Huge unexplained data transfer - investigating I have a Samsung Galaxy S3, and I do normal usage with it (web, reddit, mail, texts no netflix some youtube clips and not much streaming overall). Have been using it for about 2.5 year, without ever being near of busting data limits or reaching what could be considered heavy user (ex: from my records, 300 mb 4G  and 1.5 Gb wifi a month would be typical). wifi and 4G providers are distinct. 

Never had a problem with the device. Device is rooted and unlocked. No bogus app on it (I try to be serious about this - and manage applications permissions with this registered XPrivacy module ) Device memory is 16 Gb (internal) and SD card 32 Gb - overall 2/3 full

then this week I check my provider account for wifi as I do each month before being billed to see if I need any adjustment. And I see this:



We see by looking at this figure that between the third and the sixth of March 2015 - there was a lot of data transfer - that I cannot explain. 25 Gb the 3rd, 49 Gb the 4th, 38 Gb the 5th and 8 Gb the sixth and then a return to something normal after.

Quickly I start investigating my various devices and found this on my mobile: (sorry for the weird colors it is not on purpose - but data is still exact)



The right section show 113 Gb of traffic between the 3rd and the 7th which concurs with the previous figure showing the usage (provider report). And to the left we see a peak in traffic for the same period, this one on 4G. I have no space on my phone to accomodate this transfers - and I still have about 15 Gb /48 Gb free space on it.

So since I am using a VPN service Private Internet Access showing in the left and right part of the figure as the top traffic application, I cannot tell which specific application triggered the traffic, as all traffic is redirected to the vpn interface. So for example, if I start a movie on Netflix, the Netflix application usage won't grow, but Private Internet Access will.

I tried to investigate - a bit more to not avail, using various shell utils (logcat, netstat, ps/top for processes) but I realized the problem way to late and connections were dropped and/or no relevant info was obvious to me.

I was wondering : 

if anyone would have a hint as to how I should continue this investigation.

thanks
I have a few suggestions. I had my phone go over my monthly average by only about 5GB and just about threw my phone in a lake. 

The VPN app claiming all the data transferred as its own is a problem, but I think you can get around that with third party data management apps like 3G Watchdog and My Data Manager. Based on my research on several sites this seems to just... kind of... happen to people randomly across many different configurations. For me the Android OS service was reporting huge spikes, but My Data Manager broke that out into a different service that was running. 


In Apps, clear data and cache for Google Play Services, Google Play Store, Google Services Framework, and Google Backup Transport. 
Go to Settings -> Storage, Cached data, reset. Restart your phone.
Until you've figured it out, try to not be on data but wifi instead. That will minimize overages.
If you're feeling proactive, download one of those data management apps, or both. Then wait.


If it never happens again, I bet you'd be happy.