Traffic Analyzer accuracy

[asusTraffic]

I have RT-AC5300 with the latest Merlin FW 386.9. I have noticed that some devices uses too much data as showed in the screenshots i've uploaded. The reason it shows only upload and nothing under download is that when i enable my openVPN client, the traffic analyzer combines both upload and download traffic under the upload column.

1:st device is a Nest Protect 2:nd gen smart smoke detector
2:nd device is a LG 55EG910V smart TV

1. How accurate is Traffic Analyzer anyway? i've seen the same problem with several of my Nest Protects devices over months/years. Smartphones and other devices is more accurate though imo.
2. How can I resolve the upload/download statistic in traffic analyzer with openVPN enabled? when I disable openVPN, it differentiate upload from download just fine.
3. Assuming that i'm not being actively spied on. What other explanations does justify the high data consumption?

https://imgur.com/a/c5xcew3

Thanks!

EDIT:

Hardware acceleration was disabled the whole time.

 

[drinkingbird]

If you want truly accurate analyzer you typically have to disable hardware acceleration which could limit the throughput of the router. Kind of a tradeoff.

I've also noticed from time to time high unexplained spikes for QUIC protocol which Chrome, Facebook, etc use. In your case it is probably contained within "general" since you're using a VPN. I don't know if chrome does huge updates or synchronizes cache or what. Or is just collecting all my data which wouldn't surprise me.

I don't use VPN so can't comment on why it is combining bandwidth, possibly also something to do with HW acceleration, or maybe the VPN happens before the analyzer in that direction and it just bypasses it for some reason, hopefully someone else can she more insight into that.

 

[asusTraffic]

If you want truly accurate analyzer you typically have to disable hardware acceleration which could limit the throughput of the router. Kind of a tradeoff.

I've also noticed from time to time high unexplained spikes for QUIC protocol which Chrome, Facebook, etc use. In your case it is probably contained within "general" since you're using a VPN. I don't know if chrome does huge updates or synchronizes cache or what. Or is just collecting all my data which wouldn't surprise me.

I don't use VPN so can't comment on why it is combining bandwidth, possibly also something to do with HW acceleration, or maybe the VPN happens before the analyzer in that direction and it just bypasses it for some reason, hopefully someone else can she more insight into that.

Thanks for replying!

Hardware acceleration was disabled the whole time. Forgot to mention it.
Also, if I understand you correctly, the openVPN client I'm talking about is the one within the router FW itself. That means I can perfectly fine see which protocol has been used from all devices even though I have my openVPN client enabled in router. Check this screenshot:

https://imgur.com/a/0gux63s

As you can see, Facebook, Tiktok, Whatsapp, Youtube shows up distinct here.
I'm assuming that "general" is because the traffic is encrypted but you could be right that the protocol used before encryption "skews" Traffic Analyzer metric.

 

[drinkingbird]

Thanks for replying!

Hardware acceleration was disabled the whole time. Forgot to mention it.
Also, if I understand you correctly, the openVPN client I'm talking about is the one within the router FW itself. That means I can perfectly fine see which protocol has been used from all devices even though I have my openVPN client enabled in router. Check this screenshot:

https://imgur.com/a/0gux63s

As you can see, Facebook, Tiktok, Whatsapp, Youtube shows up distinct here.
I'm assuming that "general" is because the traffic is encrypted but you could be right that the protocol used before encryption "skews" Traffic Analyzer metric.

I can't speak to the VPN client since I haven't used it, seems to be interfering somehow, maybe one direction of traffic is seen "before" encryption and the other direction is "after" and for whatever reason the router is having trouble separating the two. Maybe @RMerlin or someone with more experience with the VPN can comment.

 

[tonymet]

I also have been getting really wild statistics . e.g. a Smart Plug transferring 45GB / day and my Brother Printer 8 GB / day

 

[tonymet]

@drinkingbird would false attribution stats (e.g. wrong client IP / Mac) in traffic analyzer statistics count as a bug? this one caused some trash when I thought my network was hacked.