BAbauruine·Jan 8, 2025
If you don't know it yet check out pwru [0] it's an eBPF based tool that let's you trace packets through the kernel using a tcpdump style syntax.
[0]: https://github.com/cilium/pwru
In Linux Routing Fundamentalscilium
pwru
C2022–2025
cilium / pwru
pwru
Packet, where are you? -- eBPF-based Linux kernel networking debugger
7Distinct people
7Mentions
0Explicit recommenders
3.9KGitHub stars
What to know before exploring
What it is
Packet, where are you? -- eBPF-based Linux kernel networking debugger
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year7 dated mentions
Observed mentions: 2022-03-03 21:11:06 UTC to 2025-01-08 14:19:18 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 2 | 1 | 1 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 2 | 1 | 1 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 1 | 0 | 1 |
What Hacker News says
7 sourcesTwo other projects in the same vein:
https://github.com/YutaroHayakawa/ipftrace2
https://github.com/cilium/pwru
In Tracing packets in the Linux kernel networking stack and friendsPacket, where are you? eBPF-based Linux kernel networking debugger
2 points · Open discussionif you have a recent enough kernel, this change https://github.com/cilium/pwru/pull/148 means that it will print the reason the packet was dropped in the output, as logged by kfree_skb_reason - see https://lwn.net/Articles/885729/
There's a whole heap of reasons a packet can be dropped:
https://github.com/torvalds/linux/blob/76f598ba7d8e2bfb4855b...
In any case, this makes it less painful than going back to read the kernel source. I don't think that the gif in the README is up to date with this change - it's 2 years old and this feature only appeared 2 months ago.
In Packet, where are you? – eBPF-based Linux kernel networking debuggerPacket, where are you? – eBPF-based Linux kernel networking debugger
143 points · Open discussionpwru (https://github.com/cilium/pwru) is a fun new tool from the Cilium folks for tracing network packets in the kernel. Like tcpdump but you can trace the full path of the packet including kernel syscalls. Lets you debug much deeper than "when the packet gets to this port it gets dropped".
In New(ish) command line toolsI recently came across another useful utility for debugging unexpected packet drops - PWRU[0] (Packet, Where Are You) by Cilium.
It uses eBPF to try to trace the path of the packet through the kernel. Haven't needed to use it yet, but it could have saved me a lot of trouble in the past.
[0]: https://github.com/cilium/pwru
In Better visibility into Linux packet-dropping decisions