Hello Nasr,

if IP addresses of spokes are not dynamic you can use some tools for this:

a Policy-map with one class for each tunnel

for IPSec only tunnel:

define traffic class as ipsec traffic between local and remote public ip address

for IPSEC+GRE tunnel:

again define traffic class as IPsec traffic flow between local public ip address and remote public ip address

you need to know if you use AH or only ESP to define ACLs

access-list 111 permit ah host local-ip host remote-ip1

ESP only , no AH header:

access-list 112 permit esp host local-ip host remote-ip2

this depends on transformation sets.

It is highly probable that GRE over IPSec use only ESP to reduce overhead

class ah-ipsec1

match ip address 111

class esp-ipsec2

match ip address 112

policy-map tunneltraffic

class ah-ipsec1

class esp-ipsec2

le'ts suppose fas0/0 is the public interface on HUB

int fas0/0

service-policy tunneltraffic out

check with

sh policy-map int fas0/0

you will get counters for each class

this will allow also to introduce QoS if needed in the future

another method could be ip accounting

int fa0/0

ip accounting output-packets

check with

sh ip accounting

but it does not provide rates only counters that increase over time

A third method could be egress netflow

Hope to help

Giuseppe