psutil system-wide counters and Scapy interface-specific packet capture are different measurements, so their totals may not match. Bandwidth threshold alerts are indicators for review, not proof of an ...