IP Accounting beside ipchains/netfilter

Hi list, caused by ppp-connections that come up und down regulary my firewall-rules get flushed each time a connection is established or disconnected. So i cant use the result of ip[chains|table] properly, because flushing rules deletes traffic data for packages like ipac, too. Any other suggestion for tools that analyze traffic for accounting [e.g. iptraf counts fine but the seem to no logs] ? thx in advance Michael ok, a little bit OT, but i know you've got the answer