use only active packages to give user data

this means we know what values were set in ebpf. It is a bit
magic how often this will get called.