@Ken_GlassWire, you haven’t responded to the specific issue raised by the ISP. Do you count everything at layer 3 of the OSI model?
I’m very interested because there are unresolved issues about counting as in the following topic. The answer might explain why so may users get different results than GlassWire but I haven’t pursued this because I don’t have to rely on the usage statistics 
. I wouldn’t be so relaxed if I did:
Here’s a diagram as an example of the significance of the question. When application data (layer 7) is transmitted it is encapsulated in a lower layer “packet” which has control information/data such as a header and sometimes a footer or trailer. As the diagram shows each layer adds more control data to the original application data which is normally called the payload.
The ISP doesn’t care what the data is so they treat all transmissions as bitstreams because they have no reason to separate control and payload data. In other words, the question is what is GlassWire actually counting?
Here’s another way of looking at it. The GlassWire Usage traffic suggests that you try to present all data at the application layer, layer 7. But do you count all control data down to layer 3? The Windows Filtering Platform (WPF) allows you to get to layer 2 (edit) but for Windows 8 and 10 only.
7 AD DS (/LDAP)
7 BOOTP
7 DHCP
7 DNS
7 HTTP
7 HTTPS
7 IMAP
7 POP3
7 SNMP
7 SSDP
5-7 NetBIOS
5-7 Teredo tunnelling