Output of nettop command

Question

I want to calculate net transfer of bytes(in & out) for every 2 seconds.

I'm using nettop to know the usage(bytes_in and bytes_out).

Command:

nettop -x -k state -k interface -k rx_dupe -k rx_ooo -k re-tx -k rtt_avg -k rcvsize -k tx_win -k tc_class -k tc_mgt -k cc_algo -k P -k C -k R -k W -l 1 -t wifi -t wired

Taking bytes_in bytes_out according to application summary.

1Q). The data(bytes_in and bytes_out) displayed is calculated from startup for every application. Am I right?

I thought I'm right and ran the nettop command two times with 2 seconds interval and subtracted these two values to get the net transfer of bytes for 2 seconds.

But sometimes, the first output is greater than second output.

2Q). How is that possible? Always the second output must be greater or equal to first output right?

OS: macOS Sierra.

Answer 1

It would make sense if the statistics were "calculated from startup for every application" but this doesn't appear to be the case. Confusingly, nettop maintains running totals since it started so you can get this data by starting a nettop session at the same time the application being observed is started but this is not really practical for most use cases.

It's notable that the Network tab in Activity Monitor behaves in the same way (totals are from when it starts, not the application being observed) since the underlying operating system service is the same for both Activity Monitor and nettop.