It appears that Glasswire might be double counting upload bandwidth for connections which use DNS that resolve to multiple IPs. I use NetLimiter to limit iTunes’ upload rate to 150KB up, but Glasswire is showing double that amount since the DNS that Apple uses resolves to multiple IPs. Is anyone else noticing this? (I would have included example images, but this forum disallows it. I grudgingly understand, however.)
I haven’t observed that because I’ve never noticed the DNS resolver affecting download traffic counts…
… but I’m not 100% certain I understand what the situation is with your DNS query:
- Apple DNS servers which are configured for anycast so they have many DNS servers with different IP addresses?
- The FQDN has several A records, which means several different IP addresses, and two or more of these IP addresses are being returned by the DNS server?
- DNS resolver on your Apple device sends multiple queries, i.e. sends a DNS query to a secondary DNS server before the primary DNS server has failed to respond in a timely manner?
- Or something else?
FYI, new users (trust level 0) in Discourse-based forums have limited abilities although I thought that one clipboard image could be pasted into a post by a new user. Normally, all it takes is 10 minutes reading in the forum to gain the normal capabilities:
1 Like
Hi Remah,
Thanks for the reply- I do realize this is a little confusing- I’ll try and post examples of what I mean. This is an example of the upload rate limit I have enabled for iTunes- 150KB up 
.
When I first took these pictures, the IP in the NetLimiter photo matched the IP that was shown in GlassWire- but at any rate, you can see that it is uploading on two separate connections to the same IP over 2 TLS connections (both limited to 75KB each, 150KB total). In fact, (although I did not capture my entire network usage) 150KB was my entire network upload usage at that moment.
1 Like
Contrast that with what GlassWire is showing (300KB, one for each IP, although they are both going to the same DNS content server).
So what I’m saying is that GlassWire appears to be counting both IPs in the bandwidth calculation (300KB), although the total upload bandwidth used by the entire process is only 150KB.
Also, thank you for the information on Discourse. I do completely understand limiting new users, I was just somewhat miffed that it did not tell me there would be hyperlink restrictions until after I’d attempted to submit my topic (not as I was creating it).
1 Like
Speed is the amount of traffic per second.
The app you use limits the amount of bytes that can be downloaded or uploaded per 1 second. GlassWire shows the amount of data for X seconds, minutes, hours or even days. This depends on the selected time interval.
GlassWire does not double the traffic amount, it just shows the amount for a longer time period than 1 second.
1 Like
Hi Ken,
Thanks for the reply. I understand what you are saying about time intervals- I guess what I don’t understand then, is what the graph measures. Is the graph not an example of a measure over time per the selected time interval? In the pictures I’ve shared above, over the interval of five minutes, you can see a constant (plateau versus a spike) of 300KB outgoing. In the GlassWire mini viewer numbers displayed (which I took to be real-time numbers) they also showed 320KB upload (160 x 2 for both IPs shown).
As another example, at the point in time which I’ve selected (by clicking at the bar- Jan 20 7:19 AM) does this not select the amount of I/O traffic at that particular time (7:19AM)? And if it shows multiple outgoing connections (as I’ve shown above) each half of the collective value (160 x 2 in this case), would a user not take that to mean the total outgoing value is a sum of its parts?
You’re saying it doesn’t “double count” the values- but if I look at a value over 1 second, and it shows double what my network traffic can possibly be doing, then what otherwise is it showing? I could understand if it showed me a total value of 160KB up, and then I saw two individual IPs both showing 160KB each. I would take this to mean that multiple simultaneous connections are in a pool, each sharing the bandwidth. But showing me 300KBs total is confusing me.
I appreciate the responses- none of this is meant to be argumentative, just trying to understand better myself.
Does this article help explain?
Hi Ken,
Thank you for the article. The post actually tends to confirm my suspicions. I cut out this section in particular as an example.
This section seems to explain that if you click on a particular point, that it will tell you the data usage at that particular point you selected (why they’re using a data usage spike to further demonstrate that). As I’ve shown in my pictures above, I’ve done this- and it’s not a spike, it’s a plateau, as in, GlassWire is showing a constant 300KB up. When I click on a particular point, as shown in my pictures, it shows 321.9KB upload rate in both images. Can I take it to mean that is what GlassWire has calculated? If so, that is not correct, and it is double counting.
Thank you again for the responses.
Could you take another screenshot like Glasswire Double Counting Upload Traffic then spread the sliders apart (the two round icons under the graph) so they are all the way apart (one pulled fully to the left, with one pulled fully to the right) while you have chosen “5 minutes” as the graph time?
Sure, it might take me some time to respond however, as I have to find a good chunk of audio (not on iTunes’ servers) to upload, so I can effectively recreate the conditions.
Thank you. If you go back in time to the time period you showed before, but then just changed the sliders to show a different time period (with the sliders spread out) it should also allow you to do the same.
So it is not related to DNS at all as we are talking about download acceleration in iTunes. That makes a lot more sense, thankfully. 
It is normal to accelerate downloads by using multiple sources - download managers and torrent clients do this all the time. I just haven’t observed more than one stream from the same IP address.
If I have time I might see if I can force the same behavior in a generic download manager.
Download manager definition
A download manager is a computer program dedicated to the task of downloading possibly unrelated stand-alone files from the Internet for storage. Some download managers can also be used to accelerate download speeds by downloading from multiple sources at once. Although web browsers may have download managers incorporated as a feature, they are differentiated by the fact that they do not prioritize accurate, complete and unbroken downloads of information. While some download managers are independent programs that can download any data over one or more protocols, many are integrated into installers or update managers and used to download parts of a specific program; examples of the latter include Google's and Adobe's update managers.Hi Remah,
It’s actually not related to downloading at all- this is in relation to uploading. Thanks for the reply though.
1 Like
Thanks for that. I should have read it more slowly. 
The same principles apply so I’m probably going to see if downloading with multiple connections to the same server has the any issue.
Sorry, I realize that was a brusque reply. Thanks for the help 
Hi Ken,
I apologize for the long delay- going back in time did not appear to produce repeatable results, so it required that I have a good amount of data to send to iTunes’ servers. Here is an updated screenshot of Glasswire under 5 minutes with sliders fully extended.
Here is the same data screenshot with the slider set to 1 minute
Again, NetLimiter is set to 150KB/s. The first screenshot is showing that at the point I’ve selected 4.4MB has been uploaded.
According to the article you posted above, the graph shows 7MB has been uploaded over 5 minutes (7MB = 7,000KB/600s = ~11.6KB/s(?)). This math doesn’t seem to equate for me and doesn’t seem to explain why I see 300KB upload in my mini-viewer.
Any additional help or explanation would be appreciated.