I run tcpdump on a usb modem in network card mode.[   18.260000] cdc_ncm 1-1.1:1.1 wwan0: register 'cdc_ncm' at usb-ehci-platform-1.1, Mobile Broadband Network Device, 0c:5b:8f:27:9a:64I run it for several minutes and also run ifconfig before and after to see the counters difference.{    sh -c '    fn1() {        date        echo $1        ifconfig wwan0        echo    } >&2    fn1 before    tcpdump -i wwan0 -w - &    sleep 600    kill $!    wait    fn1 after    ' >day3.pcap} 2>&1 | tee day3.txtResult:Sun Jul 26 13:37:32 AST 2015before...          RX packets:45568603 errors:0 dropped:0 overruns:0 frame:0          TX packets:42531282 errors:0 dropped:0 overruns:0 carrier:0          collisions:0 txqueuelen:1000           RX bytes:1843669466 (1.7 GiB)  TX bytes:2947749207 (2.7 GiB)tcpdump: listening on wwan0, link-type EN10MB (Ethernet), capture size 65535 bytes44788 packets captured44802 packets received by filter0 packets dropped by kernelSun Jul 26 13:47:32 AST 2015after...          RX packets:45585747 errors:0 dropped:0 overruns:0 frame:0          TX packets:42558941 errors:0 dropped:0 overruns:0 carrier:0          collisions:0 txqueuelen:1000           RX bytes:1845868782 (1.7 GiB)  TX bytes:3158560778 (2.9 GiB)packets: 42558941 + 45585747 - 42531282 - 45568603 = 44803bytes: 1845868782 + 3158560778 - 1843669466 - 2947749207 = 213 010 887As you can see the packets number is almost the same.day3.pcap is only 12Mb in size$ tshark -r day3.pcap -z io,stat,0,SUM(frame.len)frame.len | tail -5|                |1         |     || Interval       |    SUM   |     ||---------------------------|     ||   0.0 <> 599.6 | 12087649 |     |===================================Why does ifconfig show a difference of 200Mb? 213010887 / 44803 = 4754. What? MTU is only 1500
pcap file 20 times smaller than ifconfig TX/RX difference for same period
linux;openwrt;tcpdump;modem