# Bpf\_filter not working?
**URL:** https://discuss.elastic.co/t/bpf-filter-not-working/84999
**Category:** Beats
**Tags:** packetbeat
**Created:** [May 9, 2017, 2:33am UTC](https://discuss.elastic.co/t/bpf-filter-not-working/84999 "2017-05-09T02:33:52Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@billzy](https://discuss.elastic.co/u/billzy)
#### Post date: [May 9, 2017, 2:33am UTC](https://discuss.elastic.co/t/bpf-filter-not-working/84999/1 "2017-05-09T02:33:52Z")
hello ,
Lately I upgrade to use packetbeat version 5.x, I found bpf\_filter option not working as previously in packetbeat version 2.x, basically if I set this option in configuration file, I can still see packetbeat which is not qualified with this filter syntax coming in .
the configuration I 'm using is as below,
packetbeat.interfaces.bpf\_filter: "host 32.3.1.1 and 32.3.18.101 and port 18001"
then I can still receive packetbeat from another IP address like 32.3.1.4 with port 18001
Any ideas ? or did I miss something ?
thanks for your help in advance.
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [May 9, 2017, 1:17pm UTC](https://discuss.elastic.co/t/bpf-filter-not-working/84999/2 "2017-05-09T13:17:14Z")
Can you enable the sniffer debug log with `-d "sniffer"`? This should print the BPF filter to be installed with the sniffer during setup.
---
### Author:  [@billzy](https://discuss.elastic.co/u/billzy)
#### Post date: [May 11, 2017, 7:57am UTC](https://discuss.elastic.co/t/bpf-filter-not-working/84999/3 "2017-05-11T07:57:56Z")
Thanks for the reply I'll make a test and get back here.
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [May 11, 2017, 10:29am UTC](https://discuss.elastic.co/t/bpf-filter-not-working/84999/4 "2017-05-11T10:29:08Z")
which exact packetbeat version are you using? It might be early 5.x releases actually having a bug not correctly applying the filter.
---
### Author:  [@billzy](https://discuss.elastic.co/u/billzy)
#### Post date: [May 11, 2017, 12:13pm UTC](https://discuss.elastic.co/t/bpf-filter-not-working/84999/5 "2017-05-11T12:13:54Z")
the version I'm using is 5.2.3, should I update to the latest version ?
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [May 11, 2017, 10:08pm UTC](https://discuss.elastic.co/t/bpf-filter-not-working/84999/6 "2017-05-11T22:08:17Z")
not sure. maybe you want to try with both version.
---
### Author:  [@billzy](https://discuss.elastic.co/u/billzy)
#### Post date: [May 17, 2017, 3:34am UTC](https://discuss.elastic.co/t/bpf-filter-not-working/84999/7 "2017-05-17T03:34:20Z")
I made the test and here is the result,
by applying -d "sniffer", I found the bpf\_filter config did not take effect, even if I upgrade to packetbeat 5.4.
and also I found memcache's port 11211 was always on no matter if I annotate the 11211 port in configuration file.
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [May 17, 2017, 12:35pm UTC](https://discuss.elastic.co/t/bpf-filter-not-working/84999/8 "2017-05-17T12:35:31Z")
Thanks for testing. This is clearly a bug. Can you [report this on github](https://github.com/elastic/beats/issues)?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 14, 2017, 12:35pm UTC](https://discuss.elastic.co/t/bpf-filter-not-working/84999/9 "2017-06-14T12:35:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.