I'm trying to find out why my application has a huge network traffic, particularly, the outbound traffic. Researching the issue, I found a number such packets where length mismatches the difference between sequence numbers (see the example below):
len = 47688 - 47195 = 463, which is exactly the length of the response.
length indicates that the length is over 40MB, which is an odd size for a redirect response. I'd expect those numbers to be the same.
What can it mean and how is it possible?
sudo tcpdump -nn -A 'port 80 and src host 172.25.2.20'
An example of suspicious packet:
22:01:08.829010 IP 172.25.2.20.80 > 172.25.2.7.5353: Flags [P.], seq 47195:47688, ack 73973, win 1389, options [nop,nop,TS val 179483194 ecr 867273499], length 49321584 update+% [b2&3=0x2f31] [8243a] [11825q] [12338n] [8262au][|domain] ....m^a.....!K|@..............P.....,s. ..:3...HTTP/1.1 302 Found Server: nginx Date: Fri, 02 Mar 2018 22:01:08 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=2 Etag: "fdGd1xOMm9JndEsCTLr-3gnaNW-dTGhoVi9Lb_rtYA0=" Location: https://match.sharethrough.com/sync/v1?source_id=882ef0fa44a9ae20d4421c83&source_user_id=fdGd1xOMm9JndEsCTLr-3gnaNW-dTGhoVi9Lb_rtYA0%3D Set-Cookie: pl_user_id=fdGd1xOMm9JndEsCTLr-3gnaNW-dTGhoVi9Lb_rtYA0=; Domain=powerlinks.com; Max-Age=315360000
UPD: As it happens in AWS Cloud, I've asked them to revise the bills and explain the charges which were based on Network Usage. I'm waiting for their response.