On Monday 10 November 2003 11:34 pm, Simon Kitching wrote: > On Tue, 2003-11-11 at 12:21, Antony Stone wrote: > > On Monday 10 November 2003 10:25 pm, Marc Lucke wrote: > > > Antony - my thanks to you. I rather suspected your answer would be > > > true. My problem is that I am getting very large differences in the > > > usage I track using iptables and the usage that my ISP reports. > > > iptables reports much more traffic - up to 12% in fact. I have checked > > > with the ISP who say they too only count layer 3 IP. > > > > 12% is a lot, and the fact that you think you have 12% more traffic than > > your ISP does is more strange than if it were the other way around. > > What about traffic from your host back to itself? That should go via interface lo, not via eth0. > For example, GNOME heavily uses the ORBIT corba server, which uses > TCP/IP to communicate between interacting applications. > > Maybe you could add a separate rule for traffic from 127.0.0.1 and to > your local host address back to the local machine, to measure that? The routing table entry for 127.0.0.0/8 should send all this traffic via the loopback interface - this should not be counted by anything looking at the ethernet devices. Antony. -- In science, one tries to tell people in such a way as to be understood by everyone something that no-one ever knew before. In poetry, it is the exact opposite. - Paul Dirac Please reply to the list; please don't CC me.