Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I have an iPhone which has suddenly (last two months) started going way over the 200mb data plan it was on. Prior to this it wasn't even close to the limits.

The only information the phone company (AT&T) gives me is the amounts, and the times (which from what I understand is just a billing time for a grouped amount of data). Here is a sample:

08/23  12:07 AM  Sent  198679KB
08/22  12:07 AM  Sent  6070KB
08/21  12:06 AM  Sent  13757KB
08/20  12:06 AM  Sent  5993KB
08/19  12:54 AM  Sent  64947KB
08/17  10:05 PM  Sent  165247KB
08/17  12:02 AM  Sent  12707KB
08/16  12:02 AM  Sent  90KB
08/15  12:42 AM  Sent  23581KB
08/14  12:10 AM  Sent  35819KB

And on top of the huge amounts on 3G, this phone spent very little time outside Wifi.

Is there any possible way (without jailbreaking!) to find out what app could possibly transferring this much data? At present, AT&T will not or can not give me a breakdown of the traffic destinations. Even if it were possible, I would like an answer that lies within the phone as a check against what the carrier is measuring if that is possible.

share|improve this question
    
Many of the commenters in this comment thread seem to be experiencing the exact same problem. –  NickC Aug 24 '11 at 16:08
1  
You can't proxy 3G traffic like you can TCP/IP traffic. At least not proxy it and study it. It's encrypted. If you could build a 3G bridge that your phone would readily talk to and be able to see the datagrams via this bridge it'd make snooping 3G-based networks scary easy. Your best bet is to watch the traffic when it's on a WiFi network. –  Ian C. Feb 21 '12 at 22:55
    
I've made a fairly important edit to my answer: when your phone is in sleep mode it uses 3G, not WiFi. The 3G radio is power efficient so Apple decided to use that when the device is sleeping. You need to turn off cellular data on the phone with my technique. In fact, you can turn off cellular data use to save yourself while you figure this out. –  Ian C. Feb 23 '12 at 15:59
    
I certainly hope it isn't something uploading camera roll data to servers. bits.blogs.nytimes.com/2012/02/28/… –  bmike Feb 28 '12 at 22:57
add comment

7 Answers

up vote 9 down vote accepted
+50

After several careful readings of your question, something stood out:

And on top of the huge amounts on 3G, this phone spent very little time outside Wifi.

Your iPhone, when it's in sleep mode, turns off the WiFi radio to conserve battery power. So if you have data hungry apps that are doing things in the background when your phone is sleeping/locked, they're doing it over 3G. Note that the WiFi-off-in-sleep-mode behaviour is somewhat inconsistent. But you can ensure 3G is never used by your phone while you're performing these tests by shutting off cellular data. That way, when it sleeps, it will continue to use WiFi and not 3G for data and you'll be certain to capture all the traffic in your monitoring net.


You can cobble together some technologies that might help you track down the culprit.

As a quick first pass you could try monitoring the phone when it's on a WiFi network using mitmproxy. From this excellent mclov.in blog post, you can setup a proxy for your phone on your Mac and filter all http/s traffic through it:

  1. Download the mitmproxy tool and set it up by going to the folder of mitmproxy and running sudo python setup.py install. If all goes well, mitmproxy must be available in your $PATH.
  2. Start mitmproxy by running mitmproxy.
  3. Obtain the IP address of your computer by running ifconfig en1 (or whatever is the interface that you are using).
  4. Set the proxy on your iPhone by going to your wireless settings, setting the proxy to be “Manual”, and set the IP to be your computer’s IP and the port as 8080.

If you set mitmproxy to record http/s calls to a file you can analyze it after some period of time and look for trends. You'll also be able to inspect the payloads on the http/s calls so you might able to spot unusually large requests this way.

Of course: this approach assumes the culprit is using http/s for communication. If it's not, you won't see the problem via mitmproxy and you have to resort to a lower-level solution.

You need to monitor all the traffic on a WiFi network you control to help you hunt down at least the end points for the data transfers. Bandwidth monitoring isn't hard to set up, but keeping a per-IP, per-endpoint log is really tough to do with consumer-grade hardware because it can be A MASSIVE amount of data. Every packet has to be checked for origin, destination, logged for time and size -- it adds up really quick.

But you can get some decent numbers and narrow down the search space so it's something potentially human-parseable.

First: you need to setup a network with bandwidth monitoring on a per-IP level. For that I recommend a Linksys WRT54GL consumer-grade WiFi router running Tomato and the TeamanIPTraffic add-on for IP-level bandwidth tracking.

Second: set your DNS on the router to use OpenDNS. In your OpenDNS account to track DNS lookups:

  • Log in to https://dashboard.opendns.com/
  • Click the 'Settings' tab
  • Click the IP address for the network associated with your router
  • Click 'Stats and Logs' on the left side
  • Make sure 'Enable stats and logs' is checked and click the 'Apply' button

Now any DNS lookups performed on your network will be logged.

Assign your phone a static IP on this network so it's easier to track.

And...wait and watch.

You're going to monitor the activity for the IP address assigned to your phone in your router's per-IP activity tables. When the data activity for this IP address spikes you'll head over to your OpenDNS console and take a look at the stats and logs for your DNS lookups for the period of time when data movement was high for your phone.

That should give a short list [sic] of hostnames that were being resolved at the time. And armed with that list you might able to narrow it down to an application.

share|improve this answer
2  
This is exactly what I was hoping - details on how to proxy the data. I'll dig into this and see if I have more questions. Great links and work on this. –  bmike Feb 22 '12 at 23:39
    
I have an improvement on this approach if you also have a Mac. I'll write it up in a bit when I have time to debug the idea. –  Ian C. Feb 28 '12 at 13:37
add comment

In your shoes with my meager knowledge, I'd just pick a good candidate or two and remove them from the iPhone with iTunes. It should result in a huge loss of free space, and iTunes could show that.

Another less involved method would be to just turn them off by double-clicking the Home button and holding one until the x appears.

It's probably just one app, but sorting it out will take time and $ until you find it.

There are probably better ways that others will suggest, but this is something to start with.

share|improve this answer
    
Interesting idea, I will plug it in and try that out. I had just assumed that the data was probably not being written to disk anyway. –  NickC Aug 24 '11 at 17:08
    
Great suggestion for another indirect way of measuring the changes. And, if the storage isn't changing, then the data use could be more reliably chalked up to a bug or streaming of something as opposed to downloading something for permanent use on the device. –  bmike Feb 28 '12 at 15:31
add comment

There are several apps that may help you track down app data usage:

  • A combination of NetStat and Data Usage: The former will let you know all the connections at a point in time. The latter claims to work with any wireless provider and can provide wireless and WiFi data usage reports. The app also claims to "track data hog application by checking since last run counter". These will assist in a process of elimination search to potentially rule out or in some apps as users of the data.

  • Onavo (reviewed here): Provides compression of data for the iPhone and generates reports of the amount of data usage by app/category. Limitations - currently only works with AT&T for US users, can't compress streaming video. There may also be security risks, as your data is routed through Onavo's servers.

I also found this list of notable iOS data tracking apps that may suit your needs.

Caveat: I haven't personally used these apps, but the reviews seem promising.

share|improve this answer
    
I'll look into Onavo, but it seems I don't really want compression as much as a meter that I can monitor. Perhaps there isn't service for metering only... –  bmike Feb 22 '12 at 23:44
add comment

I believe there are some iPhone apps which enable you to log and monitor your data usage. I haven't used any personally, but I did some Googling, and found that the guys who made NetUse for Mac are planning to make a similar application for iPhone. I also found this thread, which essentially asks the same question; maybe there are some answers in there.

Perhaps you could use that when it comes out, or search around on the iPhone App Store to see if something similar already exists :)

share|improve this answer
add comment

I would recommend taking several hours to systematically go through your apps, one by one. First, quit all your apps. Take a note of the time you open the app and the time you close it (removing it from the multitasking bar, of course). Repeat with the next app. When you see AT&T's report, you should be able to tell from the times given which app uses the network that much.

share|improve this answer
    
Is this different than the answer in August that proposed a process of elimination and trying to get at the usage indirectly by measuring what it isn't? apple.stackexchange.com/a/23017/5472 –  bmike Feb 22 '12 at 23:40
    
@bmike It's very similar to the second half of that answer, but that one is somewhat vague on exactly how it could be determined using that method. It kind of sounds like they think simply removing the not-currently-in-use apps from the multitasking bar will eliminate the problem. That's most likely true, but it doesn't help find which app is the culprit. –  timothymh Feb 22 '12 at 23:52
add comment

I'm surprised it hasn't been mentioned... But make SURE to check your EMAIL settings. There are options for...

  1. Push on? (more bandwidth)
  2. Message preview setting? (more bandwidth, I'd assume)
  3. Load images ?(more bandwidth)
  4. Fetch time? (lower = more bandwidth)
  5. Multiple accounts?

And depending on your calendar / contacts setup, photos, frequency of changes... Those could also be affecting it. Also, do you have iCloud, or Find my iPhone turned on, of late... That could surely have effected your usage numbers..

While it's prolly negligible... You can also turn on and off notifications for non-essential apps.. To eliminate one additional (unlikely) source of the problem.

I went over on my iPad one month - and changing my aggressive email checking settings fixed it all for me... But, in the time shortly after it happened.. I also would slip it into airplane mode /wifi on whenever possible.. I'd assume you're using the cellular network for phone calls (which I wasn't), so that precautionary measure may be innapropriate... But if you need to do what you need to do to make sure you don't go over.. Thats an option.

share|improve this answer
    
I'm more worried about measuring what's happening than hitting an arbitrary limit. I want to know it's mail, not necessarily have to do the process of elimination mentioned last august. I do appreciate the suggestion it may be mail, however my phone isn't set up for push and no mail gets delivered until I tap the icon in the morning. (That wasn't in the original question so there's no way to know that :-) –  bmike Feb 22 '12 at 23:41
    
I didn't mention it in the original question, but I'm fairly sure the large amounts of data sent were occuring in the background. Like I did mention, it was a huge increase to prior bills (same phone, same settings), which couldn't be accounted for by standard application usage. –  NickC Feb 22 '12 at 23:52
add comment

Well you could turn it off by closing all your apps that require data then going to Settings -> General -> Network and flip the cellular data switch to off.

share|improve this answer
1  
I think the idea here is to keep using the data, but to determine which apps (whether foreground or background, system or third party) are using which portion of the total data. Once we can measure it, it's easy to choose to use more or less as each situation provides. –  bmike Feb 23 '12 at 15:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.