net-acct relies on the interface name to learn about the framing. This
works well usually, but not in setups where the NETLINK feature to
rename an interface is being used. We routinely rename the interfaces
so that their name shows the characterisation of the interface rather
than the network technology. For example, unt0 might be the name for
the first interface connected to an untrusted network, and int2 could
be the third interface in the system connected to an internal network.
Both interfaces could be ethernet, or token ring.
tcpdump does properly handle this, so I suspect there is some other
way to learn which network technology and which framing an interface
is using.
Greetings
Marc