RAW attacks are better controlled with sim/sec and not simusers because the transactions are very short and 2 simusers can generate a great amount of bandwidth, the router on the other side counts layer 3 traffic only whereas Avalanche counts the traffic as it is sent on the wire. That is the reason of the difference.