What is my HAOS instance downloading when I'm not asking it to?

Configuration
1

I have an LTE Hotspot providing my HomeAssistant instance with internet. Monitoring the data usage I see sporadic downloads of about 170MB, last time yesterday at around 8pm GMT+1

There are no other devices, except for a dehumidifier in this WLAN, and the downloads happen even if I disconnect it from the WLAN. I had my router run without any clients for several days and there were no downloads happening, so all points to the HA instance.

I don’t have many integrations installed and none of them seem like a likely candidate:

{1ED174A7-F231-4ADC-86D7-CE28DFB4BFC8}
{1ED174A7-F231-4ADC-86D7-CE28DFB4BFC8}1118×1042 71.9 KB

Is HA pre-downloading updates without user interaction?
Is HACS pre-downloading anything without user interaction?

I woulndn’t mind, but I have a very limited plan (3GB) and those downloads push me over the limit quite often.

2

I see three cloud based integrations
that could be doing it. image

HACS, OpenWeatherMap and Waste Collection Schedule.

3

True, OWM has a steady data usage, same for waste collection, but those are minimal. I think I even disabled them for testing once, but I’m currently unsure. Will attempt to do so again, as they are not critical to me yet.

This is how the usage looks like btw:

{2BDC820B-0CEF-4750-8B0B-8CE31B25A612}
{2BDC820B-0CEF-4750-8B0B-8CE31B25A612}562×382 15 KB

4

HACS does regular updates which requires downloading an index of many integrations.

5

There also are 4 devices using the mobile app. There could be a lot of traffic, depends on the settings

6

Running any addons?
They all have an Autoupdate feature.

7

Does this always happen at the same time (in this case 20:00)?

8

Thank you for the pointers. It seems that lately the spikes have actually gone down in frequency, to about once a month. Last time it was at 8pm of November 4th, the time before that at 7pm October 4th.

Definitely not regular app usage, especially since it’s mostly me checking on the instance. My wife just receives the notifications, can’t imagine those producing the spikes.

I’ve checked the add-ons and saw that Tailscale still had auto-updates enabled, but if I see it correctly, last release was on September 14th, so not fitting the pattern, but good catch. Disabled also now.

Leaves HACS, even though I can’t imagine the index is more than a few megabytes in size, as it should be all text. I’ll keep HACS disabled and see if there are any spikes just to be safe.

9

Thanks for keeping us update. Please come back and tell us when you find the culprit!

10

Then there is the supervisor, which will auto update and can be real tricky to disable.
You will have to search he forum for th methods to do it.

11

Well, it’s not HACS. I have now everything off that has to do with cloud or internet, so I’m guessing it’s the supervisor.

12

Rather than guessing why not fire up Wireshark and log the traffic?

13

You are right, of course. I was hoping for it to be something obvious, as I don’t have much time to invest into analyzing it in more depth - I’d rather concentrate on finishing rebuilding my house itself.

Whatever it is, it now has downloaded something two times in 24h and my bandwidth for the month is basically depleted.

14

If you want to investigate further you have to spend some time on it. As most of the traffic is encrypted, you should either install a DNS servers and log the queries to understant the destination endpoint, or install and configure a proxy to inpect the traffic (that might be even more complex).
Some router do have inspection capabilities that you can enable (I think I saw something on Asus routers, Netgears and for sure Ubiquity).
As tom_l suggested you can always sniff using Wireshark, but you would need to mirror the switch port to read all the packets.