WOW, i have a big day thanks to Jonh:-) ..i think im very close to per IP
accounting. Now i can open dump.php page and i see there this:

50077  118   51856 queue 4 ip from any to any out via rl1
50078    0       0 queue 8 icmp from any to any in via rl1
50079 1912 2194317 queue 8 ip from any to 1.1.1.8 in via rl1

..to be honnest i was waiting somethings else :-) This page show
m0n0/status.php#ipfw%20show. But its easier to parse dump.php than whole
status.php. Probably that was the reason why to creare dump.php.

First col. is num. of rule, second are bytes passed with that rule and third
are packets ? ...im i correct?

THANKS VERY MUCH FOR HELP!

pet.