title: AWS - Abnormal Data Transfer OUT
body: <p>I´m consistently being charged for a surprisingly high amount of <strong>data transfer out</strong> (from Amazon to Internet).
  I looked into the Usage Reports of the past few months and found out that the Data Transfer Out was coming out of an <strong>Application Load Balancer (ALB)</strong> between the <strong>Internet</strong> and multiple nodes of my <strong>application</strong> (internal IPs). 
  Also noticed that DataTransfer-Out-Bytes is very close to the DataTransfer-In-Bytes in the same load balancer, which is weird (coincidence?). I was expecting the response to each request to be way smaller than the request itself. 
  So, I enabled flow logs in the ALB for a few minutes and found out the following: </p>
  
  <ul>
  <li>Requests coming from the Internet (public IPs) in to ALB = <strong>~0.47 GB</strong>;</li>
  <li>Requests coming from ALB to application servers in the same availability zone = <strong>~0.47 GB</strong>  - ALB simply passing requests through to application servers, as expected. So, about the same amount of traffic.</li>
  <li>Responses from application servers back into the same ALB = <strong>~0.04 GB</strong>  – As expected, responses generate way less traffic back into ALB. Usually a 1K request gets a simple “HTTP 200 OK” response. </li>
  <li>Responses from ALB back to the external IP addresses => <strong>~0.43 GB</strong> – this was mind-blowing. I was expecting ~0.04GB, the same amount received from the application servers. </li>
  </ul>
  
  <p>Unfortunately, ALB does not allow me to use packet sniffers (e.g. tcpdump) to see that is actually coming in and out. Is there anything I´m missing? Any help will be much appreciated. Thanks in advance!</p>
  
  <p>Ricardo.</p>