It happence because of different level of accounting. (l2,l3,l4)
we performet test in laboratory.
scheme (router FTP server) <--> MA5200G <--> FTP client
also му made port mirroring on interface on router
send: 95176 bytes
in lam file: 103472 bytes
on port: 105220 bytes
Totaly were send 186 packets.
Size of tcp packet = 512, т.е. 512*186= 95232 (very close to 95176, that means the same that FTP server calculated).
IP size = 552, 552*186=102672 (close to 103472 in billing lam file)
Size of Ethernet frame = 566, 566*186=105276 (close to calculation on port)
So according to rezults of test we can say that on port statistics we see information about l2 ethernet frames.
In billing lam file we see information about l3 ip packets and on ftp server we see information of tcp packets.
Subscriber sends information in tcp packets and provider should mines ip header length from information in lam file.
Whan we implement scheme with QoS, billing file includ information (calculate) droped packets, so value of send and calculated in lam file information is different not only on size of ip packet, but it also different on size of dropped packets.
More information please see attachment!