sar show werid pakages status

[zziawan]

hi, sar show a very strange network packages status occasionally. The package number is very very larger. but tcpdum files shows only thounds packages a sceond. can some give a clue? thanks!
command: sar -n DEV 1 | grep bond0
sysstat version: sysstat-10.1.5-17.el7.x86_64
kernel version: 4.14.0-115.7.1.el7a.x86_64

[sysstat]

Maybe the counters are going backward?
Please send me a saDD binary datafile (usually contained in /var/log/sa/ directory) with such weird values so that I can examine its contents and confirm the problem.
Also upgrade your sysstat version if possible: It is really old!

[zziawan]

@sysstat thinks! we will update it. we want to kown if it is a fake data . i send the binary file to you by email(sysstat [at] orange.fr). thank you !