I see that in your screenshot the Top Endpoints resource shows approximately two times more traffic then Top Protocols resource. I understand your concerns about correctness of displayed data but this is actually expected results. Each packet going trough router has its source and destination (means two endpoints are involved in the communication), but just one protocol is used – so this is the reason why you can see such a difference (for comparable results use Top Transmitters or Top Receivers resource).
Shouldn't only one endpoint be involved per flow since I have "ingress" selected and not "both"? Or am I not understanding something?