Why is there still traffic in device live throughput, even if the device has internet blocked?

Live throughput on the device detail page in the Firewalla app actually counts every packet that comes from or goes to the device. If the internet is blocked, the device may still send and receive packets.

Here are some examples:

1. Device is talking to another local device and the local device is responding to it. Local traffic will not be blocked by the internet block rule.
2. Device is sending/receiving multicast traffic that are only propagating in the local network, e.g., mDNS, SSDP.
3. Device is trying to send packets to external IPs. For TCP, box will simply block it by sending back a TCP packet with RST flag set. For UDP and ICMP, it will be silently dropped by the box. In both cases, the packets that the device sends and receives are taken into account in the live throughput.