Thanks much! ...but pfflowd is tremendous overkill for my situation (where I just want to collect a few arbitrary traffic stats for a dozen IPs at most). Nor do I have a second box to devote to stats collection, nor the ability to parse Cisco Netflow data (which is what pfflowd outputs).
I'd really love it if someone had an answer to the original question (again, how to zero out the statistics counters without nuking the anchor entirely).
