> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/administration/support-and-billing/billing-faq.md).

# Billing FAQ

***

## How is Overhead Traffic billed? <a href="#billingfaq-howisoverheadtrafficbilled" id="billingfaq-howisoverheadtrafficbilled"></a>

All traffic that runs over the Link11 Infrastructure (and is not filtered by DDoS filters) is considered Clean Traffic.&#x20;

As a customer, you agree to a specific amount of clean traffic. If the agreed traffic is exceeded, a bill accounting for that traffic is sent at the end of the year. If you wish to pay this traffic monthly, you can tell your Link11 Sales Representative to change this accordingly.

The following questions give a more in depth explanation of what traffic is billed and how the volume of traffic is calculated.

## **What is Clean Traffic?**

Clean traffic is defined as the accumulated Gigabytes transported in and out each month that are routed via the Link11 WebDDoS platform but were not blocked by the Link11 DDoS Mitigation Engine.

Max Cleanpipe is a static value that shows how much bandwidth the customer has committed to in their contract. Exceeded data traffic is billed at a rate specified in the contract.

You can find the Max Cleanpipe values in [Secure CDN Bandwidth Tab](/product-guides/secure-cdn/interface/dashboard.md#id-securecdn-dashboard-bandwidth) and [Web DDoS Bandwidth Tab](/product-guides/web-ddos/interface/dashboard.md#id-webddos-dashboard-bandwidth).

## **How is traffic volume calculated?**

For different scenarios, different calculations are used. Below are graphics explaining this.

<figure><img src="/files/25t0IcIpf1WqJsl5ODm8" alt=""><figcaption></figcaption></figure>

**Scenario A:** In this scenario, 1200KB are sent over the Link11 Infrastructure (200KB as requests, and 500KB as replies)

<figure><img src="/files/mJs13FVnzA5MUHqKD6WN" alt=""><figcaption></figcaption></figure>

**Scenario B:** In this scenario, the traffic gets blocked by the DDoS filters before it enters the Link11 infrastructure. As such, it doesn’t count towards traffic volume.

<figure><img src="/files/XEkpUFucusZtY81zi9cu" alt=""><figcaption></figcaption></figure>

**Scenario C:** In this scenario, traffic isn’t blocked by the DDoS Filters, and therefore enters the Link11 infrastructure. Although the filters didn’t detect anything, the policers of the WAF (Web Application Firewall) do detect anomalies and block the request.

<figure><img src="/files/JlLQC5xQsXb6K1PwJ9ZR" alt=""><figcaption></figcaption></figure>

**Scenario D:** In this scenario, the request isn’t received by the origin, because the Content Cache served the requested content already. The request has still gone over the Link11 Infrastructure, and counts towards the total clean traffic.

## **Why doesn’t the traffic volume on our platform match the Link11 traffic volume?**

As you can see in the diagrams above, there are some scenarios where no traffic is received by the origin (Scenarios C and D) but traffic is still sent over the Link11 infrastructure.

## **Which time zone is used to measure traffic intervals?**

The traffic interval metrics are measured according to the UTC (+00:00) time zone.