"Ignore Local Traffic" with "All Connections" only option for auto-start in user account

After installing 5.2.7 (not portable) in Vista x64, I'm seeing the same problem as had w/ the portable NW using WinPCap. Unless NW is started once in admin mode, AFTER a reboot, OR unless log into an ADMIN ACCT, it doesn't show the options that include "Ignore Local Traffic" in monitored interfaces drop box.

If choose Load With Windows & select my wired Intel nw card that shows option to Ignore Local Traffic, then after reboot & NW auto starts in std user acct, displays an X on tray icon, because the option I'd chosen (& one for MS Tunnel Interface) is NOT shown.

I thought that was a problem only w/ the portable vers, that used WinPCap - seems that's not true.
Don't know how others are using NW - if those wanting to Ignore Local Traffic AND using ANY option other than All Connections, are logging into admin accts or manually start NW in admin mode, once logged into std user acct?

I'm NOT an expert about all the interfaces that could be monitored. Perhaps / probably I don't understand differences in monitoring say, my Intel ntwk card w/ that shows "Ignore Local Traffic" VS. the All Connections option WITH box checked, on Main UI for "Ignore All Traffic?"

1) Seems if I want NW to start w/ Windows AND use Ignore Local Traffic, the ONLY option I can choose - that doesn't require starting NW in admin mode / or doesn't require starting Windows in admin acct, is Monitor "All Connections." Correct me if wrong.

In fact, if in monitored interfaces drop box, select ANY option other than All Connections, then check Ignore Local Traffic box on Main tab UI, it immediately changes the monitored interfaces box selection (from any option chosen) to "All Connections," AND then grays out that box. So if check the box "Ignore Local Traffic," no other options are available.

2) But if select a monitoring interface option - that contains Ignore Local Traffic plus "Load On Windows Startup" - (but don't check box for "Ignore Local Traffic), then the option(s) just mentioned AREN'T available / not shown, when start Windows in std user acct.

3) So appears, there's no way to auto start NW w/ Windows in std user acct AND have Ignore Local Traffic work on any monitoring option EXCEPT "All Connections?" Is that correct? The All Connections option, plus Ignore Local Traffic box checked, may meet my needs (or not), but what about others?

Doesn't that severely limit the flexibility of running multiple instances, while using Ignore Local Traffic AND loading NW on Windows Startup in a std user acct?

I'm guessing the same thing would happen if I used "Monitor My Router..." - it wouldn't work if loaded NW on Windows Startup - in a std user acct. Perhaps if select (ANY) options (other than All Connections) that require running in admin mode & select to load NW on Windows startup, then NW should be programmed to display a UAC pop up?

Perhaps also adding / clarifying in Help, the requirements & limitations of choosing certain monitoring options & need to start Windows in admin acct or need to start NW in admin mode, for certain options to be available?

Thanks.

Did more checking & made screens.
1) If installed version is simply "auto started" w/ Windows - WHETHER in a user or admin acct, there are NO options in monitored interface drop box, shown w/ "Ignore Local Traffic". Period. No matter what else I check / uncheck.

2) If have NW auto start & select one of interfaces from drop box (say, Intel Gigabit card), and THEN check the box on main UI for "Ignore Local Traffic," NW immediately changes my selection in drop box to All Connections, & grays it out so no changes can be made to the interface.

When NW is started this way, it changes ANY selection in the drop box to All Connections & grays it out, once box for Ignore Local Traffic is checked. Period.

3) If installed NW is manually started w/ admin privileges from context, THEN it shows 2 options in interfaces drop box, that DO have "Ignore Local Traffic."

4) If manually start NW in Admin mode, am able to see & select options in drop box that contain "Ignore Local Traffic," & check Load When Windows starts, after reboot into EITHER an Admin or User acct, NW isn't able to "find" or display the interface selected, in the process before reboot.

The monitored interface selection box is then blank & tray icon has large 'X' over it. At this point, ONLY option to ignore local traffic is to check that box on main tab & NW immediately changes monitored interface to "All Connections" (& grays it out).

Conclusion: for me, there appears to be no way to have NW load w/ Windows (Vista) AND have ANY selection along with "Ignore Local Traffic" option (in ANY fashion) - EXCEPT the All Connections interface option.
Is it not possible to have installed NW auto start AND Ignore Local Traffic - for any selection OTHER than All Connections?

And I don't know if using the All Connections option always gives desired results. I don't think it should be the ONLY option available, that allows Ignoring Local Traffic.

Additional screens.

It is hard to tell what's happening in your system. We also don't have MS Vista for tests due to its insignificant market share.

Now, if we install WinPCap latest version (allowing it to start automatically) and NetWorx, it all works correctly without administrative privileges or elevation. Here I have opened NetWorx settings after a reboot:



As to why the interface selection changes to All Connections, you might have noticed that it becomes disabled. This is because NetWorx's own traffic filtering driver operates at a higher level (called TDI) than WinPCap does (called NDIS). Here is a diagram illustrating this:



Now, at the TDI level there is no "network adapter/interface" as such, since routing is done at a lower level. In other words, a choice of network interface is meaningless when the Ignore LAN traffic checkbox it ticked.

Thanks for details. I may see part of the problem - Networx wasn't tested on Vista.

Quote

Andrew

a choice of network interface is meaningless when the Ignore LAN traffic checkbox it ticked.

That may be true - & explain ONE of the scenarios where NW doesn't work as intended for me. But I also tried it just like your screen & it doesn't work on reboot.

Which version of Windows is your screen of NW settings UI from? If NW wasn't tested on Vista, you might want to put an asterisk by it on the "Supported Platforms" on d/l page.

Obviously, something different about how the Vista security / privileges works is causing even the installed NW not to "retain" a setting I choose (similar to your screen, where "Ignore Local Traffic... Intel Pro/100" is selected & the box, "Ignore local traffic" is left unchecked). Or Vista's not allowing NW to restart after boot, & use that setting / drivers, etc., unless NW is started in Admin mode.

In fact, as said - after choosing an interface VERY similar to your screen (& leaving the Ignore local traffic box UNchecked), on reboot in either Admin or User acct (tried both), the interface selections showing the Ignore Local Traffic are NO longer shown. In that case, the interface selection box is then blank.

But starting NW manually in Admin mode brings back those options. So, it's a problem (most likely) w/ the way NW is programmed vs how Vista's privileges system works.
I've run into similar situations before & read countless issues about similar situations. The fact that once I manually start NW in Admin mode & suddenly the "missing options" are back, tells me either Vista doesn't want NW to access certain drivers w/o elevated privileges, etc., or NW isn't written to correctly access them in Vista.

Often, apps needing to access certain drivers / files in Vista, have to be run w/ elevated privileges (thus, me starting NW manually in Admin mode brings up the "missing" options), where that may not be true for other OSes. I'm not saying that's definitely the case here, but I've seen & read about it many times.

Bottom line - since it's not likely you'll try to figure out what's going on w/ Vista x64 & NW, the remaining question is (assuming I don't want to manually start NW every time), what does the All Connections (using NW's own filtering driver, if I understand) AND checking the Ignore Local Traffic box actually measure? Since that is the only one that works automatically - after reboots, & if I have only one network adapter (on desktop), will that do the same as if I could choose the actual adapter name w/ the "Ignore Local Traffic" tag attached?

Only other thing is, will this All Connection setting prevent synching another install of NW on the laptop w/ the one (using All Connections) on the desktop? But, the laptop is Vista 32bit, so I doubt it will start w/ Windows with anything other than All Connections setting, either. If that'll do the job, even though it's wireless adapter - great.

I can create scheduled tasks to start NW at boot, but it'll require manual PW input in a UAC window.

I could easily flash 3rd party firmware on my router, but given what we've discovered / discussed, I'm skeptical that the monitor router option would work any better after reboots, than most other options do now.

When All Connections is selected NetWorx merely queries the number of received and sent bytes on all available adapters and sums it all app. Generally it's not recommended to use this option as it likely to include virtual adapters that you don't want to monitor. This could double or triple the usage or otherwise give incorrect readings.

When the Ignore LAN checkbox is ticked, as I said the selected interface no longer matters. In this case any non-local traffic from applications will be recorded.

Simple solution: install NetWorx and tick the Ignore LAN checkbox. Then download a file of the known size to check NetWorx's readings. That's all. No need to mess around with WinPCap and privileges. It does not interfere with synchronisation either.

Hi Andrew,

Perhaps making this the default config for new installs would help. Most folks only want internet traffic.
The same would apply for the portable version.

Then for those interested in monitoring traffic within the LAN, and excluding the internet, there could be another check box for "Monitor LAN traffic" although it would be nice to have this option ignore the constant ARP, etc. traffic. automatically.

However, I still want to monitor my router, so that would have to be a third option

J

box - Monitor internet traffic
box - Monitor LAN traffic (excluding ARP, IGMP, etc.)
link - Monitor my router (which 'unchecks' the two previous boxes)

Thanks Andrew,
I followed your suggestion to d/l a file of known size (that's a subj. unto itself).
Got the reading of current hour's d/l in usage rpt before began d/l of Password Safe.
http://sourceforge.net/projects/passwordsafe/files/passwordsafe/3.30/ _ pwsafe-3.30-bin.zip, which is listed as 12.7 MB on Sourceforge.

Explorer shows the file as 12.1 MB (& bytes of 12,716,328 bytes / 1024^2 = 12.13 MiB).
After the d/l, usage rpt showed an increase of 12.78 MB. I have NW multiplier set at kibi (1024) & volume unit at automatic.

My understanding was Explorer really displays the unit "MB" (10^3), even though actual values are MiB (2^20). Not sure if that's accurate. But, the 12,716,328 bytes would convert to 12.1 MiB, would they not?

So, not quite sure why NW is showing 12.78 (MiB) was d/l vs Explorer's size of 12.1 MB (MiB?) or 12,716,328 bytes. Nothing else was d/l during the same time, AFAIK. No auto updates, no email at that time, no AV updates. Nothing near the size of the difference in the two values. Maybe I'm mistaken about Explorer or how NW uses the multiplier. I thought it was pretty straight forward, but maybe I'm wrong.

If I'm not wrong about the d/l file's byte value shown in Explorer & converting it to MiB (& assuming that's what NW is also doing), there's too large of a discrepancy - if NW was only monitoring the internet traffic.

BTW, if set multiplier in NW to 1024 kibi, shouldn't the graph units show KiB or MiB instead of just 'k' or 'M' ?

Also, I'm a bit confused about usage rpt's units. When I have multiplier set = 1024, it still shows KB & MB in the total columns.

The difference may be caused by what's called protocol overhead or the fact that there was actually some background traffic.

It also seems that SF thinks there is 10000000 bytes in a megabyte. In either case, it's not guaranteed you will get a reading matching your ISP's records. Up to a 10% difference is normal.

You're right - I wasn't even thinking of overhead in terms of data size.
Since my one test showed a difference of ~ 5.36% larger data measured by NW than actual file size, that's not much. Total protocol overhead including headers, dropped packets & all other sources could easily be more than that, according to what I've read.

When I need to d/l another larger file, I'll measure it again - making sure all other possible sources for internet traffic are shut down.

SpeedMeter is good for checking a specific download.

Open it
Stop it if necessary
Clear it
Start it
do your download
stop it

Look at the download value which s/b close to what was downloaded.
The uploaded is all the ACKs
Obviously the total is greater than what the site says is the download size of 12.7MB

Yes, but is Speedmeter using the exact same method to measure transferred data size as NW uses - WHEN I'm using the NW option of checking the "ignore local traffic" box on settings Main UI page, AND monitored interface box is grayed out - showing All Connections?

If NW & Speed meter use 2 diff methods, unless while using the NW settings above, they are known to still give same results, it might not be a valid comparison for NW & Speedmeter's values. (perhaps close, but...)

All Praxis is suggestingis the SpeedMeter may be easier to measure the speed or volume as you can reset/restart it anytime. Obviously it uses the same method as other components of NetWorx.

I don't mean to be rude but why don't you just do it and look at the results?

The totals are exactly the same IF you have had some traffic and then wait a minute after a period of no traffic activity for the Graph totals to 'catch up' to SpeedMeter.

Your focus seems to be on imagining problems that don't exist rather than implementing what's been suggested.

Here's how...
- log off the internet so there's zero traffic while you do the next steps
- open NW Settings > Graph and make sure the Type is set to "Session traffic" if the Graph shows traffic for today. Otherwise, if you haven't had any activity today you can leave the Graph Type is set to "Daily traffic".
- open NW Settings > Hidden Settings and make sure that the option to "Auto-start speed meter" is set to true. This is so SM will be running after a reboot.
- open SM and clear the totals (if there were any)

- reboot

- log on to the internet, browse or download something, you'll see the SM totals are updated in 'real-time' and appear to be higher than the NW Graph because the totals on the Graph aren't updated in 'real-time'
- then stop browsing and log off the internet so there's no more activity
- wait about a minute and you'll see that the graph totals get updated and are equal to the SM totals.

Now that you know that SM and NW Graph totals agree, use SM to measure a specific download and you'll see that the download total is 'almost' the same as the claimed size and final size on disk but - yes but - SM may measure slightly higher if there was a re-transmission of some of the data. SM doesn't measure what the download traffic is supposed to be, it measures the actual traffic, including retransmissions. The "Sent" is about 6-10% of the Received total, depending on line quality, packet sizes, etc.

J

Simma' Down, Now, Praxis. Sim - Uh - Down... Now - Saturday Night Live.

Again, thanks to you both for the help & suggestions.

I believe you - but remember, I've spent much time on problems w/ NW (& MANY other apps) & how they do / don't work w/ Vista - esp. w/ Vista's often irritating privileges. For certain things, NW doesn't work in Vista the same as other OSes. I just haven't had time to try your method or use Speed meter.

I just asked a question on whether the NW monitor (using the settings I must use - IF... I want it to start w/ Windows) & Speed meter use the same measuring methods, that Andrew answered. That's all. No criticizing or complaining about that. I appreciate your detailed steps - very useful, but don't be a hater.

It may be obvious to some that they function identically, but AFAIK no documentation on that. I've made assumptions about ALL sorts of things, that most anyone w/ some critical thinking skill would assume ("it's so logical, how could it not be true?", that turned out to defy logic. That's partly why bug reports exist.

Then let us know after you've done the work,

J

Team,
I love this little app and appreciate the work gone into it,

We are using it on our home network to assist with determining which of our 5 teenagers is gobbling our bandwidth and how much! The problem is that one of them has a Vista machine, we installed NW on it however at Win start-up various pop ups etc appear about privileges etc, Press OK to start etc...

Obviously our 16 yo teenager is not keen for this.

Is there a workaround so it'll start in the background?

Works great on our Win& and XP machines

Any assistance appreciated.

Gman

Having raised 3 kids, have you considered water boarding?

For Vista, because of its UAC, if an app wants to access certain files / processes, it forces a request to enter an admin acct PW - if running in a user acct, or give consent if running in an admin acct.

The only sure way around it for something like NW (I know of) is to disable Vista's UAC. I don't know that I'd suggest that w/ teens at the wheel. Certain prgms, like AV / FW do need full system access, but don't require UAC input when they start. I'm not an expert on this, but I assume it's the way the developer writes them. Maybe Andrew or others can explain that.

The way I got around not having to give consent for NW to load when it starts w/ Vista is check the box on Main tab, "Ignore local traffic w/in the LAN." NW is using its own filter then, which allows it to start & not need an admin PW or approval . It depends on the computer & its hardware, but more than likely, that setting will monitor all internet traffic & ignore all local traffic on the machine or your home network.

But, as a seasoned parent, who ever is using the most might just turn off NW. Or, it could be all of them combined.
How much bandwidth do you have & how many are on the net at one time? You may have to implement a schedule where they're not all on at once.

I'm guessing there are also ways or software, to throttle the max bandwidth a machine can use. Maybe it can be done through a router GUI or other ways. If you want to explore that & don't get a good idea here, try posting on DSLreports.com (probably in the Broadband Tech forum) or on Neowin.net - probably in "Internet, Network & Security."