I have one more question: how many log entries from italian IPs were discarded? Were they more than in other countries? In Italy, 13 % of broadband users are Fastweb customers. Fastweb uses NATs so that each Fastweb IP is normally used by hundreds of users. Moreover, Fastweb customers are often internet heavy-users. Hence, if you exclude all IPs logged twice you could exclude all Fastweb users (i.e. at least 13 % of italian broadband traffic)...
Nemo