:
Feb 23 14:25:54 acsd: scan in progress ...
Feb 23 14:41:01 acsd: selected channel spec: 0x180b (9l)
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no TLS: soft reset sec=0 bytes=1064523456/-1 pkts=1250259/0
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_VER=2.4.6
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_PLAT=win
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_PROTO=2
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZ4=1
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZ4v2=1
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_LZO=1
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_COMP_STUB=1
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_COMP_STUBv2=1
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_TCPNL=1
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no peer info: IV_GUI_VER=OpenVPN_GUI_11
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no PLUGIN_CALL: POST /usr/lib/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no TLS: Username/Password authentication succeeded for username 'xxxxx' [CN SET]
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no Outgoing Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no Incoming Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Feb 23 14:41:16 ovpn-server1[6397]: vpn user/ip.no Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305
Feb 23 14:56:02 acsd: scan in progress ...
