I have looked at ip accounting and it seems that cli and web show different format.
cli
[admin@GV-FV155] /ip accounting snapshot> print
# SRC-ADDRESS DST-ADDRESS PACKETS BYTES SRC-USER DST-USER
0 80.213.17.136 10.10.10.50 4 784
1 10.10.10.129 91.186.72.70 5 431
2 10.10.10.129 210.48.139.85 1 40
3 10.10.10.129 91.186.72.90 1 189
4 10.10.10.32 37.247.52.130 1 40
5 37.247.52.130 10.10.10.32 1 40
6 210.48.139.85 10.10.10.129 1 40
7 91.186.72.90 10.10.10.129 2 229
8 91.186.72.70 10.10.10.129 5 3175
9 84.202.5.48 10.10.10.50 2 419
This has the format:
SRC-ADDRESS DST-ADDRESS PACKETS BYTES SRC-USER DST-USER
But look at the web data. http://10.10.10.1/accounting/ip.cgi
109.74.4.21 10.10.10.252 40 1 * *
10.10.10.132 81.167.35.123 52 1 * *
37.247.52.130 10.10.10.50 1866 9 * *
10.10.10.129 54.173.160.111 108 1 * *
91.186.72.71 10.10.10.129 485 2 * *
80.213.17.136 10.10.10.50 646 3 * *
81.167.35.123 10.10.10.132 104 1 * *
10.10.10.129 91.186.72.71 317 1 * *
54.173.160.111 10.10.10.129 40 1 * *
This format looks like
SRC-ADDRESS DST-ADDRESS BYTES PACKETS SRC-USER DST-USER
Why swap packets and bytes on web/cli?