[wasipwned]

False alarm. Really appreciate everyone helping me sanity check this. The randomized MAC is part of iOS' Wi-Fi privacy, and my phone is using Wi-Fi calling for AT&T. The randomized MAC and the fact that I thought I saw the traffic originating from my desktop (it wasn't, it was just multicast traffic) really threw me off.

[csw-001]

I had a similar situation - but I figured it out pretty quickly because my Firewalla actually warned that device was an iphone in anon mode, and prompted to turn Mac spoofing off if I wanted device-level tracking. I highly recommend Firewalla for home networking issues of this sort, it’s the only thing that gives a relative networking novice like me a fighting chance.

[CamperBob2]

At 300 Mb/sec?

[wasipwned]

I can't fully explain this part yet, but I am currently expecting that I will see the issue again even with my desktop disconnected.

I am also probably wrong about it being 300Mbps to AT&T. It was probably 300Mbps of multicast traffic internally.

[tomxor]

I find Apple devices are the worst for disrespecting network use when they "sleep", my partner has a couple and as soon they think no one's looking they saturate the network downloading updates and "syncing" shit. It doesn't help that they started using massive undelta'd partition images to distribute minor updates to their OSs.

They also keep changing stuff on each update to make it harder to force the things to disconnect in sleep mode without a lot of fiddling.. so I've resorted to just adding them to a MAC based access control on the router which we toggle on when we want to use the internet for anything that needs more reliability or bandwidth. I also first tried an aluminium foil based Faraday cage/box to chuck them in with some degree of success but the foil can get breaky.

[MarkSweep]

You maybe be able to reduce this by turning off “background app refresh”.

[tomxor]

Maybe, but trying it on the device it's a constant battle, next update it will be something else.. Blocking it's access externally is reliable.

[bedast]

My iPad once decided it had 100gb of data to back up and kept trying to back it up to icloud. It was killing my internet.

If you have icloud backups enabled, check the size of the backup.

This seems to be an issue that comes up from time to time on iOS and the only way to clear it is to temporarily disable backups, remove all backups, then re-enable the backup. If that doesn't clear out the oversized backup, you may need to factory reset. I ended up factory resetting my iPad to resolve my issue.

[kevin_nisbet]

One possibility, although unlikely, is do you have a loop in your network. I think you mentioned multiple switches... does anything have multiple paths on the switching layer to form a loop?

[wasipwned]

Not to my knowledge, but I will double checking to make sure. The odd part is the issue only started recently, but I haven't made any major changes to my network recently.

[kevin_nisbet]

Well, the fun thing about network loops, is they can run for years without a problem on a switched network. It's only when you run into a learning issue that switches fall back to flooding all ports except the source port, which then allows packets to flow through the loop indefinitely.

This is why so many people footgun themselves disabling spanning tree, is it seems to work without it... until it doesn't.

[AnotherGoodName]

Do you have a Chromecast? I had one spamming ARP requests recently. Network reboots didn't fix it but rebooting the chromecast did

Took a loong time and Wireshark for me to find that one.

[CamperBob2]

Something I wish someone would build is a smarter Wireshark. "Something is hinky on my network. Figure out what it is and who's causing it."

Wireshark is awesome, but the problem is, I only need to use it about once every five years, which means I have to start the learning curve from scratch every single time. I end up following the same basic troubleshooting steps each time, but the process never gets any easier because I never remember what I did the last time.

[justsomehnguy]

Some devices can convert muticast to unicast traffic.

Some devices can respond with errors to the traffic received, but not destined to them.