pwru review
A focused Linux utility for tracing packets through kernel networking paths.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
pwru is an open-source command-line utility for tracing network packets through the Linux kernel with eBPF. It is designed for engineers debugging connectivity and networking behavior at host level, particularly when packet paths, kernel functions, namespaces, interfaces, TC programs, or XDP programs need closer inspection. Its focus is Linux network visibility rather than general application observability, and it runs as a self-hosted tool rather than a hosted service.
The strongest part of pwru is its filtering and output depth. PCAP-based packet filtering can narrow investigations to relevant traffic, while kernel-function filters support exact or regular-expression matching. Network-namespace and interface filters add further control. Traces can include packet metadata, tuples, stacks, tunnel details, TCP flags, and SKB information. JSON output and rotating trace files support structured analysis and longer-running capture workflows. Docker execution and deployment as a privileged Kubernetes pod on a node extend the tool to containerized environments.
pwru is a strong choice for Linux specialists who need detailed packet-level and kernel-path visibility without adopting a broad observability platform. Its narrow scope is also the main boundary: it is not intended for application tracing or kernel profiling, and Linux is the supported operating system. Teams seeking a hosted service, cross-platform coverage, or application-level telemetry should choose a product built around those requirements instead. For host-level Linux networking diagnosis, pwru offers a concentrated feature set centered on tracing where packets move and how the kernel handles them.
pwru pros and cons
- Where it wins
- Filters packets with PCAP, kernel functions, namespaces, and interfaces
- Shows packet metadata, stacks, tuples, tunnels, TCP flags, and SKB output
- Supports JSON traces, rotating files, Docker, and Kubernetes-node execution
- Where it doesn't
- Linux-only deployment limits use on other operating systems
- Self-hosted operation requires host-level deployment and administration
- Does not provide application tracing or kernel profiling
pwru fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update