I have a Samsung Galaxy S3, and I do normal usage with it (web, reddit, mail, texts no netflix some youtube clips and not much streaming overall). Have been using it for about 2.5 year, without ever being near of busting data limits or reaching what could be considered heavy user (ex: from my records, 300 mb 4G and 1.5 Gb wifi a month would be typical). wifi and 4G providers are distinct.
Never had a problem with the device. Device is rooted and unlocked. No bogus app on it (I try to be serious about this - and manage applications permissions with this registered XPrivacy module ) Device memory is 16 Gb (internal) and SD card 32 Gb - overall 2/3 full
then this week I check my provider account for wifi as I do each month before being billed to see if I need any adjustment. And I see this:
We see by looking at this figure that between the third and the sixth of March 2015 - there was a lot of data transfer - that I cannot explain. 25 Gb the 3rd, 49 Gb the 4th, 38 Gb the 5th and 8 Gb the sixth and then a return to something normal after.
Quickly I start investigating my various devices and found this on my mobile: (sorry for the weird colors it is not on purpose - but data is still exact)
The right section show 113 Gb of traffic between the 3rd and the 7th which concurs with the previous figure showing the usage (provider report). And to the left we see a peak in traffic for the same period, this one on 4G. I have no space on my phone to accomodate this transfers - and I still have about 15 Gb /48 Gb free space on it.
So since I am using a VPN service Private Internet Access showing in the left and right part of the figure as the top traffic application, I cannot tell which specific application triggered the traffic, as all traffic is redirected to the vpn interface. So for example, if I start a movie on Netflix, the Netflix application usage won't grow, but Private Internet Access will.
I tried to investigate - a bit more to not avail, using various shell utils (logcat, netstat, ps/top for processes) but I realized the problem way to late and connections were dropped and/or no relevant info was obvious to me.
I was wondering :
if anyone would have a hint as to how I should continue this investigation.