# Network Load Balancer

> A Network Load Balancer bills a fixed hourly charge plus NLCU-hours metered separately per protocol. TCP, UDP, and TLS each count new connections, active connections, and processed bytes on their own. ZopNight keeps 90 days of NLB namespace metrics and flags load balancers billing hourly with no traffic.

Source: https://zop.dev/integrations/aws/nlb
Updated: 2026-08-19

---

A Network Load Balancer (NLB) handles TCP, UDP, and TLS traffic at layer 4, billed per hour plus capacity units. Like all ELB types, an NLB accrues its hourly charge regardless of traffic volume.

## Layer 4 billing mechanics

An NLB bills its fixed hourly rate from creation to deletion, plus usage in NLCU-hours. The capacity unit is measured per protocol. TCP, UDP, and TLS each track new connections, active connections, and processed bytes independently, with TLS also counting handshake work. Each protocol's hour bills on its highest dimension. In practice most NLBs are traffic-light: the fixed hourly charge dominates, which is exactly why an idle one is worth finding.

## Where NLBs go idle

NLBs front infrastructure rather than websites: databases exposed to peered networks, gRPC backends, PrivateLink endpoint services, syslog collectors. When that infrastructure is decommissioned, the NLB rarely goes with it, because layer 4 load balancers are wired into VPC plumbing that nobody wants to touch. A PrivateLink service whose consumers all disconnected still holds its NLB, billing hourly for a private front door no one walks through.

## Detection over 90 days

Load balancers are discovered on the 6-hour cycle. Hourly CloudWatch metrics from the NLB namespace run with a 90-day lookback, long enough to distinguish genuinely idle from monthly-batch quiet, with per-resource cost from Cost Explorer or CUR 2.0 and idle-load-balancer recommendations. There is no off state; recovery is deletion, preceded by checking target groups and any PrivateLink endpoint services that depend on the NLB.

## Distinguishing it in the console

EC2 console, then Load balancers, with the Type column reading network. Before deleting one, the Integrated services tab matters more than the traffic charts: an NLB can be the anchor of a PrivateLink endpoint service, and deleting the anchor breaks every consumer of it.