12 Jan
2003
12 Jan
'03
10:12 p.m.
On Sat, 11 Jan 2003, Sitaram Chamarty wrote:
My observations are that if I stay online (without actually surfing) for more than 2-3 hours, this difference is quite noticeable. "ifconfig eth0" (which shows IP *plus* non-IP traffic, as opposed to iptables' input chain, which shows only IP traffic) is closer to what they claim is my "usage", and using tcpdump I realise that the difference is the constant stream of ARP traffic (amounting to about 300-500 KB/hour!)
Check your firewall configuration, misconfigured firewalls can generate unwanted ARP packets. Don't know about your double counting problem though.
Best regards, Rajesh
--