This topic provides the reasons why the traffic amount that is found by using the monitoring and usage analytics feature or the usage statistics feature provided by CDN is different from the traffic amount that is logged.

Symptoms

Why is the traffic amount found by using the monitoring and usage analytics feature or the usage statistics feature in the CDN console or by calling API operations different from the traffic amount that is logged? In most cases, the traffic amount that is logged is less than the traffic amount that is found by using the monitoring and usage analytics feature or the usage statistics feature.

Causes

The logged traffic amount that is recorded by the response size field in logs includes only the amount of traffic that is collected at the application layer. The actual amount of network traffic at the network layer is 7% to 15% higher than the traffic that is collected at the application layer. The difference between the traffic at the network layer and that at the application layer includes the following items:
  • Insertion of TCP and IP packet headers

    Before data transmission, traffic at the application layer needs to be encapsulated into TCP packets by using the TCP protocol at the transport layer and then encapsulated into IP packets by using the IP protocol at the network layer. The maximum size of an IP packet is 1,500 bytes, in which the TCP protocol header and the IP protocol header each occupies 20 bytes. The traffic consumed by the headers is not collected at the application layer. Therefore, the 40 bytes are not logged. The traffic consumed by the headers accounts for at least 2.74% (40/(1,500-40)) of the logged traffic. The smaller the application layer data, the larger the proportion. In most cases, the proportion is approximately 3%.

  • Retransmission of TCP packets

    Due to the complex network conditions on the Internet, about 3% to 10% of packets are lost in the case of network congestion and device failures. The retransmission of lost packets is processed by the protocol stack of the OS kernel and cannot be logged at the application layer. The retransmission of TCP packets also consumes traffic.

Due to the preceding additional traffic-consuming items, the actual traffic amount is conventionally the sum of the traffic amount that is recorded by the response size field in logs and 7% to 15% of the additional traffic. Bills are generated based on the actual traffic amount. CDN includes only 10% of the additional traffic in the actual traffic amount. Therefore, you are charged for the actual traffic amount that is 1.1 times of the traffic amount recorded by the response size field in logs.