Generic Android boxes are widespread in Brazil and Argentina, and many ship with apps that generate constant traffic. That traffic does not stay inside the subscriber's home: it worsens the Wi-Fi, loads the access equipment and the uplink, and ends up on the ISP's transit bill and in "slow internet" tickets. For an ISP, the first step is to see what each box consumes; the second is to have visibility into the rest of the network.
When a subscriber complains that "the internet is slow", the ISP usually looks at its own network. But part of the problem starts in a US$50 device the subscriber bought on their own and that nobody at the ISP manages. This note follows that traffic end to end, from the customer's living room to the outbound link, and explains what an ISP can do about it.
A huge, barely managed market
Cheap Android boxes have become the usual replacement for the cable set-top box in many homes in the region. There is no single official figure, but a few data points show the scale:
- Brazil. The trade press reported that Anatel pulled more than 1.4 million devices from circulation in 2023, and cited estimates of 5 to 7 million homes with illegal pay-TV ("TV a gato"). In January 2024, a report from a Chinese research center flagged more than 1.3 million Brazilian IP addresses tied to a TV box botnet, and Anatel said it had found backdoors and malware in some devices.
- Argentina. We did not find an official count. What is visible is the market movement: according to a prosecutor quoted in the press, after football-streaming sites were blocked there was a mass migration to imported boxes with preloaded apps, at around US$50 each, and the courts ordered Magis TV blocked.
An important caveat: not every generic box is pirate or infected, and many legitimate operators use them on purpose to save cost. But the white-label hardware and its unaudited firmware are the same, and that is where the problem we describe in why your Android TV box ships with malware from the factory appears.
What an infected box does to the network
A box with adware, hidden updaters or third-party services does not wait for someone to watch TV. It keeps connections open, downloads ads, polls remote servers and, according to the botnet reports, can be used to generate traffic on behalf of third parties. The result is background traffic, constant and often at hours when nobody is using the box. A thousand boxes that each move a little add up to a volume no single subscriber notices, but that the ISP pays for.
The whole chain: where the cost shows up
That traffic crosses every segment between the subscriber and the exit to the internet, and each one costs something different:
- The subscriber's Wi-Fi. The box competes for airtime with phones, laptops and consoles, almost always on the 2.4 GHz band, which is already crowded. A box that transmits non-stop takes capacity from everything else, and the subscriber perceives "slow internet" on every device even if the plan is more than enough.
- The router or CPE. Every open connection uses resources on the customer's device. An entry-level router with many simultaneous sessions slows down and reboots, and the complaint arrives as a service failure.
- The access network. On PON, radio or cable, capacity is shared among many subscribers. Sustained upload and download from a handful of boxes per node reduces what is left for everyone else, right at peak hours.
- Aggregation and uplink. If the background traffic of the whole base adds up, aggregation links approach saturation sooner than planned, and capacity upgrades are pulled forward.
- Transit and interconnection. Many transit contracts are billed by capacity or by a usage percentile. More sustained traffic means, sooner or later, a bigger link and a higher bill.
- Support and truck rolls. Every complaining subscriber generates a ticket, a call or a technician visit that fixes nothing, because the cause is not in the installation.
If 2,000 boxes in your base each kept just 1 Mbps of background traffic, that would be 2 Gbps sustained crossing your access network and your uplink without anyone looking at it. This is not a measurement of any real network: it is arithmetic to show how small amounts per box become a large cost when multiplied by the base.
What the ISP can do with AdminSTB
AdminSTB is an agent installed on the box that reports its status every 15 minutes. One honest limit: it only sees the boxes where it is installed, meaning the ones the ISP supplies or installs, or those of subscribers who agree to it. It is not a sniffer for the whole network. On those boxes, here is what you get:
- Per-app consumption ranking. You see which apps on the device use the most data and how much they upload compared with what they download. If the video client does not lead, there is a suspect.
- Dangerous apps. The installed apps list flags those with a high danger score, including where they were installed from.
- Wi-Fi band and signal. You know whether the box is on 2.4 GHz with a weak signal and can tell the subscriber to move it closer or switch networks, without sending anyone. The full method is in how to tell whether it is the Wi-Fi, the box or another app's traffic.
- Remote action. Close or uninstall an unwanted app, or reboot the box, from the panel. Closing and uninstalling require the agent as a system app or root; reboot works with and without root.
AdminSTB for internet service providers
Find which boxes generate traffic they should not, and fix it without a technician visit.
Beyond the box: the rest of the network with LintraTech
The box is one end of the problem. To see the rest, AdminSTB is a product of LintraTech, which also has tools built for ISP operations:
- MoniTik. Real-time monitoring and remote management of MikroTik fleets, with alerts, backups and centralized firewall control. It is the view from your network's side, to correlate a usage spike with what you see on the boxes.
- Pico-Server. A device installed on the ISP's network that provides its own, faster DNS, with the query history that MikroTik does not keep. That history is a complementary clue for spotting devices that query suspicious domains.
- LintraTech services. Network design, Linux system performance tuning, security audits and 24/7 monitoring for teams that prefer outside support.
No single tool solves the problem. Together they cover the whole path: what the box does, how your network behaves and what it costs.
What to do now
- Take a sample of your "slow internet" tickets and note how many subscribers use a generic box of their own.
- Install the agent on the boxes the ISP supplies and on a few from willing subscribers, with the free plan, and look at the per-app consumption ranking.
- Cross what you see with the traffic peaks on your network to estimate how much background traffic weighs.
- With those numbers in hand, decide whether it pays to manage the fleet, offer a certified box, or both.