Is this a warning?

Because my fetches seemed to stay on-line longer than expected, I checked
the: tail -f /var/log/messages
which showed:
=> Nov 5 17:58:18 localhost pppd[13329]:
Sent 106885 bytes, received 2406182 bytes.

Now I know that my on-line fetch was simply:
cd /mnt/p11/Graphics/Txt2Speech ; g12 NwsLstD NwsLstDd

Which means 'lynx -dump the list of URLs in NwsLstD' >> NwsLstDd.

And: `ls -l` shows 725741.

And I did one other fast-little fetch of about 8KB.

So 2'406'182 - 725'741 means two thirds or some 1M4 is unaccounted for.

So, I checked 'what files have changed in the last 90 minutes' via
`find /mnt/p6 -mmin -90`
also in /root, /etc, /usr, /bin, /sbin ...
but I can't find anything unexpected or which can account for the extra 1M4
received.

Am I paranoid if I think it could have been received and self-deleted?
What about code being received, run and then deleted?

== TIA.

Oh Hell! You have to put it in writing to stimulate the ideas!!
`lynx -dump <URL>` receives all the html-crap which is much more than
what it saves to file. But normally not 3 times as much, because it skips
the graphic images. I wrongly though that lynx is so much faster because
it fetches only the text. Which is wrong. It fetches all the http-wrapping,
and discards it. Of course it skips fetching the images.
So it's economical in not fetching the images,
and not saving the http-wrapping.
You have to have a [perceived] problem to put your mind to it.
BTW it's a problem; NOT an 'issue' and definitely NOT a challenge.