Culvert VPNReading a VPN connect screen: down, up, session, exit IP
Down and up are tunnel throughput, session is time since the tunnel came up, and the exit IP is the address sites see; here is what each one tells you.
A VPN connect screen usually shows four numbers, and each answers a different question. Down and up are how much data is moving through the tunnel right now, in each direction. Session is how long the current tunnel has been up. The exit IP is the address websites see when you are connected, and on a well-built app it is the address the provider's own server observed through the tunnel, not the one the app hoped to use. Read together, they tell you whether the VPN is working, whether it is fast, and whether it has been quietly reconnecting.
Down and up
These are throughput: the rate of data arriving through the tunnel and leaving through it, usually in kilobytes or megabytes per second, sampled every second or so. They measure the tunnel, not the phone as a whole, so an app you have excluded from the VPN does not appear in them.
When you are doing nothing, both should sit near zero with small flickers from background sync. When you open a page or start a video, down should jump; during a call or an upload, up should. The number that matters most for diagnosis is a zero that should not be there: if you are loading a page and down stays at zero, the tunnel is up and carrying nothing, which is the classic connected but no internet state.
The numbers are also the honest speed test. A speed test app reports what it managed to move in a burst; the throughput readout shows what is actually flowing while you use the phone, on this network, through this server. If it is much lower on one Wi-Fi than on mobile data with the same server, the network is the difference, and the usual reason is that the Wi-Fi filters UDP and the app has fallen back to a slower TCP-based method.
Throughput is not latency. A tunnel can move a lot of data and still feel sluggish if the server is far away, which is why the city rows show a round-trip time rather than a speed.
Session
Session is the time since the current tunnel was established. It is not the time since you tapped connect if the tunnel has been rebuilt since then, and that is the point of showing it.
A session timer that keeps resetting to zero on a network that has not changed means the tunnel is being torn down and rebuilt, and the app is hiding the disconnects from you by reconnecting quickly. On Android the usual cause is battery optimisation or a manufacturer task killer stopping the service when the screen is off. A reset on walking from Wi-Fi to mobile data is expected.
Sessions also end by design. Free tiers limit how long a session lasts, and a well-run service puts a hard ceiling on every session, typically a day, so that per-session keys are replaced. When either limit is reached, the app starts a new session and the timer starts again; the session expiry post explains why that is a feature rather than a fault. Reconnecting is always allowed.
Exit IP
The exit IP is the address the rest of the internet sees for you while connected: the address of the server your traffic leaves from, shared with everyone else on that server. It is the single most important line on the screen, because it is the one that proves the tunnel is doing its job.
How the app got that address matters. The right way is to send a request through the tunnel to a server the provider runs and ask what address it saw. That proves traffic flows and names the real exit. The wrong ways are to print the address from the server's configuration, which is a label that reads the same whether the tunnel works or not, or to load a third-party "what is my IP" page, which tells that page's owner that a user behind this exit just checked. The exit IP explainer covers what the address is and why the source matters.
There is a moment to look for on connect: the tunnel comes up and the address is absent or marked as checking, then it appears. If it never appears, the tunnel is up but nothing is getting through, and the app is telling you so by not filling in the gap.
Latency and load on the city rows
Most connect screens also lead to a picker, and its rows carry two more numbers worth reading properly. Latency should be a round trip measured from your phone to that city, in milliseconds, not a signal-bar glyph that means nothing in particular. Load or headroom should be a real figure for how busy the city's servers are. Distance sets the floor on latency, load sets how much of the server's capacity is left for you, and either one can make a nearby city the wrong choice; the server load post goes into the trade-off.
What is not on a good connect screen
A protocol name. The method the app used to get through this network is its business, and it can change mid-session when the network changes, so a label for it is either meaningless or already wrong. Signal bars, for the same reason. And a "protected" badge with nothing measured behind it: the verified exit IP is the protection indicator, and it is a number rather than a colour.
Reading it as a checklist
| Reading | Meaning |
|---|---|
| Down and up both zero while you load a page | Tunnel up, nothing flowing; reconnect or switch networks |
| Down high, exit IP present | Working |
| Exit IP never appears | Tunnel not carrying traffic |
| Session keeps resetting on stable Wi-Fi | App being stopped in the background |
| Session reset once, then stable | Free session or daily ceiling reached, new session started |
| Throughput fine on data, poor on this Wi-Fi | Network filtering; the app fell back to a slower method |
Culvert VPN's connect screen shows exactly these: live down and up throughput, session time, and your IP address verified through the tunnel by asking its own server; it is on Google Play.
Questions people also ask
Why is the download number moving when I am not doing anything?
Apps sync in the background, so mail, chat, photo backup and app updates all move data. A few kilobytes per second at idle is normal. Sustained high throughput at idle is worth a look in the phone's data usage screen to see which app it is.
Why does the session timer reset on its own?
The tunnel was re-established. That happens when the network changed, the phone slept and reconnected, or the session reached its time limit and the app started a new one. Frequent resets on a stable network point to battery optimisation stopping the app.
The exit IP shows but the city next to it looks wrong. Which is right?
The address. The app's city name comes from the server it chose; a city name on an outside lookup page comes from a database that lags behind address changes by weeks. Trust the address and the app's own label.