Is the sql server overloaded?
It may be worth getting a pcap and diags and opening a support case.
Are you sure your comparing apples to apples?
Custom "bytes transmitted/received" I got approximately 5.1 GB.
Custom Netflow report with "ingress" selected. got 2.85 GB.
Pretty sure... I'm downloading the raw SNMP data and summing the values in the "received" column in order to distinguish between transmit and receive.
I currently have a ticket open on this; awaiting further info.