I am trying to determine my in/out traffic and not able to fully understand the netstat counters while using bridging.

Setup is a normal 1 Bridge created (BR0) using port ETH0. Also I have an LXC container with a port of BR0-MINE1.

As ETH0, when using a bridge, has no IP address, I assumed that ETH0 would have no activity and only activity on the two interfaces with IP addresses (BR0 and BR0-MINE1). Or if it did, it would be the sum of all bridged interfaces, but it is not. So I am confused as to what traffic is on BR0 vs ETH0. BR0-MINE is fine as it matches the traffic within the LXC container using lxc-info.

netstat - I (after 4 hours)
Iface RX-OK TX-OK
br0 2662201 1445566
eth0 27252094 54437414
br0-mine1 47359837 23705765

brctl show
bridge name bridge id STP enabled interfaces
br0 8000.003048db12f2 no eth0

br0-mine1
Thank you in advance for any replies.
---Garrett

Easiest way to see what's there is to run tcpdump. You'll see lots of non IP traffic.

Thanks I spent a few hours analyzing tcpdump results and doing some tests like sending streams to each IP. The strange thing is, all traffic that goes to the LXC container is present on all interfaces for example:

BR0 IP = x.x.x.110
BR0-MINE1 IP = x.x.x.115
ETH0 - NO IP assigned (as it is the port for BR0)

HTTP to port 91 (port 91 was setup in apache just so I could test with no other noise)
tcpdump -i BR0 port 91
tcpdump -i BR0-mine1 port 91
tcpdump -i eth0 port 91

all three returned the same results and captured my http get requests on ip x.x.x.115. No traffic was shown for x.x.x.110 as port 91 is not open nor any requests to the IP/PORT pair.

With this behavior I would assume all traffic to the container would be captured on both eth0 and BR0, but looking at my first post that is not true.

What I am trying to capture is total network traffic per interface to see my bandwidth in each container total usage of all virtual/real interfaces. I just do not understand the values shown.

You should capture all traffic on three interfaces, br0, br0-mine1 and eth0 instead of on port91. You should see different. Another one, br0-mine1 is LXC container, you do tcpdump on host or guest machine?