Router or firewall traffic is being monitored in the wrong direction

Monitor (span, mirror) the traffic going to the firewall or router. On Cisco switches, this means you need to specify Tx. On HP and 3Com switches, you need to specify Egress.

To log bytes sent and received, set both Tx and Rx (Cisco) or both Egress and Ingress (HP, 3Com).