The bandwith monitoring on this thing looks so cool ... but I am a bit confused (and concerned) so I decided to run a little test last night At 3am I disconnected all devices off my network except one computer I shutdown almost everything I could think of on my computer (killed a bunch of processes, etc) I logged onto router (Tomato 1.04.0944) The device list shows vlan1 and br0 (one computer and the router are the only items on the the network). I closed all my "open" ports I got the stats from the Bandwidth displays I ran windump on the network adapter on the PC (windows xp SP2) I went to bed At 9am I logged onto router (Tomato 1.04.0944) The device list shows vlan1 and br0 (one computer and the router are the only items on the network). I got the stats from the Bandwidth displays Windump indicates I got a block of Udp packets every hour (see the attached file) and that was it The bandwidth results from Tomato are: Comments / Questions/ Concerns / Suggestions From last 5 hours inbound average ... 35.5kbps by 5hrs by 3600 sec/hr yields 78 MB (8 bits/byte, 1024kbits/megabit) but the The Bandwith Daily Page indicated 90.85 MB downloaded. Where did the other ~12MB go? How do I find out who/what/where is bombing my router with 90MB of data in a 5 hour period? ... which if I have read this correctly, does not appear to be making it through the firewall The Bandwidth Daily/Monthly appears to show the total data that hits the router before the firewall ... would it not be just (or more) useful to show the data that actually got downloaded through the firewall to the switch/wireless?