DU Meter does its traffic volume calculations on IP layer (IP headers and anything above it are included, anything below them don’t). IP is OSI layer 3. This is consistent with how most other software operates and it’s what is expected by most users (ISP traffic accounting works on IP level for example).
Note that it is very important to select correct network adapters in DU Meter, especially when you have multi-homed system or when virtual network adapters exist (otherwise VPN traffic could be calculated twice, for example, first on the VPN interface and then second time encapsulated on the real interface).
Moreover, networks are always lossy to some extent, so when measuring on two points you will never get exactly the same byte counts to the last byte: some traffic is lost due to physical errors on physical layer, some is dropped by the intermediate switches, routers and firewalls. However, our methodology is sound and agrees to generally accepted practices used by other reputable traffic accounting software vendors, so you should see comparable results.