Australia NBN satellite usage difference

I am finding that my ISP download figures are, on average, 20% higher than those reported by Glasswire. The ISP upload figures are, on average 200% higher!

I have finally received a response from my ISP which follows:

strong text"Please not that whilst Glasswire & Netwrox give you good information, they are not industry standard counters and dont operate at the layer we ( and all ISP’s
) count data at

We count data at the layer 3 level and include all headers in the count"strong text

I would be very grateful if you can comment on what they are saying here?

Kind Regards,


1 Like


Is your PC the only device connected to your satellite Internet? GlassWire only counts the data on the device it’s installed on.

We work hard to make sure GlassWire is accurate but maybe they are saying that your cable modem or router is somehow sending traffic on its own that GlassWire can’t see since it doesn’t interface with your router/modem directly.

I think 20% seems high though.

Thank you so much for the quick response. Glasswire is installed on all my devices and I have run Networx to check the results. My ISP initially told me that NBN was using prefetching behind the scenes to achieve the speeds we are getting on the satellite. This however was only verbal. The only written explanation of the difference is this “count data at layer level 3 and include all headers” Do you know what “layer level 3” is?
Thanks for the link. I will try the test.

Kind Regards,


BTW 20% i only an average. Some days it is nearly 50% and once I only downloaded about 400MB and got slugged for 2.5GB!!

@Ken_GlassWire, you haven’t responded to the specific issue raised by the ISP. Do you count everything at layer 3 of the OSI model?

I’m very interested because there are unresolved issues about counting as in the following topic. The answer might explain why so may users get different results than GlassWire but I haven’t pursued this because I don’t have to rely on the usage statistics :relaxed:. I wouldn’t be so relaxed if I did:

Here’s a diagram as an example of the significance of the question. When application data (layer 7) is transmitted it is encapsulated in a lower layer “packet” which has control information/data such as a header and sometimes a footer or trailer. As the diagram shows each layer adds more control data to the original application data which is normally called the payload.

The ISP doesn’t care what the data is so they treat all transmissions as bitstreams because they have no reason to separate control and payload data. In other words, the question is what is GlassWire actually counting?

Here’s another way of looking at it. The GlassWire Usage traffic suggests that you try to present all data at the application layer, layer 7. But do you count all control data down to layer 3? The Windows Filtering Platform (WPF) allows you to get to layer 2 (edit) but for Windows 8 and 10 only.
7 POP3
5-7 NetBIOS
5-7 Teredo tunnelling

The network layer model usually referred to is the OSI model. You can read about it on Wikipedia and many other sites. Here’s the link to the list of protocols and which layers they operate at. The layers start at the physical cables (layer 1) and go up to the application program you are running (layer 7). Layer 3, the Network layer, is most significant because it is the layer where routers do their heavy lifting getting your data into and out of the Internet.

1 Like

I’m also very interested in the answer to this question as Usage is one of major reasons that I started running Glasswire. My ISP (Verizon) applies heavy surcharges on data overage.

Like Remah, I also find Glasswire to be interesting and useful for security and other network functions, but I essentially abandoned the Usage information because I could not reconcile it to my ISP. Part of this is the fact that Glasswire only covers Windows PCs and trying to filter through Windows usage and other usage is much too time consuming. Of major import is that almost a year ago I changed to a new router (Netgear R7000) which provides traffic monitoring and precisely maps to the Verizon reports.

At this point, I do watch Glasswire Usage for significant impacts, but I’m not dependent on it at all. When Android support is added to Glasswire, that will do much to elevate my interest in the Usage info – especially now that an Android app (Spotify) is a significant part of my data use.

So knowing how Glasswire handles the Network Layer 3 is important to my understanding how Glasswire relates to the other tools available for network management.

This is just me speaking, not GlassWire, but if I understand correctly layer 3 requires access to the router or behind and GlassWire only sees the data on your PC currently.

You’re correct that we are working hard on an Android version, then we hope to add full network monitoring in the future!

1 Like

Very good point – thanks for waking me up! :slight_smile:

And yes, I think Glasswire development has a nice full plate!

I don’t know enough about WFP but WFP can get to MAC address level which is layer 2 so I’d expect layer 3 to be possible too. The limitation might be that Windows 8 or higher is required to get more complete filtering.