12 Oct 2026 · redes, iot, security · 4 min
A coffee maker doesn't send a terabyte in ten days
A coffee maker would need 2,089 HTTPS requests per second, nonstop, to push 1,008 GB in ten days. Not even to brew.
The number comes from the Keurig K-Supreme SMART an IT pro found in his parents’ router and posted about on X on October 6. UniFi showed the machine doing 9.94 GB down and 1,008.45 GB up over ten days and nine hours, an average of 9 megabits per second upstream. Tom’s Hardware and Cybernews covered it. The owner unplugged it and later noticed almost all of it didn’t leave his network: local junk, probably a bug in the network stack, and a reboot fixed it.
The question left over was how much one normal request from a device like this actually costs, in bytes.
What one request costs
I stood up a local TLS server, a byte-counting proxy, and a pair of typical messages: a 64 byte telemetry body going up and a 74 byte status response coming back.
| scenario | bytes on the wire |
|---|---|
| first connection (handshake plus request) | 5,083 |
| request reusing the connection | 538 |
The TLS handshake is expensive: 4,545 bytes that exist only the first time. After that, each request cycle fits in 538 bytes.
Those two numbers give a monthly traffic projection, varying only the frequency:
| interval between requests | new connection (MB/month) | reuse (MB/month) |
|---|---|---|
| 1 s | 13,175 | 1,395 |
| 5 s | 2,635 | 279 |
| 15 s | 878 | 93 |
| 60 s | 220 | 23 |
| 900 s | 15 | 1.6 |
A device doing real telemetry sits in the bottom rows. The coffee maker was in the top row, and even that wasn’t enough.
The math that doesn’t close
1,008 GB in ten days and nine hours works out to 1,124,498 bytes per second. Divided by the 538 bytes of a reused cycle, that’s 2,089 cycles per second. With a new connection each time, 221 TLS handshakes per second.
total_bytes = 1008 * 10**9
seconds = 10*86400 + 9*3600
print(total_bytes / seconds) # 1124498 bytes per second
print(total_bytes / seconds / 538.2) # 2089 cycles per second
No coffee maker makes 2,000 requests per second. A brew-recipe telemetry ping happens every few hours at most. That number is a stuck process flooding the local network, not spying or mining. It matches what the owner concluded: reboot, a separate network, and the problem never came back.
The LG washing machine that showed up in 2024 pushing 3.6 GB a day, per Tom’s Hardware, sits in the range I measured, 41 KB per second, but a different league: twenty-seven times less than the coffee maker.
What to do with this
Traffic is a metric you can check before you buy a theory. A router with per-device accounting shows it in a weekend. If a device pushes more than a few dozen MB a day, something is wrong, and the answer is almost never “it’s spying on me.”
Put appliances on their own network with no access to yours. That’s the cheap control. And the 4,545 byte handshake I measured is the same one every HTTPS client pays, the thing that disappears from view when TLS just works.
Caveat: the 538 bytes come from a pair of messages I made up to stand in for minimal telemetry. A real device sends a bigger payload. The order of magnitude is what carries the argument, not the exact number.
My take is that the coffee maker story is less about security and more about the invisible cost of a bug in software nobody will ever update. A process that won’t stop sending, running on a device with no debug button, only shows up when someone opens the router panel. When it does, the boring correct answer is the usual one: reboot, and a certificate nobody watches still vouching for whatever the bug sends.