Why Squid Downloads Can Exceed a Monthly Traffic Quota

A quota report refreshed every ten minutes can miss much more than ten minutes of current traffic. Squid's native transaction logging normally writes the completed transaction, so an open download or CONNECT tunnel may not yet have supplied its final byte count.

First define which traffic the quota counts.

Admission happens before final accounting

A helper can admit a new request using an accounting database. Updating that database later does not automatically stop work already admitted.

Concurrent requests can also consult the same balance. With 20 MB left, two simultaneous 15 MB operations might both be admitted before either changes the total. Accurate reporting afterward cannot undo the excess.

Authentication and external-ACL caching can delay a changed decision further. A cached allow is not a fresh balance check. IP-based accounting can also combine users behind one translated source.

Define the limit you can enforce

A soft monthly policy may permit delayed totals and a documented overshoot allowance. A hard live cap needs an authoritative live meter and enforcement that can act on ongoing traffic.

Decide whether admitted transfers finish, are interrupted, or reserve a budget. Define how concurrent operations share that budget and how failed operations release reservations. A transfer starting just below the limit should have a predictable outcome.

Include rollover, late records, service restarts, and log rotation in the accounting design. Keep durable processing progress; deleting an active log to avoid double counting can instead lose evidence.