Hi Chris > I'm trying my best to compare apples with apples. I can allow > for a few megs difference....but at the moment I'm out by gigs. >
1.4Gb is a very large discrepency, but if you really want to compare 'apples to apples' then you need to measure the raw bits coming to your external interface. More than likely your ISP is either measuring your usage by either using the counters on the router interface or by polling their router for SNMP data. To have a measurement that you can truly use as a comparison you'd need to do the same thing, maybe using MRTG or RRDTool to query your external interface and build a database of the numbers of raw bits entering/leaving the network. You can still use your other tools to give stats on bytes per protocol etc, but having a raw bit count as a comparison to your ISP bill makes more sense, as that's how they charge you. > Squid is only handling tcp requests. Its aparrently > downloaded approx. 750megs for internal workstations, but if > I query the database for all packets (tcp, udp, icmp, etc) > and add their length up, the total only comes to not even 500 megs. > > So if the isp claims we have downloaded 2.2gigs, squid sais > we have received 750megs of web traffic, that leaves 1.4gigs > unaccounted for. Have you asked your ISP how they gather their usage data? If they use the router's interface counters for reference then they could be incorrect figures if the router has reloaded during the accounting period, resetting the counter (resetting the counters to zero can lead some accounting scripts to believe that the counter has rolled over) Maybe you need to have your ISP confirm their figures? Just a thought Cheers Michael -- SLUG - Sydney Linux User's Group - http://slug.org.au/ More Info: http://lists.slug.org.au/listinfo/slug
