From owner-freebsd-ipfw@FreeBSD.ORG Mon Mar 8 05:55:59 2004 Return-Path: Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7F4E116A4CE for ; Mon, 8 Mar 2004 05:55:59 -0800 (PST) Received: from duke.boxke.be (duke.boxke.be [62.213.198.10]) by mx1.FreeBSD.org (Postfix) with SMTP id 6F07C43D2F for ; Mon, 8 Mar 2004 05:55:58 -0800 (PST) (envelope-from jimmy@inet-solutions.be) Received: (qmail 8744 invoked from network); 8 Mar 2004 13:55:57 -0000 Received: from unknown (HELO webmail.boxke.be) (127.0.0.1) by duke.boxke.be with SMTP; 8 Mar 2004 13:55:57 -0000 Received: from 213.118.81.79 (SquirrelMail authenticated user postmaster@inet-solutions.be) by webmail.boxke.be with HTTP; Mon, 8 Mar 2004 14:55:57 +0100 (CET) Message-ID: <47557.213.118.81.79.1078754157.squirrel@webmail.boxke.be> Date: Mon, 8 Mar 2004 14:55:57 +0100 (CET) From: "Jimmy Scott" To: freebsd-ipfw@freebsd.org User-Agent: SquirrelMail/1.4.1 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 Importance: Normal Subject: ipfw counters (field 3) X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Mar 2004 13:55:59 -0000 Hello, Me and a friend of my are located in a datacenter on the same switch, We both have the same 3 rules, to count the traffic. Our ISP uses MRTG with the 95% rule to charge us, now i was wondering, i have 2MB traffic echt day, theire MRTG says 70MB i thought it was because of all the ARP traffic. But my friend counted 1,6944 GB traffic, while our ISP's MRTG points 2GB i've let crond mail me his results from 00:01 till 00:01, so these are both mails: 00010 11345045 1068348938 count ip from any to any via xl0 00011 6826150 466872667 count ip from any to any in recv xl0 00012 4518893 601476157 count ip from any to any out xmit xl0 00010 27743578 2887729820 count ip from any to any via xl0 00011 17168887 1405455507 count ip from any to any in recv xl0 00012 10574689 1482274199 count ip from any to any out xmit xl0 1) is there something except ARP that isn't counted here? i thought this is with IP headers inclusive. (we don't have any ESP traffic) 2) is it because of theire 95% rule? 3) is theire system absolutely not correct? in case of number 3, how can i prove it to my ISP, just normal ipfw logs and kernel ipfw counters won't do imho Thanks in advance Jimmy Scott