I wrote my own proxy and it appears that the data is all stuck in socket buffers. If SNDBUF isn't set, then OS will resize it if you try to write more data than remote can accept. Overall, in my tests I see that this buffer grows to 2.5MB and in wireshark I see that difference grows up to 5MB. As docs from SO_SNDBUF state, actual internal value is usually twice larger than what SO_SNDBUF ports then it kind of starts to make sense where this max 5MB difference is wasted.