DirectAdmin monitors both, but only the services that it can monitor.. those services installed by DA that have per-user logging. Other programs that run "behind the scenes" or that do no have any user association with it's logs are not counted. Things like wget calls, socket calls within php scripts... spam, pop/imap are also not logged (dovecot doesn't have per-user bytes logging that I'm aware of).
In any case, the true device traffic will always behigher than the traffic logged in DA.
John