egresscost
Attributes network egress cost to individual processes, in real time, on Linux, using eBPF.
Egress is the cloud line item people are worst at predicting. It is invisible during development, it has no quota to hit, and the surprise arrives four weeks later attached to an account, not to a cause.
Two kinds of tool already exist. nethogs and iftop show bytes per process but know nothing about money. Cost Explorer and Kubecost show money, but a day late, aggregated per account, with no idea which process on which host caused it. Nothing joins the two. egresscost answers the question left over: which process on this box is generating egress charges, to where, and at what dollar rate.
egresscost aws us-east-1 (us-east-1a)
ebpf (kernel 6.8.0, programs: egress, tcp_sendmsg, udp_sendmsg) for 4m12s
1.31 TiB at 1.28 GiB/s
$118.42 egress + $59.21 NAT = $177.63 projected $1830.44/month
WHAT BYTES SHARE COST
- backup-agent 892 GiB 66.5% $118.68
- internet 892 GiB 66.5% $118.68
52.94.12.7 892 GiB 66.5% $118.68 aws us-east-1 S3
+ nginx 310 GiB 23.1% $41.27
+ prometheus 98 GiB 7.3% $13.04
+ (unattributed) 41 GiB 3.1% $5.46
What it actually measures
- Wire bytes. IP and TCP headers included, retransmits included. Measured at the cgroup v2 egress hook, not inferred from what a process handed to a socket.
- No lost bytes. A packet the kernel cannot attach to a process is still counted, in a row that says so. Totals stay correct even when attribution does not.
- No floating point in a cost path. Money is an integer count of nano-dollars, computed from a byte total and never by summing rounded amounts.
- Unknown is not free. Traffic to a private address stays “unpriced” until an availability-zone map is supplied. A plausible wrong number is worse than a visible gap.
How it is built
Two eBPF programs cooperate in the kernel, joined by socket cookie: one counts bytes on the way out, the other records which process owns each socket. Userspace resolves the destination by longest-prefix match against the IP ranges AWS, GCP and Azure publish, classifies the network path, then applies list prices. Everything that can be pure is pure: only two crates touch the kernel, so a capture can be replayed and the cost model developed on any operating system.