vnStat TX Activity

  • ATTENTION! You'll notice a Prefix dropdown when you create a thread. If your post applies to one of the topics listed, please use that Prefix for your post. When browsing the thread list you can use the Prefix to filter the view.
  • ATTENTION! As of November 1, 2020, you are not able to reply to threads 6 months after the thread is opened if there are more than 500 posts in the thread.
    Threads will not be locked, so posts may still be edited by their authors.
    Just start a new thread on the topic to post if you get an error message when trying to reply to a thread.


Occasional Visitor
My vnStats are indicating high TX activity. I use typical streaming services and expect the RX activity to increase at times but a bit perplexed by the TX activity. I have AI protection enabled, if that's relevant, and the Traffic Monitor doesn't isolate transmission activity by device. What's the best way to identify the source?


JR Godwin

Regular Contributor
If you're alreadt using AIProtection, may as well turn on the Traffic Analyzer/Statistic. That will track usage by devices


Occasional Visitor
Traffic Analyzer is enabled and the Traffic Monitor is showing a steady 2MB of outgoing packets to the Wired network, but little activity over the WAN. The Traffic Analyzer Statistic tab shows 2GB of upload activity today for all clients today whereas vnStat shows 14+GB TX. How can I begin to reconcile this difference?


Senior Member
Sorry I missed this. I'd asked that all vnStat-on-Merlin be kept in the mega-thread and wasn't really looking.

The vnStat-on-Merlin app doesn't have the capacity to track individual devices. As @JR Godwin notes, AIP can give you that.

I'm not sure why TA/TM would show outgoing packets via wired but nothing leaving your intranet. But since vnStat-on-Merlin draws from the same underlying system that's why you'd get the report you're seeing with an excess of transmission.

FWIW, I've seen Apple devices which are backing-up spike the upload a various times, depending on their settings. Did AIP show anything? Are there wired Apple devices (or devices connected to a secondary AP or mesh node, which would also report as wired usage)?

You could also selectively unplug wired devices until you hit the culprit, or disconnect from a node/AP.


Occasional Visitor
Apologies if this was posted in the wrong section. I will search for that mega-thread next time there is a related issue. I do not have any Apple devices or Mesh nodes.

Suspecting the WIFI cams to be the culprit I took your advice of disabling them for testing. They were responsible for the TX traffic on the Wired network, with my workstation being plugged into the router. I would expect to see offsetting activity on the Wireless segment but it's practically flat. I suppose I'm still misinterpreting something but at least the activity is limited to the LAN.

TA Results.png

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!