I have an RTU950 on my boat. The boat is in the middle of the river all navigation equipment is switched off. The only thing that is running is the Victron VRM and the RTU950. I can sxee that my boat is using 1.65gb of data a day and no one is onboard!
How can I trace the culprit?
How many people know the ruts WiFi passwords, change them. I’d also change the ruts login password too.
How often is the Victron VRM configured to send out data, if it’s every minute or more frequently, and you’re accessing the system on a regular basis that may account for it, possibly.
Try disconnecting / switching off the Victron VRM for 24hrs, what happens. I would do this because it’s important to eliminate it altogether to get started. I think so anyway.
This is a nightmare. I have done a factory reset on the RTU950 and nothing is plugged into it, it is literally on it’s own. I have installed an O2 sim and the RTU950 is using 1mb of data a minute. RMS is not activated.
Someone or something is using your data. Router doesnt do this on its own.
Well here is the test I did. I disconnected everything wan and lan from the RTU950. The RTU950 is configured for hotspot sharing so It does not have it’s own hotspot, it can connect to a hotspot if I manually do so.
I then connected my laptop to the RTU950 using the lan port. I then navigated to Network/Wan from there I can see Interfaces/Mobile/Status and I can see the fable of RX. If I pull the network connection out of the RTU950 for say 10 minutes amd then put it back in and navigate back to that page I can see RX has increased by 14mb. If I do the same thing and wait 20 minutes I can see it has gone up 28mb and if I leave it for 24 hours I can see it has consumed 14gb.
How can something be using the data when there isn’t a something connected to the router? It is just a router with a SIM card and an antenna. RMS is not switched on?
If I can’t resolve this I will have to dump it and buy something like the GL.iNET Spitz AX (GL-X3000) Wi-Fi 6 AX3000
This was a very drastic thing to do!
How did you perform your factory reset? The only true way to do it is via the bootloader method: https://wiki.teltonika-networks.com/view/RUT950_Device_Recovery_Options
You’ll have to scroll down a little to find out how to do it. Then i would make sure any passwords are very different from anything you’ve used before and don’t share them with anybody.
Don’t give in yet.
I did it by holding the reset button on the back of the router for a long time. It returns it to factory fresh.
I am very disappointed with Teletronika I have posted here and submitted a support tickets and have not had a response from them at all.
If you look in the status → real time data → connections , scroll down and you can see the currently active connections and their type. Keep an eye on this when there is nothing plugged into your device (nothing other than your self). Take a look at the source/destination. There may be periodic connections but with a factory reset device and just your connection, the list should be very low.
Following on from there I would recommend taking a look at the traffic page, you can split this by network type, WAN/LAN/Mob. See if you can figure out what interface the traffic is originating.
Next take a look at the ‘Network Usage tab’ and click on connections. This should give you some idea of where the data is being sent as it contains the protocol and data counters (mb/kb/gb etc). This might help figure out where the data is being spent.
From this information you should be able to track down the source or destination of the data and we can work from there.
You mentioned O2 SIM so I assume this is not a specific IoT type SIM with a Public IP?
The router can communicatie on its own with mqtt servers for example (‘Data to Server’ functionality or ‘Modbus to Mqtt gateway’). I would reckon these features are not enabled after a factory reset, but check to be sure. I have collected traffic on my RUT240 in the past to be able to feed it into Wireshark to examine traffic, and then i found that merely the Mqtt keepalive poll was eating data, but not to the extent you witness.
Help from Claude:
Most RutOS devices have a built-in packet capture tool:
Enable Advanced WebUI mode (toggle at the top of the interface — many diagnostic pages are hidden until you do this).
Go to System → Maintenance → Troubleshoot.
There’s a TCP dump section there — select the WAN interface, optionally set a filter/duration, and it generates a .pcap file you can download and open directly in Wireshark.
Note: on newer firmware (from _R_00.07.00 onward), TCPdump is no longer part of the core functionality — you first need to download the TCPdump package via System → Package Manager, enable it, save, and then the capture options and download button appear. So if you don’t see the tcpdump fields on the Troubleshoot page, install the package first. Teltonika Networks
For filtering, longer captures, or specific interfaces:
Connect via SSH, or through the web UI at Services → CLI (log in with root and your admin password) — this gives you a CLI/SSH console on the router itself. Teltonika Networks
Run tcpdump directly. It’s the command-line packet sniffer used to capture or filter TCP/IP packets received or transferred over a network on a specific interface. Example syntax: tcpdump host 192.168.1.111 and icmp -i any -n captures only ICMP packets from that host on any interface. Teltonika NetworksTeltonika Networks
For your case (capturing WAN traffic), something like:
tcpdump -i wan -w /tmp/wan_capture.pcap
or, if your WAN interface has a different name (check with ifconfig or ip a — often something like eth1, wwan0, or a mobile interface name like mob1s1a1 on cellular models):
tcpdump -i <wan_interface_name> -w /tmp/capture.pcap
Then transfer the file off the router with scp:
scp root@<router-ip>:/tmp/capture.pcap ./
Practical tips:
Storage on the router itself is limited — for longer captures, write to an attached USB drive if your model supports it (-w /mnt/usb/capture.pcap), or pipe live over SSH straight into Wireshark on your PC: ssh root@<router-ip> tcpdump -i wan -w - | wireshark -k -i -
Use -s 0 (or omit -s, default is usually full-length now) to avoid truncating packets, and add filters (host/port/protocol) to keep files manageable if you’re capturing over a long period.
One known quirk: on some models tcpdump only reliably captures traffic on br-lan (the LAN<->WAN bridge), not traffic strictly between two separate LAN ports — worth keeping in mind if your setup has multiple LAN segments and you’re not seeing the packets you expect. Teltonika Networks