pwru is one of the best tools for troubleshooting Linux network issues. The full name of pwru is Packet Where Are You?,How does it work?eBPF allows us to attach hooks to kernel functions. When a kernel function is executed, eBPF can define additional actions, such as recording the function and its parameters and then printing them out.When Linux starts, it generates /proc/kallsyms, a file that pwru reads to locate all functions related to skb (the data structure for network packets in the kernel). Then, pwru hooks into these functions. This allows eBPF to track the exact path a packet takes th...

Most of the time, when we develop software or even use software, we play within the safe boundaries of the operating system. We might not know how the network interface welcomes that IP packet, nor how the filesystem handles the inodes when we save a file.This boundary is called user space, which is where we write applications, libraries, and tools. But there's another world, kernel space, where the operating system's kernel resides and is responsible for managing system resources such as memory, CPU, and I/O devices.We usually don’t need to go below the socket or file descriptor level, ...