Network traffic ratio

My graphs have always had a higher incoming traffic volume than outgoing. The ratio seems right but really this should be reversed for a webserver… (as i understand it) I have all ports bar 80 and ssh blocked for incoming traffic.

Is the graph reflecting the linode or the switchport? Is it possible that its reversed? What do other people's web server graphs look like?

What would be the best way of tracking down what's really going on?

Thanks a lot!