I'm getting a consistent disparity between the total bytes sent by Apache vs. the number of tx bytes reported by ifconfig. On one instance, httpd logs summed 1.7 GB delivered, while ifconfig tx bytes showed an increase of only 371MB. I realize the tx byte counters are 32-bits and wrap frequently but checking again on other days it's no different.

Compression by apache is also not the case. Also, adding just the 200 codes alone (certain deliveries) also add up to far more than what ifconfig reports. Taking snapshots of /proc/net/dev show the same as ifconfig. Any insight appreciated.

Oh, some info: CentOS 4.1, httpd 2.0.52, all traffic on eth0, nothing unusual.

Might Apache also be including byted through the loopback device?

Tx bytes on lo: are very low, that's not it either. I think Apache is correct because I can verify files sizes that were served. Tx bytes to the kernel obviously isn't the same as total bytes going out the nic. The question lingers.

Watching bytes counts for several days and seeing the same results, I've reached the conclusion that my server's output is being cached downstream.