How to correctly get bytes transmitted over virtual interface?

Question

Created Oct ’21

Replies 2

Boosts 0

Participants 2

Hi everyone,

I have been working on the VPN app and on of my tasks is to show data downloaded/uploaded for VPN connection. I took approach with sysctl based on this gist https://gist.github.com/mbbx6spp/6309854 The code from gist does not matter match as I check my network metrics with cli tool

netstat -ib -I <interface name>

Everything works fine for hardware interfaces en[0-9], and for uploaded data. The only problem that I need to solve is for virtual interfaces like utun or ipsec the download data in the statistics is being doubled or tripled. Speaking in more technical terms Ibytes is three times bigger than it should be.

I understand that VPN connection may have some size overheads from encryption, tcp, http, ssl protocols etc. But that should be no higher than 20% in my expectations.

It is better to reproduce this issue on macOS with build in IKEv2 protocol on macOs Big Sur.

Set up IKEv2 VPN connection
Get interface name. For example using netstat -rn. usually for IKEv2 the name is ipsec0
Get current stats: netstat -ib -I ipsec0
Download 100 MB file https://speed.hetzner.de/
Get stats again netstat -ib -I ipsec0

So, for IKEv2 protocol Ibytes shows 329024520 bytes(328 MB) instead of ~100 Same behaviour is for other protocols https://github.com/WireGuard/wireguard-go

Is there a good explanation for this behaviour? How to fix it? Is it ok just to divide by some coefficient obtained from practical tests(like 2 or 3) ?

Boost

Answer 1

Systems Engineer OP

Apple

Oct ’21

If you are using a custom built NEPacketTunnelProvider, then are you able to record the actual bytes being written to the virtual interface via NEPacketTunnelFlow?

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

0

Answer 2

serhii07 OP

Oct ’21

Matt, Thank you for the response. Unfortunately, I am not using custom NEPacketTunnelProvider.

0