The final count of bytes and packets in an accounting stop message may be less than the number of packets/bytes exchanged during the session if there were multiple accounting stops during the session. Accounting stops are triggered during a call for any number of different reasons such as dormancy, airlink parameter changes, PPP restarts, and intra/inter-pdsn handoffs. Some of this behavior is controlled in the aaa group via "radius accounting rp" settings.
Each time an accounting stop message is triggered, the accounting session ends and a new one will be started with a zero count. The values for a given attribute from each of the accounting stops should add up to the total for the session, which you can also view with "show subscriber full" and the "CALL STATS" displayed at the end of a session with monitor subscriber.
Here is an example of this where there is an accounting stop in the middle of the session due to airlink parmaeter changes. So the respective values from both accounting stop messages need to be added together to get the total for the session.
<<<<OUTBOUND 09:08:51:028 Eventid:24901(6)
RADIUS ACCOUNTING Tx PDU, from 10.50.180.12:24448 to 192.147.213.166:1646 (660) PDU-dict=starent-vsa1-835
Code: 4 (Accounting-Request)
Id: 1
Acct-Status-Type = Start
Acct-Session-Id = 0E40B2FB
<<<<OUTBOUND 09:10:57:749 Eventid:24901(6)
RADIUS ACCOUNTING Tx PDU, from 10.50.180.12:24448 to 192.147.213.166:1646 (840) PDU-dict=starent-vsa1-835
Code: 4 (Accounting-Request)
Id: 2
Acct-Status-Type = Stop
Acct-Session-Id = 0E40B2FB
Acct-Input-Packets = 2673
Acct-Output-Packets = 3943
Acct-Session-Time = 127
SN1-Disconnect-Reason = active-start-param-change
Acct-Input-Octets = 126131
Acct-Output-Octets = 5364755
<<<<OUTBOUND 09:10:57:750 Eventid:24901(6)
RADIUS ACCOUNTING Tx PDU, from 10.50.180.12:24448 to 192.147.213.166:1646 (660) PDU-dict=starent-vsa1-835
Code: 4 (Accounting-Request)
Id: 3
Acct-Status-Type = Start
Acct-Session-Id = 0E0578DD <====== New accounting session
<<<<OUTBOUND 09:12:06:883 Eventid:24901(6)
RADIUS ACCOUNTING Tx PDU, from 10.50.180.12:24448 to 192.147.213.166:1646 (840) PDU-dict=starent-vsa1-835
Code: 4 (Accounting-Request)
Id: 4
Acct-Status-Type = Stop
Acct-Session-Id = 0E0578DD
Acct-Input-Packets = 2558
Acct-Output-Packets = 3926
Acct-Session-Time = 69
SN1-Disconnect-Reason = MIP-remote-dereg
Acct-Input-Octets = 117552
Acct-Output-Octets = 5412116
Add the values from the respective attributes and you get fairly close to the session CALL STATs below. For session time, note the difference in the timestamps of the accounting start/stop messages from above.
Acct-Input-Packets: 2673 + 2558 = 5231
Acct-Output-Packets: 3943 + 3926 = 7869
Acct-Input-Octets: 126131 + 117552 = 243683
Acct-Input-Octets: 5364755 + 5412116 = 10776871
Acct-Session-Time: 127 + 69 = 196 seconds
***CONTROL*** 09:12:06:912 Eventid:10285
CALL STATS: <2898381122@mip.msn.com>, msid <000002898381122>, Call-Duration(sec): 195
input pkts: 5234 output pkts: 7876
input bytes: 243954 output bytes: 10777332
Imported from Starent Networks Knowledgebase Article # 10960
