I've looked at the raw statistics and the differences are there; this is not a graphing error. I believe that the explanation is this:
Remember that encapsulating a packet makes it longer by the size of the added IP header, that is, by 20 bytes. The byte counts include the entire size of the packet, including all headers.
The outbound encap traffic packet count is slightly higher than the inbound that causes it because large incoming packets are fragmented into two packets after having grown in size by the addition of the second IPIP encapsulation header.
The byte count is significantly higher because the majority of the inbound traffic is connection requests i.e., packets that consist only of an IP and a UDP or TCP header, no data. Adding the IPIP header to this makes the packet significantly larger, increasing its byte count. - Brian
On Wed, May 17, 2017 at 08:25:26AM +0000, R P wrote:
May someone explain to me how the "Firewall: inbound raw vs outbound encapsulated traffic" show that the encap data is bigger then the raw input ? may i misunderstand something ?