Accuracy of packet counting?

Accuracy of packet counting?

[John Holman]

I would be grateful for expert opinion on a simple matter:

I am trying to reconcile the traffic charges of my ISP with my own
counts.  
I have a plain 1500/256 bridged ADSL connection (i.e. no connection
software or overhead) to eth0 on a lightly-loaded web/mail server.

My traffic counter is simply this:

#iptables -L -n -v -x
Chain INPUT (policy ACCEPT 21095 packets, 2640498 bytes)
    pkts      bytes target     prot opt in     out    
source               destination         
    9639  1817610 ACCOUNTING  all  --  eth0   *      
0.0.0.0/0            0.0.0.0/0          

Chain FORWARD (policy ACCEPT 629 packets, 262264 bytes)
    pkts      bytes target     prot opt in     out    
source               destination         

Chain OUTPUT (policy ACCEPT 20654 packets, 5383330 bytes)
    pkts      bytes target     prot opt in     out    
source               destination         
    9957  4391462 ACCOUNTING  all  --  *      eth0   
0.0.0.0/0            0.0.0.0/0          

Chain ACCOUNTING (2 references)
    pkts      bytes target     prot opt in     out    
source               destination         
   19596  6209072 RETURN     all  --  *      *      
0.0.0.0/0            0.0.0.0/0

My question:

Is there ANY reason to suppose that the ACCOUNTING total is not an
accurate count of all IP traffic into and out of eth0?

(The machine is a dual-Pentium Pro Linux box, daily traffic 20-30 MB
average, ifconfig never reports any dropped packets).

TIA, 

-- 
Best regards,
John Holman
Eastax WWW
Melbourne, Australia

Re: Accuracy of packet counting?

[John Holman]

Harald Welte wrote:
> 
> On Fri, May 17, 2002 at 08:39:39AM +1000, John Holman wrote:
> > My question:
> >
> > Is there ANY reason to suppose that the ACCOUNTING total is not an
> > accurate count of all IP traffic into and out of eth0?
> 
> yes, since you only count locally-generated and locally-targeted traffic,
> not the traffic forwarded by your machine.
> 
> use your accounting rules in the mangle table (PREROUTING and POSTROUTING)
> to cover all traffic.
> 


Thank you for that, Harald, it was a RTFM problem :(

[I eventually managed to work out the reason for the discrepancies
byself, by checking against a detailed traffic report supplied by my
ISP.]

-- 
Best regards,
John Holman
Eastax WWW
Melbourne, Australia