Host traffic report data ~1/2 expected rate

[Codelica]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Describe the bug

Traffic report host data seems to be ~ 1/2 the expected rate. In this example I have a VPN interface (VPN_eC_IOT - purple) which just has a 6Mbps inbound video stream to a client on the LAN. As you can see the purple inbound VPN rate graph at the top does show the 6Mbps stream, however the hosts graphs show 3Mbps streams from the VPN and to the LAN client which seem incorrect unless I'm missing something(?).

To Reproduce

Setup a substantial data stream between hosts on two networks (with negligible other activity) and compare the network graph for the networks and the hosts.

Expected behavior

Without other host network activity, the host network stats should roughly equal the network stats.

Describe alternatives you considered

That I'm overlooking something very simple -- sorry if that's the case!

Screenshots

Relevant log files

Can pull some if needed.

Additional context

N/A.

Environment

OPNsense 24.1.6-amd64
Intel(R) Celeron(R) J4125 CPU @ 2.00GHz (4 cores, 4 threads)
4 x Intel 2.5GbE I226-V

[Codelica]

I decided to setup a controlled example you can replicate. Over a quiet network connection I setup a listener on one side via:

nc -lk 8000 > /dev/null

And a source to feed it random data at ~2Mbps (244 kibibytes/s for pv):

dd if=/dev/urandom bs=1000 count=100000000 | pv -L 244k | nc my-test-host 8000

As you can see the network graph correctly shows ~2Mbps, while the host graph shows the corresponding host at only ~1Mbps:

[AdSchellevis]

The top hosts are sampled (each 2 seconds) using iftop and only the top 10 is collected if I'm not mistaken, which might explain differences here.

core/src/opnsense/scripts/interfaces/traffic_top.py

Lines 45 to 48 in 030ed19

	sp = subprocess.run(
	['/usr/local/sbin/iftop', '-nNb', '-i', interface, '-s', '2', '-t'],
	capture_output=True, text=True, timeout=10
	)