In fact, the component does not consume traffic. The component checks it while passing it through itself. It processes as much traffic as is generated by the applications that have accessed the Internet and the data that has been received/sent over the network.
Technically, it looks like this:
To check traffic, the anti-virus installs its Internet traffic filters in the protected system and presents itself as a proxy. This filter must be the very first one so that malware cannot process the traffic before it does. For example, in order to conceal that it is transferring data. Third-party monitoring systems also install similar counting filters, but they process traffic after the anti-virus filter because such filters always work consistently. That's why the dwnetfilter process will always be seen as the main consumer of traffic.
On its own initiative, the dwnetfilter component does not connect to the Internet, it only intercepts connections from other applications.
To exclude the false effect that the dwnetfilter component is consuming traffic, you need to exclude it from your traffic control program, if this option is available. It makes no sense to track application traffic separately or their total traffic via the proxy (dwnetfilter).
