Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Packet, where are you? -- eBPF-based Linux kernel networking debugger
| Date | Stars |
|---|---|
| 2026-07-24 | 3793 |
| 2026-07-25 | 3793 |
| 2026-07-28 | 3793 |
| 2026-07-30 | 3793 |
| 2026-08-06 | 3793 |
Today
— stars today
This week
— stars this week
This month
— stars this month
Momentum
35.0
growth rate 0.00%/day
# pwru (packet, where are you?)
[](https://github.com/cilium/pwru/actions/workflows/test.yml)
[](https://github.com/cilium/pwru/releases/latest)
`pwru` is an [eBPF](https://ebpf.io)-based tool for tracing network packets in
the Linux kernel with advanced filtering capabilities. It allows fine-grained
introspection of kernel state to facilitate debugging network connectivity issues.
The following example shows where the packets of a `curl` request are dropped
after installing an IP tables rule:
## Running
### Requirements
`pwru` requires >= 5.3 kernel to run. For `--output-skb` >= 5.9 kernel is required. For `--backend=kprobe-multi` >= 5.18 kernel is required.
`pwru` optionally requires `debugfs`. It has to be mounted in `/sys/kernel/debug`. In case the folder is empty, it can be mounted with:
```
mount -t debugfs none /sys/kernel/debug
```
The following kernel configuration is required.
| Option | Backend | Note |
| ------------------------ | -------------|----------------------------------------------------- |
| CONFIG_DEBUG_INFO_BTF=y | both | available since >= 5.3 |
| CONFIG_KPROBES=y | both | |
| CONFIG_PERF_EVENTS=y | both | |
| CONFIG_BPF=y | both | |
| CONFIG_BPF_SYSCALL=y | both | |
| CONFIG_FUNCTION_TRACER=y | kprobe-multi | /sys/kernel/debug/tracing/available_filter_functions |
| CONFIG_FPROBE=y | kprobe-multi | available since >= 5.18 |
You can use `zgrep $OPTION /proc/config.gz` to validate whether option is enabled.
### Downloading
You can download the statically linked executable for x86\_64 and arm64 from the
[release page](https://github.com/cilium/pwru/releases).
### Usage
```
$ ./pwru --help
Usage: ./pwru [options] [pcap-filter]
Available pcap-filter: see "man 7 pcap-filter"
Available options:
--all-kmods attach to all available kernel modules
--backend string Tracing backend('kprobe', 'kprobe-multi'). Will auto-detect if not specified.
--filter-func string filter kernel functions to be probed by name (exact match, supports RE2 regular expression)
--filter-ifname string filter skb ifname in --filter-netns (if not specified, use current netns)
--filter-kprobe-batch uint batch size for kprobe attaching/detaching (default 10)
--filter-mark mark[/mask] filter skb mark (format: mark[/mask], e.g., 0xa00/0xf00) (default 0x0)
--filter-netns string filter netns ("/proc/<pid>/ns/net", "inode:<inode>")
--filter-non-skb-funcs strings filter non-skb kernel functions to be probed (--filter-track-skb-by-stackid will be enabled)
--filter-trace-tc trace TC bpf progs
--filter-trace-xdp trace XDP bpf progs
--filter-track-bpf-helpers trace BPF helper functions
--filter-track-skb trace a packet even if it does not match given filters (e.g., after NAT or tunnel decapsulation)
--filter-track-skb-by-stackid trace a packet even after it is kfreed (e.g., traffic going through bridge)
--filter-tunnel-pcap-l2 string pcap expression for vxlan/geneve tunnel (l2)
--filter-tunnel-pcap-l3 string pcap expression for vxlan/geneve tunnel (l3)
-h, --help display this message aExcerpt of 8,471 characters
Read on GitHub
160
Martynas Pumputis · @isovalent · Switzerland
157
94
92
56
Tobias Klauser · @cilium / @isovalent · Switzerland
48
10
Bill Mulligan · @cilium @ebpf-io @isovalent · Germany
8
Duan Jiong
6
6
Sebastian Wicki · Switzerland
6
5
Immanuel Tikhonov
5
Tom Payne · Switzerland
5
5
Aditi Ghag · Lambda
4
Hengqi Chen · China
4
Robin Gögge · @isovalent · Germany
4
Yutaro Hayakawa · Isovalent at Cisco · United States
3
Quentin Monnet · @githedgehog · United Kingdom
3
Would you bet a product on this? Bounded 0–100 and slow moving.
matched fp:4976d5aa28c69091, topic:tracing