My FW sends a daily mail about traffic. I occasionally look at this to scan the obvious. My Model S's dhcp address is tied to its hardware address (x.x.13.25) in private LAN space. This is the recent traffic that was reported. 8/10/18 sent 103Mb -> driving footage for AP (?) 8/11/18 sent 120Mb -> ditto 8/12/18 send 194Mb -> ditto 9/01/18 recv 496Mb -> software updated on same day 9/04/18 sent 28Mb -> driving footage ? 9/05/18 sent 80Mb -> ditto 9/07/18 sent 174Mb -> ditto 9/08/18 sent 120Mb -> ditto 9/12/18 sent 167Mb -> ditto 9/15/18 recv 5.83Gb0 -> V9 ? 9/16/18 recv 367Mb -> software update ? (not yet known) The 5.83Gb received by the car on 9/15 are strangely related by size to this entry from the FW report: 2 ssh (Port:22) TCP Egress 5.480 (GBytes) Basically, my FW says: 5.83Gb was recv by your car and the 2nd most trafficked port on that day was SSH port 22. The question is why use SSH out of the car? Is it a v9 download via CDN (that is ssh protected) rather then normal VPN to the mothership ?