Wrong no. of bytes with cipe and accounting tables

To count my traffic I setup some accounting rules that are called by the
input- and output rules CHECKIN and CHECKOUT. The accounting rules look
like:

Chain ACC_cipcb2_INPUT (1 references)
 pkts bytes target     prot opt in     out     source               destination
  106 58467 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ACC_cipcb2_OUTPUT (1 references)
 pkts bytes target     prot opt in     out     source               destination
   83  6236 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ACC_ppp0_INPUT (1 references)
 pkts bytes target     prot opt in     out     source               destination
  113 64380 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
      ^^^^^ looks ok (>58467)

Chain ACC_ppp0_OUTPUT (1 references)
 pkts bytes target     prot opt in     out     source               destination
    7   988 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
        ^^^ cannot be ok because it's less than 6236!

Since the cipcb2 traffic goes out through ppp0 I don't understand why
both traffic and packet count of ppp0 is less than the values of cipcb2.
But only in the output chains. The values of the input chains look good.

That's how the accounting rules are inserted as first rules in the
chains:

Chain CHECKOUT (1 references)
 pkts bytes target     prot opt in     out     source               destination
 9071 1116K ACC_ppp0_OUTPUT  all  --  *      ppp0    0.0.0.0/0            0.0.0.0/0
 5409 1511K ACC_cipcb2_OUTPUT  all  --  *      cipcb2  0.0.0.0/0            0.0.0.0/0
 [...]

Chain CHECKIN (1 references)
 pkts bytes target     prot opt in     out     source               destination
18539 8203K ACC_ppp0_INPUT  all  --  ppp0   *       0.0.0.0/0            0.0.0.0/0
 6118 3433K ACC_cipcb2_INPUT  all  --  cipcb2 *       0.0.0.0/0            0.0.0.0/0
 [...]


How can ppp0's counters be less than cipcb2's counter? Does CIPE
compress packets and puts several of them together in a single packet?

--
Message sent by the [email protected] mailing list.
Unsubscribe: mail [email protected], "unsubscribe cipe-l" in body
Other commands available with "help" in body to the same address.
CIPE info and list archive: <URL:http://sites.inka.de/~bigred/devel/cipe.html>