Squid increases outgoing traffic.

Hello!

I encounter just a nice problem when check statistics. As I think, if
there are no cached data in the squid cache then, when we fetch some
data from outside world, incoming (that squid fetch from remote server)
and outgoing (that squid sends to client browser) traffic must be
equivalent. But I encounter that outgoing traffic much bigger than
incoming.

To verify this I make an experiment. I done:
  1. clean up cache directory of browser (Netscape communicator 4.72)
     and restart it.
  2. wipe out all squid chache and recreate it with squid -z
  3. add some ipfw rules to count traffic
  4. restart squid
  5. fetch only main pages from some different sites to minimize
     caching.

Client browser and squid at the same system. Browser uses localhost:3128
as a proxy cache.

After that ipfw counters was:

  00100 2656 1841142 count tcp from any 8000-8104,80 to 195.239.204.61
  00200 2983 356736 count tcp from 195.239.204.61 to any 8000-8104,80
  00300 4112 3213318 count tcp from 127.0.0.1 3128 to 127.0.0.1 1024-65535
  00400 3784 498394 count tcp from 127.0.0.1 1024-65535 to 127.0.0.1 3128

As you can see, outgoing traffic almost two times bigger then incoming,
but there are no caching was done by squid! The access.log for this
tranfers in attachment. There are cache.log also.

My system: FreeBSD 4.0-STABLE
Squid Cache: Version 2.3.STABLE2

Here is my squid.conf:
===
cache_mem 4 MB
maximum_object_size 1024 KB
cache_dir ufs /var/spool/squid 30 8 128
cache_access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log
cache_store_log none
pid_filename /var/run/squid.pid

acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 563
acl Safe_ports port 80 21 443 563 70 210 1025-65535
acl Safe_ports port 280
acl Safe_ports port 488
acl Safe_ports port 591
acl Safe_ports port 777
acl CONNECT method CONNECT

http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

http_access allow localhost
http_access deny all

icp_access allow all
miss_access allow all

cache_effective_user squid
cache_effective_group httpds
===

Now the question:

  What I must to do to reduce outgoing squid traffic in
  such situations and why this happens?

Any help welcome.
Sorry for my poor english.

-- 
_________________________  ________________________________________________
Vladimir A. Petrov       \ \ I had slept and seen a dream, I seen a Windows
aka vap (vap@infopac.ru) _\ \____ of the future, and it was almost working.