pmacctd monitor incoming traffic mismatch

bgp_agent.map

bgp_ip=127.0.0.1 ip=0.0.0.0/0

inbound.map

! voxility, cogent, retn, bucharest-interlan
set_tag=1  filter='ether src host 00:01:e8:8b:50:59'
set_tag=2  filter='ether src host 40:ce:24:2e:a2:60'
set_tag=3  filter='ether src host 9c:cc:83:83:f7:c1'
set_tag=4  filter='ether src host 00:06:f6:d1:79:7f'

pmacctd.conf

daemonize: true
pidfile: /var/run/pmacctd.pid
syslog: daemon

pre_tag_map: /etc/pmacct/inbound.map
pcap_interface: bond4
pcap_interface: ens1f0

! aggregate: tag, src_as, dst_host

plugins: mysql[in], mysql[out]
! print_refresh_time: 10
! print_output: formatted

aggregate[in]: tag, src_mac, dst_host
aggregate[out]: tag, dst_mac, src_host

aggregate_filter[in]: ether dst host 00:15:2c:18:ac:00
aggregate_filter[out]: ether src host 00:15:2c:18:ac:00

sql_refresh_time: 600
sql_history: 24h
! sql_table: acct_v4_%Y_%m
sql_table[in]: inbound_v4_%Y_%m
sql_table[out]: outbound_v4_%Y_%m
! sql_table_schema: /usr/share/pmacct/sql/pmacct-create-db_v9.mysql
sql_table_schema[in]: /etc/pmacct/pmacct-create-db_v9.mysql
sql_table_schema[out]: /etc/pmacct/pmacct-create-db_v9-outbound.mysql
sql_table_version: 9
! sql_table_type : bgp
sql_optimize_clauses: true

sql_host: XXX
sql_port: 3306
sql_db: XXX
sql_user: XXX
sql_passwd: XXX

! bgp_daemon: true
! bgp_daemon_ip: 127.0.0.2
! bgp_daemon_as: 60602
! bgp_daemon_port: 179
! bgp_agent_map: /etc/pmacct/bgp_agent.map
! pmacctd_as: bgp

sql requests.sql

SELECT tag, round(sum(bytes)/1024/1024, 2) as mBytes, as_src, stamp_inserted, stamp_updated 
FROM `acct_v4_2021_02` group by tag, as_src, stamp_inserted ORDER BY `mBytes` DESC