[nonane]

> - I saw that `10.0.0.3` showed up as a client on my switch with a randomized MAC address (presumably, since I couldn't find the MAC prefix in a vendor list).

MAC address randomization is enabled by default on iOS: https://www.linksys.com/support-article?articleNum=317709

[wasipwned]

Thanks for reminding me of this. This is looking less and less malicious at this point as `10.0.0.3` is my phone (using AT&T, which is where all the traffic was destined).

[ghostbrainalpha]

That still seems like an awful lot of traffic for your phone to be using.

Do you mind sharing what gets you that kind of data usage? Just hours of FaceTime calling or something else?

[wasipwned]

I can't explain this part yet. I was asleep when this happened, so I wasn't even using my phone. I may be wrong about 300Mbps being to the AT&T. public IP, as my router shows a much lower rate. That might have just been the total traffic I was seeing internally on my private network from multicast.

[smoyer]

Maybe they've got your phone generating traffic to bill you for going over your limit?