Ok so you can see what those values are in the RRD update script /var/db/rrd/updaterrd.sh, specifically:
pfctl_si_out="` /sbin/pfctl -si > /tmp/pfctl_si_out `"
pfctl_ss_out="` /sbin/pfctl -ss > /tmp/pfctl_ss_out`"
pfrate="` cat /tmp/pfctl_si_out | egrep "inserts|removals" | awk '{ pfrate = $3 + pfrate } {print pfrate}'|tail -1 `"
pfstates="` cat /tmp/pfctl_ss_out | egrep -v "<\-.*?<\-|\->.*?\->" | wc -l|sed 's/ //g'`"
pfnat="` cat /tmp/pfctl_ss_out | egrep '<\-.*?<\-|\->.*?\->' | wc -l|sed 's/ //g' `"
srcip="` cat /tmp/pfctl_ss_out | egrep -v '<\-.*?<\-|\->.*?\->' | grep '\->' | awk '{print $3}' | awk -F: '{print $1}' | sort -u|wc -l|sed 's/ //g' `"
dstip="` cat /tmp/pfctl_ss_out | egrep -v '<\-.*?<\-|\->.*?\->' | grep '<\-' | awk '{print $3}' | awk -F: '{print $1}' | sort -u|wc -l|sed 's/ //g' `"
So that looks like the number of unique source IPs on outgoing states. If you only have a single WAN and you're NATing out of it that's probably going to be 1.
And the number of unique destination IPs on incoming states. A lot higher since that includes all the external IPs on states
opened on LAN by clients.
Looking at the output there though it looks like there may be room for improvement. It doesn't handle IPv6 addresses and counts blank lines.
Steve
