The router’s traffic statistics are 260G more than the operator’s app. Who made a mistake in remembering this?

When I checked my broadband bill last month, the operator's app said "420G has been used this month." I conveniently entered the router's backend, and the traffic statistics page showed 680G. The same home, the same broadband, the same month, the difference between the two numbers is more than 200 gigabytes. The first reaction is that the router is broken, and the second reaction is that the operator overcalculated. Both are wrong - I don't know when the router's account was started. In this article, I will write down everything I have reconciled in one go.: Statistical caliber, clearing pitfalls, and the three really useful aspects of this account. If your home network is slow and you want to limit the speed, this article is a homework before starting the project.

Make it clear first: The router's account and the operator's account are not the same.

Just because it's not right doesn't mean someone is wrong. There are three differences between the two accounting rules. I checked them one by one.:

The starting point is different. The operator's app records accounts on a natural monthly basis and resets to zero at 0:00 on the 1st of each month. This is unbreakable. As for router statistics, my Mercury is "accumulating since the last manual reset", my friend's Xiaomi next door is "accumulating since the last factory reset", and my colleague's TP-Link is simply "accumulating since the last power outage and restart". My 680G was saved since the day I last restarted the router, which was the 26th of last month - a span of two natural months. Aligning the starting point, 420G and the number on the book will basically coincide.

The caliber of recording is different. The operator records the traffic on the public network, and only the traffic through the WAN port is counted. Some router models record the "total traffic", including the internal transmission of the LAN - the TV pulls the movie from the NAS without even leaving a G, and some routers also record it for you. This difference will be particularly big for people who have NAS at home. My home intranet transfers dozens of gigabytes to each other every day, and the statistics are all included.

There are also retransmissions and overhead. TCP retransmission and various protocol headers have different algorithms on both sides. A difference of a few percent is normal. There is no need to take this kind of fraction seriously.

Statistics will be cleared when restarted. This is the easiest pitfall for misjudgment.

My router was powered off and restarted, and the statistics reset to zero. I've suffered a lot from this design: For a while, my home network was stuck in the middle of the night. I suspected that a device was stealing traffic. I got up early the next morning and checked the statistics. The numbers were so small that I thought I had made a mistake. Later I realized that the router was unplugged by an old man at home that night (the socket was loose, so he pressed the switch), and the statistics had long since been cleared and reset. What I was looking at was not the entire night’s account at all.

So capture the traffic, Before looking at the statistics, make sure the router has not been restarted during this period. . Generally, you can see the running time in the background. Mercury is on the system status homepage, Xiaomi is in the router information, and TP-Link is called the running time. If the running time is less than the time period you want to check, the account is incomplete. Some models have statistics that will not be lost after power outage (stored in flash memory), but don’t bet, take a look at the running time first for the most stable performance.

Counter-intuitive by the way: There are also benefits to stat clearing. If you suspect there is something fishy in a certain period of time, manually clear it once, and then come back to read after that period of time. What you read will be a clean account for a period of time, which is much more convenient than deducting deductions from a pile of accumulated numbers. This technique will be used later.

The use of this account is 1: Catching someone who steals traffic in the middle of the night is more stable than looking at the real-time rate

When the network is slow, most people’s first reaction is to check the device list to see the real-time speed. Xiaomi’s article about stealing traffic This is the method written in it. It is easy to use when catching the current situation. But most of the devices that steal traffic don’t come out in the open.: Be a good person during the day and work in the middle of the night. If you sleep it to work, the real-time rate will never catch it.

This is where cumulative statistics by device come in handy. Scroll through the "By Device" list on the statistics page and compare the total usage of each device with "how much it should be used": A TV box with a few gigabytes a month is normal, but if it suddenly comes out with dozens of gigabytes, there is something strange. ； A smart speaker has a few hundred gigabytes all year round. If it jumps to a few gigabytes in any month, it is probably due to a firmware upgrade or a malfunction. The Internet speed at my colleague's home was inexplicably slow. After browsing by device, an old mobile phone was lying in the drawer and plugged in. It used more than 60 gigabytes in a month - later it was found out that the background synchronization of a certain network disk App was not closed, and the lock screen was still being transmitted.

A more ruthless trick is the time curve. The statistics pages of many routers have 24-hour traffic curves. You can tell at a glance whether there is a flat line between two and five o'clock in the middle of the night. If there is no NAS, no monitoring, and no cloud disk synchronization at home, the upward curve in the middle of the night should be close to zero all year round. ； These devices should be scattered and small bulges, not a flat line that is held up tightly. During the day when no one is around, the upward trend tops into a flat line. , either the device was stolen, or the router itself was used as a proxy. The latter is a security issue, and the number of ways to deal with it is The router was hacked Everything is written in, please unplug the WAN port first.

The second use of this account: Before limiting the speed, let the data speak first

If you want to limit the speed of your network card at home, if you set it up directly, you will most likely limit the speed to the wrong person. The five-step speed limit article The first step is to catch the real culprit, and the most stable source of the real culprit is this statistical account: The real-time rate only represents the moment, and the cumulative statistics represent the long term. Whoever consumes half of the traffic at home every day can sort out the list. It only makes sense to limit it. Those who live in a shared house should first read this account before dividing the bandwidth. Roommates should divide the bandwidth according to actual usage, which is much less noisy than dividing by head. Our method at that time is recorded in 300M divided into three parts inside.

After completing the speed limit, there is a finishing move that few others mention.: Come back the next day to review the statistics . Among the reasons why the speed limit setting does not take effect, random MAC replacement is the number one pitfall - the device is replaced with a fake MAC, the router still limits the number of the old vest, and the new one is still full. This mechanism is MAC article The inside is very fine. Before the speed limit was set, the monthly traffic of the device was 60G. The statistics were still rising the next day after the speed limit was set. That means there was no limit. Go to the mobile WiFi details page and turn off "Random MAC/Private Address" and set it again. The statistical account plays the role of referee here.: Whether it takes effect or not, numbers have the final say, not feelings.

Three uses of this account: Determine whether broadband needs to be upgraded

A slow network does not necessarily mean insufficient bandwidth. With a 300M broadband, the monthly traffic account is 300 to 400G all year round. If the speed drops during peak periods, it is a problem with the bandwidth or equipment. ； The monthly traffic is less than 100G, and the card is stuck for one hour at 9pm. Upgrading to Gigabit is a waste of money - what you need may be a router that can handle dozens of devices. I have been through the trap of negotiating 100M for the WAN port. 500M only runs 94M It's a lesson. Check the statistics first, then decide where to spend your money.

Reconciliation also has a side benefit: Check billing disputes. I really suspect that the operator is overbilling. I align the statistics of the router's WAN port with the curve of the app after the natural month and look at it together (note that only the WAN port is looked at and the intranet ones are excluded). If the shape and magnitude of the curves on both sides are the same, then it is basically suitable for your home. ； The difference is an order of magnitude, so keep the screenshots so you can call customer service with confidence. Operators and users are also particular about speed measurement standards. Before reporting for repair, you must first find out who recognizes which number. The article about repair speed test Don't step on the points you have stepped on again.

After three months, I only have four fixed movements.

You don’t need to keep an eye on the traffic statistics page every day. This is how I use it.:

The last two sentences are true. First, router statistics are not a measuring instrument and cannot be accurate to the single digit. Its value lies in "finding patterns and catching anomalies", not in "calculating accounts." Second, if you really want to be more serious about billing, the operator's table shall prevail - but in order for the operator to recognize your account, you must first come up with the account of the router. This is the meaning of its existence. If the statistics page of your home router doesn't exist at all or remains static all year round, don't search for it. It's very common for old machines worth hundreds of dollars to lose functionality. Then go back to the old method of real-time rate and time point monitoring, which is just a waste of time.