ipfw counters (field 3)

[Jimmy Scott]

Hello,

Me and a friend of my are located in a datacenter on the same switch,
We both have the same 3 rules, to count the traffic.

Our ISP uses MRTG with the 95% rule to charge us,
now i was wondering, i have 2MB traffic echt day, theire MRTG says 70MB
i thought it was because of all the ARP traffic.

But my friend counted 1,6944 GB traffic, while our ISP's MRTG points 2GB
i've let crond mail me his results from 00:01 till 00:01, so these are
both mails:

00010 11345045 1068348938 count ip from any to any via xl0
00011  6826150  466872667 count ip from any to any in recv xl0
00012  4518893  601476157 count ip from any to any out xmit xl0

00010 27743578 2887729820 count ip from any to any via xl0
00011 17168887 1405455507 count ip from any to any in recv xl0
00012 10574689 1482274199 count ip from any to any out xmit xl0

1) is there something except ARP that isn't counted here? i thought this
is with IP headers inclusive. (we don't have any ESP traffic)
2) is it because of theire 95% rule?
3) is theire system absolutely not correct?

in case of number 3, how can i prove it to my ISP, just normal ipfw logs
and kernel ipfw counters won't do imho


Thanks in advance


Jimmy Scott