Hi,

Thanks for the help. It's definitely no-one on WiFi, I'm too remote for access and I can detect people driving up to the house. Yes, Clearos is my DHCP server,and they are mapped by MAC so I can identify all devices by IP address alone. But none of those devices are turned on at the time of high data use I spotted. So I don't know if I have an occasional break in or some legit server use.

I don't want to restrict by time as this would kill email hosting.

I'm not seeing how vnstat tells me IP addresses. I was hoping for an app to help with this. I am not familiar enough with packet sniffing and so forth for that to work well for me.

Thanks,
Drew