This is a question we get from time to time. The answer is pretty simple:
QuotaGuard logs both your requests and passed-through bandwidth.
For the SOCKS bandwidth, we're simply measuring the bandwidth going through the SOCKS proxy.
Since most SOCKS connections are long lived, we log every time 1MB is reached, then any remaining balance that is left when the connection is closed gets attached to the RESPONSE log entry.
For example, if you consume 3.5MB in a single connection you should see:
REQUEST - 0 bytes
BANDWIDTH - 1MB
BANDWIDTH - 1MB
BANDWIDTH - 1MB
RESPONSE - 0.5MB
Hopefully that helps clear up the question "How are you measuring "SOCKS BANDWIDTH" in the logs?"
If not, send us more questions at Support so we can answer them for you.