[cobalt-users] [raq4] Site usage statistics and real traffic differ extremely

[Rainer Hofmeister <rh@xxxxxxxxxx>]

I have a leased Raq4 sitting at a provider. I get billed for the traffic 
the machine produces. The "Total Usage" statistic under "Site Usage" 
shows a monthly traffic of approximately 6.5 GByte constantly every 
month. The provider statistiscs (Ethernet traffic) is over 18(!) GBytes 
one month and around 8 GByte (normal) the other.

The provider tells me that this difference is most likely caused by 
"ICMP packets and cancelled downloads which don't appear in the Raq 
statistics". Well, the difference looks like a lot of ICMP packets and 
cancelled downloads especially when the heavy load appears on certain 
days and is always about the same amount (2 GByte/day).

I have looked into the secure log and there seems nothing wrong. I have 
looked into the http log and I can't find anything special 
(unfortunately I get over 100,000 hits a day and the log is pretty big). 
I have run Analog over the http log to see if a file is requested often 
or if one IP address is constantly requesting something but this seems 
normal, too.

My question is:
Is it true that cancelled downloads (http/ftp) are not counted by the 
Raq statistic?
How can I find out what exactly generates this traffic?

I'm a little lost at the moment since I never had this problem and I 
don't know where to start.

Best regards,
Rainer Hofmeister