DirectAdmin only shows what is logged.
This includes:
- apache
- proftpd
- DA usage/backups, etc.
- smtp traffic to email accounts that exist, and output smtp.
 
Spam email, email to non-existant domains/addresses, dns, mysql bandwidth, pop/imap, and any traffic done that is not in the above isn't logged by DirectAdmin.
Example, file updates, pings, traceroutes, etc.. DirectAdmin can't track.
 
The port traffic will always be higher than what DirectAdmin can see.