Wan interface Usage is way higher than Lan

I am monitoring my traffic usage using vnstat as my internet subscription has a data cap on it, I recently noticed that my wan traffic is much higher than lan. in just 21 days the wan traffic exceeded my Lan by about 50GB, I thought it's maybe caused by the protocol overhead (FTTC + PPPOE + 1492mtu) even with overhead it shouldn't go this far up

does anyone have any explanation for this?

1 Like

May usage was 361/304 = 18.75% higher
April usage was 140/123 = 13.8% higher

The nice gentlemen over here say hardware NAT acceleration (offloading) should be turned off.

Assuming the larger number of the 2 (wan) is the accurate one it would match your ISP's usage statistic. Is that the case?
Assuming the smaller number of the 2 (lan) was not accurate due to NAT offloading.

Disclaimer: I don't use this software I have no idea. But you could test this theory out by turning hardware offloading (or perhaps SFO) off?

sorry for the late reply, I have been busy with work stuff

I do not have NAT acceleration (offloading) enabled. also after some searching I found some people said it may be a DNS amplification attack so I dropped any traffic at porn 53 but still had the same issue