Understanding Traffic Analyzer page

[Keenan]

I'm trying to understand what I'm seeing in the Traffic Analyzer charts. In the image I've attached would it be correct to say that the hourly indicator along the bottom of the chart is in 24 hour increments and the "0h" entry indicates midnight my time?

Spoiler

As I'm reading the chart I see that 'Lyspc' has used 28.19 Gbs in the last 24 hr period with the bulk of that usage being between the hrs of 8pm and about 3:30am and that 22 GBs of that data was used by the Amazon Cloudfront and Amazon Video entries which as I understand it are both related to the Amazon streaming video product. Why they are different is another question I have but not really relative to this posting.

Thanks in advance for any insight on this.

Also, out of curiosity why do I have an entry for Xbox in the app listing when I don't even have an Xbox? Is it related to some other Windows 10 function?

 

[MarkRH]

Yeah, when you first go to that page, it's showing the last 24 hours (even if on different days). 0h is indeed midnight. How it categorizes things is up to Trend Micro. I have Windows 7 and I haven't seen an XBOX entry... so that could be a Windows 10 related thing talking to the same servers that XBOX does.

I play EverQuest II and it categorizes that data as "Planetside" even though I don't have that game LOL.

 

[kfp]

- You are reading it right.
- They are different because Amazon Cloudfront is their CDN. If you’ve access anything hosted on Amazon it would definitely contribute to that category.
- What @MarkRH said. Signatures are updated by TrendMicro so we as end users have little control over that. Best you can do is keep the signature definitions up to date.

 

[Keenan]

Yeah, when you first go to that page, it's showing the last 24 hours (even if on different days). 0h is indeed midnight. How it categorizes things is up to Trend Micro. I have Windows 7 and I haven't seen an XBOX entry... so that could be a Windows 10 related thing talking to the same servers that XBOX does.

I play EverQuest II and it categorizes that data as "Planetside" even though I don't have that game LOL.

Thanks. Not that I'm really concerned but I'm going to do a bit of research on what that Xbox entry is, purely out of curiosity as the data amount is basically negligible.

 

[Keenan]

- You are reading it right.
- They are different because Amazon Cloudfront is their CDN. If you’ve access anything hosted on Amazon it would definitely contribute to that category.
- What @MarkRH said. Signatures are updated by TrendMicro so we as end users have little control over that. Best you can do is keep the signature definitions up to date.

When you say 'signatures' what are you referring to? The individual apps using the data? And how would you keep them up to date?

 

[kfp]

When you say 'signatures' what are you referring to? The individual apps using the data? And how would you keep them up to date?

The signature used by the DPI engine to categorize traffic into their respective categories.

Administration -> Firmware Update and hit the Check button next to the Signature Version

As for the XBOX category, I think @MarkRH is right on the head as well, likely some traffic Windows 10 is generating (hitting something on the live.com domain).

 

[Keenan]

The signature used by the DPI engine to categorize traffic into their respective categories.

Administration -> Firmware Update and hit the Check button next to the Signature Version

As for the XBOX category, I think @MarkRH is right on the head as well, likely some traffic Windows 10 is generating (hitting something on the live.com domain).

Just checked it and it's up to date, 2.070 updated on 5/26/18.

Thanks

Regarding that 29 Gbs, that seems like an awfully lot of data to stream 2 episodes of Suits which is what the user says they watched. I'm not looking to catch someone wasting data I'm just curious why I'm seeing that amount.

 

[kfp]

Regarding that 29 Gbs, that seems like an awfully lot of data to stream 2 episodes of Suits which is what the user says they watched. I'm not looking to catch someone wasting data I'm just curious why I'm seeing that amount.

There is some inaccuracies in the stats collection (should be fixed in next release for at least certain models that Merlin supports), in the meantime you could compare the numbers with data provided by your ISP if you have access to it.

 

[Keenan]

There is some inaccuracies in the stats collection (should be fixed in next release for at least certain models that Merlin supports), in the meantime you could compare the numbers with data provided by your ISP if you have access to it.

Yes but Comcast doesn't provide any sort of granularity to speak of and the chart includes this little gem of a disclaimer, "Data used in the last 24 hours may not be displayed", so basically useless for what I'm looking for.