cilium/pwru is an open-source project on GitHub with 3.8k stars, written primarily in C. Packet, where are you? -- eBPF-based Linux kernel networking debugger
Snapshot summary built from the project's own GitHub metadata — there's no written TopGit review yet. The page will update automatically when a full review is published.
WHY NO REVIEW YET
TopGit writes full reviews for the most-starred, most-requested repositories. This page is a snapshot until then — see the READ ME tab for the original README in full.
pwru is an eBPF-based tool for tracing network packets in
the Linux kernel with advanced filtering capabilities. It allows fine-grained
introspection of kernel state to facilitate debugging network connectivity issues.
The following example shows where the packets of a curl request are dropped
after installing an IP tables rule:
Running
Requirements
pwru requires >= 5.3 kernel to run. For --output-skb >= 5.9 kernel is required. For --backend=kprobe-multi >= 5.18 kernel is required.
pwru optionally requires debugfs. It has to be mounted in /sys/kernel/debug. In case the folder is empty, it can be mounted with:
You can use zgrep $OPTION /proc/config.gz to validate whether option is enabled.
Downloading
You can download the statically linked executable for x86_64 and arm64 from the
release page.
Usage
$ ./pwru --help
Usage: ./pwru [options] [pcap-filter]
Available pcap-filter: see "man 7 pcap-filter"
Available options:
--all-kmods attach to all available kernel modules
--backend string Tracing backend('kprobe', 'kprobe-multi'). Will auto-detect if not specified.
--filter-func string filter kernel functions to be probed by name (exact match, supports RE2 regular expression)
--filter-ifname string filter skb ifname in --filter-netns (if not specified, use current netns)
--filter-kprobe-batch uint batch size for kprobe attaching/detaching (default 10)
--filter-mark mark[/mask] filter skb mark (format: mark[/mask], e.g., 0xa00/0xf00) (default 0x0)
--filter-netns string filter netns ("/proc/<pid>/ns/net", "inode:<inode>")
--filter-non-skb-funcs strings filter non-skb kernel functions to be probed (--filter-track-skb-by-stackid will be enabled)
--filter-trace-tc trace TC bpf progs
--filter-trace-xdp trace XDP bpf progs
--filter-track-bpf-helpers trace BPF helper functions
--filter-track-skb trace a packet even if it does not match given filters (e.g., after NAT or tunnel decapsulation)
--filter-track-skb-by-stackid trace a packet even after it is kfreed (e.g., traffic going through bridge)
--filter-tunnel-pcap-l2 string pcap expression for vxlan/geneve tunnel (l2)
--filter-tunnel-pcap-l3 string pcap expression for vxlan/geneve tunnel (l3)
-h, --help display this message and exit
--kernel-btf string specify kernel BTF file
--kmods strings list of kernel modules names to attach to
--output-caller print caller function name
--output-file string write traces to file (rotates at 100MB by default)
--output-file-max-size int max size in MB per file before rotation (default 100)
--output-file-max-age int max age in days to keep rotated files (default 0, no limit)
--output-file-max-backups int max number of rotated files to keep (default 0, no limit)
--output-file-compress compress rotated files with gzip (default false)
--output-json output traces in JSON format
--output-limit-lines uint exit the program after the number of events has been received/printed
--output-meta print skb metadata (default true)
--output-skb print skb
--output-skb-cb print skb->cb
--output-skb-metadata strings print skb metadata (e.g., "skb->mark", "skb->hash"), 4 at most
--output-skb-shared-info print skb shared info
--output-stack print stack
--output-tcp-flags print TCP flags
--output-tunnel print encapsulated tunnel header data
--output-tuple print L4 tuple (default true)
--output-xdp-metadata strings print xdp metadata (e.g., "xdp->rxq->queue_index"), 4 at most
--set-percpu-buf uint32 set the size of buffers to print skb data (used by --output-skb and --output-skb-shared-info) (default 4096)
--timestamp string print timestamp per skb ("current", "relative", "absolute", "none") (default "none")
--version show pwru version and exit
The --filter-func switch does an exact match on function names i.e.
--filter-func=foo only matches foo(); for a wildcarded match, try
--filter-func=".*foo.*" instead.
Running with Docker
Docker images for pwru are published at https://hub.docker.com/r/cilium/pwru.
Also see contrib/scripts/pwru-on-k8s-node for a reusable version of this script.
Distro packages
pwru is available in some distro packages. GH#89 tracks any packaging work and progress.
Running on Vagrant
See docs/vagrant.md
Developing
Dependencies
Go >= 1.16
LLVM/clang >= 12
Bison
Lex/Flex >= 2.5.31
libpcap(-dev)
Building
make
Alternatively, you can build in the Docker container:
make release
Sign-off
Ensure that all commits have Developer Certificate of Origin by adding a Signed-off-by line to your commit messages.
Community
Join the #pwru Slack channel to chat with
developers, maintainers, and other users. This is a good first stop to ask
questions and share your experiences.
Logo Credits
The detective gopher is based on the Go gopher designed by Renee French.
No homepage URL was recorded for cilium/pwru in TopGit's last sync. The README tab above frequently contains screenshots and demo links, or check the repository description on GitHub.
How many stars does cilium/pwru have?
cilium/pwru has 3.8k GitHub stars — refresh the page for the live number, or check github.com/cilium/pwru. TopGit mirrors GitHub's count but does not claim minute-by-minute accuracy.
Is cilium/pwru open source?
Yes — cilium/pwru ships under the Apache-2.0 license, which makes its source code freely readable (and, depending on license terms, forkable and reusable). Source: github.com/cilium/pwru.
What is cilium/pwru?
cilium/pwru (cilium/pwru) is a C project on GitHub. From the project's own README: Packet, where are you? -- eBPF-based Linux kernel networking debugger
Where do I read more about cilium/pwru?
This TopGit page is a snapshot — the READ ME tab shows the project's own README content (links stripped, images preserved). The GitHub repository at github.com/cilium/pwru is the definitive source.
Read full README in the tab above.
Want a second opinion on pwru?
Ask an AI that can read this page — one click and you get its take on pwru.
/pwru
