vnstat measures file sharing from one device to another as transmission

[thelastindian]

vnstat won't show me accurate data, it's estimates for today are 1.66 times greater than what it should be. If the data usage is 6 GB, it would show me that it is 10GB, pretty inaccurate readings. Is there a way to fix this? Also, sometimes it's 1.66 times and sometimes it more/less. It isn't accurate is my point, but yes, 1.66 is an average.

yesterday my data usage was close to 2.9 GBs (I am sure of this) but it showed me that I had used 4.5 GBs of data, which is pretty inaccurate and unreliable, I am ready to post any files you like (please tell me what to redact while requesting data), but it would be helpful if we could get to the bottom of this issue.

---

What was causing the inaccurate readings: I am connected to my android through hotspot and 3 other applications, scrcpy, KDE connect and syncthing are also connected and sometimes they send documents wirelessly (not uploaded to the internet). It's counting stuff which I shared over the 3 applications scrcpy, KDE connect and syncthing, now, is there a way to not count these? Let me share the log (at the end)

$ vnstat --version
vnStat 2.6 by Teemu Toivola <tst at iki dot fi>

(base) bob@bob:~
$ vnstat
Database updated: 2023-09-19 07:00:00

   wlan0 since 2023-07-29

          rx:  189.57 GiB      tx:  32.15 GiB      total:  221.72 GiB

   monthly
                     rx      |     tx      |    total    |   avg. rate
     ------------------------+-------------+-------------+---------------
       2023-08     99.69 GiB |   19.95 GiB |  119.64 GiB |  383.71 kbit/s
       2023-09     82.18 GiB |   11.68 GiB |   93.86 GiB |  510.18 kbit/s
     ------------------------+-------------+-------------+---------------
     estimated    134.79 GiB |   19.16 GiB |  153.94 GiB |

   daily
                     rx      |     tx      |    total    |   avg. rate
     ------------------------+-------------+-------------+---------------
     yesterday      4.53 GiB |    1.14 GiB |    5.67 GiB |  563.69 kbit/s
         today     76.53 MiB |  243.18 MiB |  319.71 MiB |  106.42 kbit/s
     ------------------------+-------------+-------------+---------------
     estimated    262.40 MiB |  833.75 MiB |    1.07 GiB |
(base) bob@bob:~
$ echo "sharing  1.3 gb file over syncthing"
sharing  1.3 gb file over syncthing
(base) bob@bob:~
$ vnstat
Database updated: 2023-09-19 07:10:00

   wlan0 since 2023-07-29

          rx:  189.59 GiB      tx:  33.23 GiB      total:  222.82 GiB

   monthly
                     rx      |     tx      |    total    |   avg. rate
     ------------------------+-------------+-------------+---------------
       2023-08     99.69 GiB |   19.95 GiB |  119.64 GiB |  383.71 kbit/s
       2023-09     82.20 GiB |   12.77 GiB |   94.97 GiB |  516.00 kbit/s
     ------------------------+-------------+-------------+---------------
     estimated    134.76 GiB |   20.94 GiB |  155.70 GiB |

   daily
                     rx      |     tx      |    total    |   avg. rate
     ------------------------+-------------+-------------+---------------
     yesterday      4.53 GiB |    1.14 GiB |    5.67 GiB |  563.69 kbit/s
         today     94.19 MiB |    1.33 GiB |    1.42 GiB |  472.43 kbit/s
     ------------------------+-------------+-------------+---------------
     estimated    315.44 MiB |    4.44 GiB |    4.75 GiB |
(base) bob@bob:~
$ echo "ok that's accurate, it did count syncthing's shared file, now, how can I make sure that uploads to my phone via syncthing, scrcpy & KDE connect don't count?"
ok that's accurate, it did count syncthing's shared file, now, how can I make sure that uploads to my phone via syncthing, scrcpy & KDE connect don't count?

(base) bob@bob:~
$ vnstat -hg
 wlan0                                                                    07:20 
  ^                                                                        t    
  |                                                                        t    
  |                                             t                          t    
  |                                             t                          t    
  |                                            rt                          t    
  |                                            rt r                        t    
  |                                   r        rt r                        t    
  |                 r  r              r  r     rt r                        t    
  |           r     r  r              r  r     rt r                     t  t    
  |     r  r  r  r  r  r              r  r     rt r                     t  t    
 -+---------------------------------------------------------------------------> 
  |  08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 00 01 02 03 04 05 06 07    

 h  rx (MiB)   tx (MiB)  ][  h  rx (MiB)   tx (MiB)  ][  h  rx (MiB)   tx (MiB) 
08       87.7        9.5 ][ 16       23.4        1.9 ][ 00        0.0        0.0
09      137.9       11.5 ][ 17       86.3       13.0 ][ 01        0.0        0.0
10      188.0       16.1 ][ 18       21.5       14.6 ][ 02        0.0        0.0
11      261.0       16.5 ][ 19      548.3       31.8 ][ 03        0.0        0.0
12      155.9       21.2 ][ 20      398.5       26.9 ][ 04        0.0        0.0
13      384.0        8.5 ][ 21       37.7        8.6 ][ 05        0.0        0.0
14      423.7       21.7 ][ 22      737.5      927.1 ][ 06       76.5      243.2
15        1.9        0.5 ][ 23      616.8       25.3 ][ 07       23.8    1,117.7

[vergoh]

Which vnStat version are you using?

The estimate is based on the average traffic rate so far for the selected time period. It doesn't have any understanding of any usage patterns as it's only doing linear estimation based on the current average. As a result, if you for example don't use the connection much during the night and then check the estimate the first things during the morning then that estimate isn't likely to be too accurate but it will improve as the day progresses.

As for the "inaccuracy" you are trying to understand, I suspect the problem is related to how you expect vnStat to be monitoring traffic. The thing is, vnStat isn't aware if the traffic it sees is something you'd count as "external" or "local". It only sees the amount of traffic seen by the network interface and if that interface can communicate with both "external" and "local" systems then both are being reported and there's no way to differentiate between those two. vnStat is still accurate in that case as that's all the traffic the interface being monitored sees.

[thelastindian]

$ vnstat --version
vnStat 2.6 by Teemu Toivola <tst at iki dot fi>

I edited it in the original question too. I understand now why the traffic stats are the way they are. I still wish there was a way to distinguish between local and external traffic though.

Idk what I am talking about, but is there a way to make certain pathways not register on vnstat? I mean, I realize you said there is no way to differential between them, but if vnstat say measures different data flows and for scrcpy application say the data stream always going through a pre determined path, maybe one would be able to make vnstat ignore it?

Again, I am glad that vnstat is accurate and I really don't know what I am talking abt, but as an analogy, let's say there are 5 bridges and only 2 of these bridges are local bridges, then maybe if they bridges aren't changing (i.e., the data stream from that path is predictable) one can try to ignore it?

Again, I got my answer, thank you for your help and for your package!

If you need any other info or want to reply to my comments you can do that, I will be closing the issue after 24 hours.

[vergoh]

You can see the data that vnStat uses as source with cat /proc/net/dev. It's only interface metrics that are visible from there. There's no information what the traffic is about, which program has generated it or where the traffic going or coming. On the other hand, that's also the reason why the system resource usage of vnStat doesn't change at all no matter how much traffic you have as the kernel is doing all the work anyway.

The only option you have to separate the traffic for vnStat is to have more interfaces that are in some way use case specific. However, the catch is that those interfaces don't all need to be physical interfaces. For example, tunnel interfaces can be monitored so having some kind of VPN setup could be one option.