I'm a Dev Who Barely Knows the Kernel. Here's How I'm Learning How to Track a Packet with pwru

Short summary

A web developer with minimal kernel knowledge explains pwru, an eBPF-powered tool from the Cilium project that traces packets through the Linux kernel networking stack. Instead of hand-picking functions to trace, pwru uses BTF type metadata to automatically discover every kernel function whose parameters reference an sk_buff struct, then attaches kprobes to all of them simultaneously. The result is essentially a console.log for kernel packet paths, using familiar pcap-filter syntax for filtering.

• •pwru uses eBPF to trace packets through the entire Linux kernel networking stack—like console.log for kernel functions
• •It auto-discovers traceable functions by scanning BTF metadata for any function whose parameters reference sk_buff structs
• •Filters use standard pcap-filter syntax (same as tcpdump), making it accessible to devs without kernel expertise

Generated with AI, which can make mistakes.