Why don't the figures in vnstat seem to add up?

Router: WD My Net 750
LEDE Reboot 17.01.2 r3435-65eec8bd5f (stable)

Why doesn't the math add up?

I installed vnstat to help me see bandwidth usage of "WiredFred" and "WifiSarah".

root@LEDE:~# vnstat

                      rx      /      tx      /     total    /   estimated
 wlan1: [This must be the 5gHz radio]
       Jul '17         0 KiB  /     483 KiB  /     483 KiB  /       0 KiB
         today         0 KiB  /     483 KiB  /     483 KiB  /      --    

 wlan0: [This must be the 2.4gHz radio]
       Jul '17     20.56 MiB  /   98.13 MiB  /  118.69 MiB  /    1.95 GiB
         today     20.56 MiB  /   98.13 MiB  /  118.69 MiB  /     140 MiB

 eth0.2:
       Jul '17    159.76 MiB  /   43.88 MiB  /  203.64 MiB  /    3.33 GiB
         today    159.76 MiB  /   43.88 MiB  /  203.64 MiB  /     241 MiB

 eth0.1:
       Jul '17     21.80 MiB  /   75.99 MiB  /   97.79 MiB  /    1.58 GiB
         today     21.80 MiB  /   75.99 MiB  /   97.79 MiB  /     114 MiB

 eth0:
       Jul '17    192.08 MiB  /  122.11 MiB  /  314.20 MiB  /    5.18 GiB
         today    192.08 MiB  /  122.11 MiB  /  314.20 MiB  /     376 MiB

Forget the tx and rx and estimated columns. Let's just focus on the third column. That is, the "total" column.
I would think that WiFi bandwidth + Wired bandwidth = Total Bandwidth.

So where is the total bandwidth in the chart?

https://wiki.openwrt.org/toh/wd/n750 says

Interfaces
The default network configuration is:

Interface name     	Description      	Default configuration

br-lan 	                LAN & WiFi       	192.168.1.1/24
vlan0 (eth0.0) 	        LAN ports (1 to 4)     	None
vlan1 (eth0.1) 	        WAN port         	DHCP
wlan0 	                WiFi 2.4 GHz     	Disabled
wlan1 	                WiFi 5 GHz       	Disabled 

http://192.168.1.1/cgi-bin/luci/admin/status/vnstat/config
shows
http://i.imgur.com/CZafyX8.png

Just a thought, wlan1 to wlan0 traffic would increase both wlan counters without affecting any of the wired interfaces' counters... It is quite clear that total is just the sum of rx and tx per line, but I am sure you knew that ;).
But regarding your billing use-case, I would assume that you actually need numbers only for eth0.1, but differentiated by internal addresses; not sure whether vnstat is the right tool, unless you would be content with a approximate solution, like just dividing the cost by the ratio of the totals for WiredFred and WifiSarah...

1 Like

Hi, @moeller0.

Thank you for your reply.

Yes, a lot is unclear. But this is one thing I'm clear on. :stuck_out_tongue:

Hmmm... how come you chose eth0.1? The number is smaller than eth0.

Yes, I'm fine with an approximate measurement. I don't need precision down to the byte, or even to the megabyte. I just want to make sure that everything is accounted for. And when I look at my vnstat, I wonder:

  1. What exactly is the grand total bandwidth used? Which interface represents this grand total?
  2. How can WiFi + Wired = "Grand Total"?

I'm okay with dividing cost by ratio. But again, I want to make sure that vnstat has monitored everything. How can I be assured if the math doesn't add up? Let me reiterate, I'm completely okay with imprecise measurements. But I'm not okay knowing that we are not accounting for everything.

You are looking things a bit wrongly.

You have one wan interface, and several lan interfaces (wired, wifi).
vnstat measures the traffic for each interface separately and totals will not add up.

E.g. DHCP traffic from wifi to router will not get forwarded to WAN, so the wifi traffic counter grows, but WAN counter does not. Number do not add up any more... The same goes for all kind of services running on the PC that e.g. sniff for LAN PC's, network file shares, printers etc. stuff that Windows (and Macs) do in LAN. So, likely the sum of LAN traffic counters will exceed the WAN traffic counter.

Based on your vnstat config screenshot, I think that eth0.2 is your wan (instead of the eth0.1 as said in the wiki extract that you have confusingly included here). You should verify that by looking at the actual network settings in your router instead of looking at the outdated wiki.

Do I assume right that this router only has "billable traffic"? So, you are interested in the WAN total.

eth0.2 has 204 MB while wlan0 has 119 and eth0.1 has 98 (together 217), so there has been some 13 MB internal LAN-LAN or LAN-router traffic that has not got in to WAN.

1 Like

@Hnyman, thanks for chiming in.

By wifi, do you mean, say, WifiSarah's laptop? Or are we talking about one of the two the wireless radios inside the router?

By WAN, we mean "internet" right? We mean the router is connecting to the Internet? I think so, but I just wanna confirm.

While "inside" my router (i.e. ssh root@192.168.1.1), I ran ip a. Here are the results:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:0th0:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP qlen 1000
    link/ether 00:90:a9:05:07:86 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::290:a9ff:fe05:786/64 scope link 
       valid_lft forever preferred_lft forever
5: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether 00:90:a9:05:07:86 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
       valid_lft forever preferred_lft forever
    inet6 2600:e008:8:ced8::1/61 scope global dynamic 
       valid_lft 578sec preferred_lft 578sec
    inet6 fd9d:c63f:7525::1/60 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::290:a9ff:fe05:786/64 scope link 
       valid_lft forever preferred_lft forever
6: eth0.1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
    link/ether 00:90:a9:05:07:86 brd ff:ff:ff:ff:ff:ff
7: eth0.2@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether 00:90:a9:05:07:85 brd ff:ff:ff:ff:ff:ff
    inet 100.100.103.106/29 brd 100.100.103.111 scope global eth0.2
       valid_lft forever preferred_lft forever
    inet6 2600:e008:8:ced0:290:a9ff:fe05:785/64 scope global dynamic 
       valid_lft 282sec preferred_lft 12sec
    inet6 fd0d:edc3:e12a::290:a9ff:fe05:785/64 scope global dynamic 
       valid_lft 282sec preferred_lft 12sec
    inet6 fe80::290:a9ff:fe05:785/64 scope link 
       valid_lft forever preferred_lft forever
8: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
    link/ether 00:90:a9:05:07:88 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::290:a9ff:fe05:788/64 scope link 
       valid_lft forever preferred_lft forever
9: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
    link/ether 00:90:a9:05:07:86 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::290:a9ff:fe05:786/64 scope link 
       valid_lft forever preferred_lft forever
root@LEDE:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP qlen 1000
    link/ether 00:90:a9:05:07:86 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::290:a9ff:fe05:786/64 scope link 
       valid_lft forever preferred_lft forever
5: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether 00:90:a9:05:07:86 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
       valid_lft forever preferred_lft forever
    inet6 2600:e008:8:ced8::1/61 scope global dynamic 
       valid_lft 571sec preferred_lft 571sec
    inet6 fd9d:c63f:7525::1/60 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::290:a9ff:fe05:786/64 scope link 
       valid_lft forever preferred_lft forever
6: eth0.1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
    link/ether 00:90:a9:05:07:86 brd ff:ff:ff:ff:ff:ff
7: eth0.2@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether 00:90:a9:05:07:85 brd ff:ff:ff:ff:ff:ff
    inet 100.100.103.106/29 brd 100.100.103.111 scope global eth0.2
       valid_lft forever preferred_lft forever
    inet6 2600:e008:8:ced0:290:a9ff:fe05:785/64 scope global dynamic 
       valid_lft 275sec preferred_lft 5sec
    inet6 fd0d:edc3:e12a::290:a9ff:fe05:785/64 scope global dynamic 
       valid_lft 275sec preferred_lft 5sec
    inet6 fe80::290:a9ff:fe05:785/64 scope link 
       valid_lft forever preferred_lft forever
8: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
    link/ether 00:90:a9:05:07:88 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::290:a9ff:fe05:788/64 scope link 
       valid_lft forever preferred_lft forever
9: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
    link/ether 00:90:a9:05:07:86 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::290:a9ff:fe05:786/64 scope link 
       valid_lft forever preferred_lft forever

I double checked on IRC, and people there said that my eth0.2 is my WAN and my eth0.1 is my br-LAN, or LAN.

[quote="hnyman, post:4, topic:4958"]
Do I assume right that this router only has "billable traffic"? So, you are interested in the WAN total.
[/quote] Yes, the router is connected to a not-unlimted internet service. Does that answer your question? I'm interested in WAN total, yes, but I'm primarily interested in dividing bandwidth used by WiredFred and the usage used by WifiSarah.

I have no idea which of your interfaces is "WifiSarah" or "WiredFred" as that is not visible in any of your logs or config. Based on traffic stats, those might be using wlan0 and eth0.1. I mean "interfaces" as the vnstat sees them, eth0.1, eth0.2, wlan0 and wlan1. But note that wlan0 and wlan1 are NOT equal to a wireless radio. One physical radio may have multiple logical interfaces.

Vnstat does NOT measure traffic by device. If there are several devices connecting via a same radio interface, they all get lumped together.

Vnstat only measures traffic on logical interfaces as they are defined. Similarly vnstat does not care if the other side of an interface is "internet", neighbour's router, VPN pipe to somewhere, whatever...

By WAN (Wide Area Network) I mean the network outside your Local Area Network (LAN). In your case WAN is likely your ISP and the connection uses eth0.2 as that gets a public-looking IP address. WAN and LAN are common terms on router (and firewall) discussions, while "internet" is not used that often as it is ambiguous. In practical terms WAN means the "next hop" away from your local network (under your control).

Based on that "ip" output, eth0.2 is your wan connection. That should also be rather visible in the overview screen and network/interfaces screen.

You might also test "darkstat" package. It offers more per-host stats, which might be useful if you need to see closer statistics per device.

1 Like

We've concluded that eth0.2 is my WAN connection.

Do we know what eth0 and eth0.1 is?