vnstat measures file sharing from one device to another as transmission about vnstat

[vergoh]

Which vnStat version are you using?

The estimate is based on the average traffic rate so far for the selected time period. It doesn't have any understanding of any usage patterns as it's only doing linear estimation based on the current average. As a result, if you for example don't use the connection much during the night and then check the estimate the first things during the morning then that estimate isn't likely to be too accurate but it will improve as the day progresses.

As for the "inaccuracy" you are trying to understand, I suspect the problem is related to how you expect vnStat to be monitoring traffic. The thing is, vnStat isn't aware if the traffic it sees is something you'd count as "external" or "local". It only sees the amount of traffic seen by the network interface and if that interface can communicate with both "external" and "local" systems then both are being reported and there's no way to differentiate between those two. vnStat is still accurate in that case as that's all the traffic the interface being monitored sees.

[thelastindian]

$ vnstat --version
vnStat 2.6 by Teemu Toivola <tst at iki dot fi>

I edited it in the original question too. I understand now why the traffic stats are the way they are. I still wish there was a way to distinguish between local and external traffic though.

Idk what I am talking about, but is there a way to make certain pathways not register on vnstat? I mean, I realize you said there is no way to differential between them, but if vnstat say measures different data flows and for scrcpy application say the data stream always going through a pre determined path, maybe one would be able to make vnstat ignore it?

Again, I am glad that vnstat is accurate and I really don't know what I am talking abt, but as an analogy, let's say there are 5 bridges and only 2 of these bridges are local bridges, then maybe if they bridges aren't changing (i.e., the data stream from that path is predictable) one can try to ignore it?

Again, I got my answer, thank you for your help and for your package!

If you need any other info or want to reply to my comments you can do that, I will be closing the issue after 24 hours.

[vergoh]

You can see the data that vnStat uses as source with cat /proc/net/dev. It's only interface metrics that are visible from there. There's no information what the traffic is about, which program has generated it or where the traffic going or coming. On the other hand, that's also the reason why the system resource usage of vnStat doesn't change at all no matter how much traffic you have as the kernel is doing all the work anyway.

The only option you have to separate the traffic for vnStat is to have more interfaces that are in some way use case specific. However, the catch is that those interfaces don't all need to be physical interfaces. For example, tunnel interfaces can be monitored so having some kind of VPN setup could be one option.