Why is the actual billed network traffic different from the network traffic reported by the logging feature?


The network traffic reported by the logging feature reflects only the network traffic generated at the application layer. The network traffic that occurs at the network layer is 7% to 15% more than the reported network traffic. The extra network traffic may occur because of the following reasons:
  • TCP/IP packet headers

    HTTP requests are transmitted based on a TCP/IP stack. The maximum transmission unit (MTU) over the Internet is 1,500 bytes, of which the headers inserted by the TCP and IP protocols occupy 40 bytes. The headers are inserted into each packet by the system kernel based on the underlying protocols in the TCP/IP stack. The size of the headers is not captured at the application layer, and is not reflected in the logging feature. This leads to an estimated 3% of outbound data that is untracked. This estimate is based on the following calculation: 40/(1,500 - 40) = 2.74%.

  • TCP retransmission

    Depending on the physical network conditions of the Internet, about 3% to 10% of packets may be lost during transmission. The corresponding servers resend the packets that have been discarded during transmission over the Internet. The system kernel and the underlying protocols in the TCP/IP protocol stack process the retransmission and consume some network traffic. This consumption is excluded from the statistics collected at the application layer. The proportion between the network traffic for retransmission and the log statistics result varies, depending on the network conditions. For example, the proportion is lower at off-peak hours in the morning than that at peak hours in the evening. In most cases, the proportion is from 3% to 7%.

Therefore, as an industry standard practice, an excess of 7% to 15% of the consumed network traffic is added to the total billable items. An average proportion of 10% is used for Alibaba Cloud Content Delivery Network (CDN).