eBPF-based Linux kernel networking debugger for tracing and filtering network packets with fine-grained introspection.
pwru (packet, where are you?) is an eBPF-based tool for tracing network packets in the Linux kernel with advanced filtering capabilities. It provides fine-grained introspection of kernel state to facilitate debugging complex network connectivity issues, such as identifying where packets are dropped or transformed.
Linux kernel developers, network engineers, and SREs/DevOps engineers who need to diagnose low-level networking issues in the kernel that traditional tools cannot easily reveal.
Developers choose pwru for its ability to trace packets with precision across kernel transformations (like NAT or tunnel decapsulation) and after they are freed, using advanced pcap-style filtering and multiple output formats. Its eBPF foundation and support for multiple tracing backends (kprobe, kprobe-multi) offer deep visibility into kernel networking internals.
Packet, where are you? -- eBPF-based Linux kernel networking debugger
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports pcap-style expressions and filtering by kernel function names, network namespaces, interfaces, and marks, enabling precise trace targeting for complex debugging.
Offers multiple output formats including JSON, with options to print metadata, stack traces, TCP flags, and tunnel headers, facilitating integration with analysis tools.
Can trace packets across transformations like NAT or tunnel decapsulation using --filter-track-skb, and even after they are freed with --filter-track-skb-by-stackid, revealing hidden network issues.
Supports both kprobe and kprobe-multi backends for compatibility across kernel versions, ensuring wider usability as noted in the kernel version requirements.
Optionally traces BPF helper functions with --filter-track-bpf-helpers, providing insights into eBPF program behavior in networking contexts.
Requires kernel >=5.3 with specific configurations like CONFIG_DEBUG_INFO_BTF=y, and features like --output-skb need >=5.9, limiting deployment on older or custom kernels.
Using kprobes for tracing can introduce significant performance impact, making it unsuitable for lightweight or continuous production monitoring without careful consideration.
Needs debugfs mounted and kernel config validations, which adds complexity and requires privileged access, as highlighted in the requirements section.
Focused solely on low-level kernel debugging, so it lacks features for application-layer analysis and has a steep learning curve for those unfamiliar with eBPF or kernel internals.