I am monitoring my traffic usage using vnstat as my internet subscription has a data cap on it, I recently noticed that my wan traffic is much higher than lan. in just 21 days the wan traffic exceeded my Lan by about 50GB, I thought it's maybe caused by the protocol overhead (FTTC + PPPOE + 1492mtu) even with overhead it shouldn't go this far up
does anyone have any explanation for this?
May usage was 361/304 = 18.75% higher
April usage was 140/123 = 13.8% higher
The nice gentlemen over here say hardware NAT acceleration (offloading) should be turned off.
Assuming the larger number of the 2 (wan) is the accurate one it would match your ISP's usage statistic. Is that the case?
Assuming the smaller number of the 2 (lan) was not accurate due to NAT offloading.
Disclaimer: I don't use this software I have no idea. But you could test this theory out by turning hardware offloading (or perhaps SFO) off?
sorry for the late reply, I have been busy with work stuff
I do not have NAT acceleration (offloading) enabled. also after some searching I found some people said it may be a DNS amplification attack so I dropped any traffic at porn 53 but still had the same issue