How does Net Counter work? It's open source, which simplify the analysis. Nevertheless, the debug setting in the app revealed the key - rmnet0 and tiwlan0.
They can be found in the sysfs /sys/class/net/rmnet0 and /sys/class/net/tiwlan0 . Peeking inside shows a statistics directory with rx_bytes and tx_bytes that are received and transmitted bytes.
A simple verification by summing those values and comparing the app's output result in identical figure.
doMountVolume() -> vold <- /etc/vold.conf (for 2.1; 2.2 use /etc/vold.fstab)
References:
Gemini app manager
http://forum.xda-developers.com/showthread.php?t=1187672&page=2
http://www.linuxquestions.org/questions/linux-kernel-70/events-0-process-usage-441837/
http://code.google.com/p/android/issues/detail?id=16721