Why I coded WatchWAN

I needed an utility that would give me an ACCURATE account of my Broadband Internet usage.
That is to say, if it reports that I have downloaded 200 MB of data, then ideally my ISP should also report that I have actually downloaded 200MB of data.
Not one MB more, not one MB less.

Now we must understand that this is practically an impossible task.
The reason being that while it is possible to keep an eye on the data that flows between my machine and the ADSL router (or modem. I will use the two terms interchangeably) which links me to my ISP, the actual traffic that is being billed by the ISP is that which flows over the telephone line between the ADSL router and the ISP.
This traffic is usually carried over PPPoE protocol the overhead of which increases the size of the data that is being transferred by anywhere between 5% to 10%.

There is no easy way to measure that actual traffic (perhaps querying the router using SNMP would be the answer), but one can ATLEAST accurately measure the traffic that flows between my machine and the router.
In this case, the calculated usage figure would be a few percent LESS than what the ISP will bill me for.
I can live with that.

Unfortunately, available utilities like DU Meter and Netmeter do a lousy job in doing even this.
In fact they have been reported to show the usage as being 100% MORE than what the ISP calculated.

Here is what people are discussing on broadband forums..

	Posted by:fearless
	Posted: Mon Aug 01, 2005 7:06 am
	Post subject: DU Meter shows WRONG download/upload values. Why???


	if u don't believe me, activate the stopwatch in du meter,
	download something for say 15 min(or surf for an hour),
	now check the amount of data downloaded in the 'service records' section
	(in the bsnl login site after u have logged into ur acount).
	PRESTO the 'data flow' for that particular time is about only 2/3
	of the value shown in DU Meter.
	Why does DU Meter show higher values.........Whyyyyyyyyyy?

	Posted by:paurna
	Posted: Tue Jan 31, 2006 10:51 pm
	Post subject: Re: DU Meter shows WRONG download/upload values. Why???


	well last month du meter showed my usage as double the actual usage.
	hence i decided to remove it.morover i felt that it didnt serve any purpose.

Reporting the usage as less than what the ISP shows is understandable. But MORE!?
Clearly, there is something wrong with the way DU Meter is calculating the usage.

I tried to find the reasons behind the inaccuracy, and this led me into coding this utility of my own which tries to rectify some of the faults and thus be as accurate as possible in calculating my actual Internet usage.

I found that the major reason for DU Meter and Netmeter giving incorrect figures is this:

The traffic that flows to and fro from your machine consists of packets that are going in appropriate directions.
This includes packets that are coming from or going towards the Internet and also packets that belong to the local network and will never cross over to the Internet.
Since we are interested in calculating Internet usage, the only packets we should take into consideration are those that are either bound towards the ISP or are coming to us from that direction.

You may well think, that if we have a single machine that is connected to an ADSL router, ALL the packets coming to or going from our machine will be those that are meant for the Internet.
This is not correct. A lot of traffic is being generated between your machine and the router (which itself has a full fledged TCP/IP stack, and is a bonafide member of your network of TWO computers (your machine and the router (modem) itself)).
Not all of this traffic crosses over to the Internet.

For example (and people familiar with networking will already be knowing this) Broadcast packets do not cross the router. ARP packets are broadcasted frequently. IGMP packets of netbios ports 137, 138 form a good bulk of your total traffic. None of these are meant for the Internet.
And this scenario is when we have a single computer connected to the router.
In cases where many computers are networked, you can well imagine the amount of traffic generated.

If you want to see this for yourself, start DU Meter and keep it running without using the Internet at all. After a couple of hours you will see what I am hitting at.

Which explains the reason why DU Meter and Netmeter are inaccurate.
Both make no distinction between traffic that is meant for the local network and the traffic that is routed over to the Internet. They take ALL these packets in their calculations.
No wonder they show MORE than what the ISP shows.

And how does WatchWAN rectify this problem?

WatchWAN uses WinPcap packet capture library, the same library that is used by Ethereal and other popular sniffers.
It actually sniffs all the packets passing by and passing through our machine.
It examines the IP address and MAC addresses of these packets and ignores all that should not be taken into usage calculation.

However, this requires a little help from you.

In the "Settings" dialogbox, there is a "Filter" textbox.
You have to enter the MAC address (physical address) and the IP address of your ADSL router here.

The filter takes the form of this string:
ether host 00:0F:A3:54:35:05 and not host

The first red text is the MAC address (physical address of your ADSL router).
It is unique for every router. You will have to find the MAC address of your ADSL modem.
The second highlighted text is the internal (private) IP address of your ADSL modem. Typically it is though it can be anything else.
You have to find these two pieces of information and set them here.
You are usually provided by an administrative utility by your ISP to administrate the modem. Use it to get these addresses.

NEW!   (8 June 06)
I have been receiving emails from people finding it difficult to determine the IP address or the MAC address of their routers.
I realize this procedure should not have required user intervention and should have been done in an automated manner. But that will have to wait for the next version.
As a stop gap measure for the time being, I have coded a quick-n-dirty little utility which tries to find the IP address as well as the MAC address of the router. However it requires Windows 2000 or later.
You can get it from here.

Make sure you set this filter to get as accurate a result from WatchWAN as possible.
You can use WatchWAN without setting this filter, but in that case the usage it reports will not be entirely correct.