In some mail I received from Berndt Josef Wulf, sie wrote
> 
> G'day,
> 
> ipfstat returns the number of packets being matched by the
> ipf.rules. My question: What is the size of those packets?
> 
> I want to use ipf in view to double check the ISP's volume charge on
> my feedline. For this I have enabled the following rule:
> 
> pass in log on ppp0 proto tcp/udp from any to any
> 
> ipfstat -hi gives me the following output for this rule:
> 
> 4196 pass in log on ppp0 proto tcp/udp from any to any
> ^^^^
>    These are, AFAIK, the number of packets counted for this rule, but 
>    it doesn't give me the absolute size as in
> 
>    	4196 * packet-size = x bytes
> 
> Are there other packages around which may be better suited for 
> general accounting?

You might want to try:

count in on ppp0 proto tcp/udp all

to get both packet and byte counts.  More recent code will log the
number of bytes & packets when state/NAT information expires within
IP Filter (for NAT, this will be in the next release).

Darren