Traffic is the combined download+upload rate, sampled every device-monitor tick. Thresholds are edge-triggered — one alert when crossed, one when it recovers.