# cilium/pwru

Packet, where are you? -- eBPF-based Linux kernel networking debugger

Repository: https://github.com/cilium/pwru
Canonical: https://ross.abutalabs.com/products/pwru
Language: C
License: Apache-2.0
License Family: permissive
Topics: linux, network, ebpf, bpf, tracing, kernel
Last push: 2026-08-24T09:51:09+00:00

## Health v2 (maintenance only)
Score: 89/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 99, release rhythm 69, longevity 100
- inputs: {"age_days": 1786, "days_push": 9, "days_rel": 51, "gap_med": 166.0, "n_releases_24m": 5}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3813, forks 227 (observed 2026-08-28T04:08:20.799973+00:00)

## What it is
pwru is an eBPF-based CLI tool for tracing network packets through the Linux kernel with fine-grained filtering. It helps debug connectivity issues by showing where packets are dropped or processed inside kernel functions.

## Use cases
- trace where a packet is dropped in the linux kernel
- debug network connectivity issues with ebpf
- find which iptables rule drops my packets
- trace packet flow through kernel functions
- debug kubernetes node networking packet loss
- inspect skb lifecycle in the kernel

## When to choose
- you need to see exactly where packets are dropped or transformed inside the Linux kernel
- you're debugging complex networking setups like iptables, eBPF programs, or routing on Linux >= 5.3
- you want a single static binary with pcap-filter-style packet filtering

## When to avoid
- you need userspace application-level packet analysis (use tcpdump or Wireshark instead)
- your kernel is older than 5.3 or lacks CONFIG_DEBUG_INFO_BTF
- you need a cross-platform tool - pwru is Linux-only

## Facets
- artifact type: cli-tool
- maturity: active
- function: tracing, monitoring, networking, developer-tools
- domain: networking, developer-tools, operating-systems
- platform: cli
- tags: ebpf, bpf, kernel-debugging, packet-tracing, kprobes, network-debugging, debugging, linux

## Member repositories
- cilium/pwru (main) score 89

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:20.799973+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:26:35.447313+00:00, confidence not recorded.
  - readme: https://github.com/cilium/pwru (fetched 2026-08-28T04:08:20.799973+00:00, sha 7c0e950d7a2e)
- Data as of 2026-08-30T08:39:29.467469+00:00.