From owner-freebsd-questions@FreeBSD.ORG  Wed Nov  7 01:39:58 2007
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 8967716A419
	for <freebsd-questions@freebsd.org>;
	Wed,  7 Nov 2007 01:39:58 +0000 (UTC)
	(envelope-from ecrist@secure-computing.net)
Received: from snipe.secure-computing.net (snipe.secure-computing.net
	[209.240.66.149])
	by mx1.freebsd.org (Postfix) with ESMTP id 5856013C4AA
	for <freebsd-questions@freebsd.org>;
	Wed,  7 Nov 2007 01:39:55 +0000 (UTC)
	(envelope-from ecrist@secure-computing.net)
Received: from [192.168.1.200] (unknown [209.240.66.157])
	(using TLSv1 with cipher AES128-SHA (128/128 bits))
	(No client certificate requested)
	(Authenticated sender: ecrist@secure-computing.net)
	by snipe.secure-computing.net (Postfix) with ESMTP id CEC4817043
	for <freebsd-questions@freebsd.org>;
	Tue,  6 Nov 2007 19:39:41 -0600 (CST)
Message-Id: <5172CBDE-31B3-4AE6-863A-679C960DC2AC@secure-computing.net>
From: Eric F Crist <ecrist@secure-computing.net>
To: User Questions <freebsd-questions@freebsd.org>
Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Apple Message framework v912)
Date: Tue, 6 Nov 2007 19:39:40 -0600
X-Mailer: Apple Mail (2.912)
Subject: IPFW show format question...
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 07 Nov 2007 01:39:58 -0000

So, everything I've read says that ipfw show displays rule number,  
packets caught, bytes matched, and rule.  The problem I'm having is  
that it seems that the bytes, at least on some rules, is way out of  
whack.  I'm capturing this data for cacti, and trying to display  
accumulated ipfw traffic.

If I zero my counters and download a file via FTP, the downloaded  
sizes don't even compare.  61MB into the download, if I convert the  
ipfw show from the supposed bytes into MB, it says I've downloaded  
155MB.

Please help me understand this!

Thanks!
-----
Eric F Crist
Secure Computing Networks